November 2016 - Freeradius-Users - lists.freeradius.org

Cisco-AVPair and Access-Accept
by Eugene M. Zheganin 08 Nov '16

08 Nov '16

Hi. I'm trying to restrict a wireless user to a specific SSID. I have a freeradius 3.0.11 server that was configured some time ago when it was running a 2.x version, and this feature was working, then I ported the configs. Now it doesn't work for some reason, and I'm desperately trying to figure out why. It has an PgSQL backend configured and pretty much all of my tweaks are saved there. So, now about what do I see. Seems like when using radtest sequence everything is working as intended: ===Cut=== # radtest -t eap-md5 foobar XXXXX localhost 666 s0m3s3cr3t Loading input data... Read 1 element(s) from input: stdin Loaded: 1 input element(s). Adding new socket: src: 0.0.0.0:0, dst: 127.0.0.1:1812 Added new socket: 6 (num sockets: 1) Transaction: 0, sending packet: 0 (id: 54)... Sent Access-Request Id 54 from 0.0.0.0:16248 to 127.0.0.1:1812 length 99 User-Name = "foobar" User-Password = "XXXXX" NAS-IP-Address = 192.168.3.22 NAS-Port = 666 Message-Authenticator = 0x00 EAP-Code = Response EAP-Type-Identity = 0x3839303238333234323133 EAP-Message = 0x021f0010013839303238333234323133 Transaction: 0, received packet (id: 54). Received Access-Challenge Id 54 from 127.0.0.1:1812 to 0.0.0.0:16248 length 80 EAP-Message = 0x012000160410cc18e96bf6909c2fe2f185b7207c2811 Message-Authenticator = 0x9cccd86e57512c5ebea735dd2c4b5766 State = 0x95e1ebea95c1ef71bbd0a746eddfb07e EAP-Id = 32 EAP-Code = Request EAP-Type-MD5-Challenge = 0x10cc18e96bf6909c2fe2f185b7207c2811 Transaction: 0, sending packet: 1 (id: 247)... Sent Access-Request Id 247 from 0.0.0.0:16248 to 127.0.0.1:1812 length 123 User-Name = "foobar" User-Password = "XXXXX" NAS-IP-Address = 192.168.3.22 NAS-Port = 666 Message-Authenticator = 0x00 EAP-Code = Response EAP-Type-MD5-Challenge = 0x10ea04a9bf38cdd98629a7190157fc268b EAP-Id = 32 State = 0x95e1ebea95c1ef71bbd0a746eddfb07e EAP-Message = 0x022000160410ea04a9bf38cdd98629a7190157fc268b Transaction: 0, received packet (id: 247). Received Access-Accept Id 247 from 127.0.0.1:1812 to 0.0.0.0:16248 length 75 Cisco-AVPair = "ssid=vivat" EAP-Message = 0x03200004 Message-Authenticator = 0x65764b79391e1dadd0ae0cab4a25d2a4 User-Name = "foobar" EAP-Id = 32 EAP-Code = Success Main loop: done. ===Cut=== Everything is in place: Cisco-AVPair = "ssid=vivat" is present in Access-Accept message. But when it comes to the actual exchange with Cisco AP, it is present only in some messages, but not in the last Access-Accept message. Here's the output from the radiusd -X (my message doesn't end with this huge block of text, so please read below too): ===Cut=== (89) session-state: No cached attributes (89) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (89) authorize { (89) policy filter_username { (89) if (!&User-Name) { (89) if (!&User-Name) -> FALSE (89) if (&User-Name =~ / /) { (89) if (&User-Name =~ / /) -> FALSE (89) if (&User-Name =~ /@.*@/ ) { (89) if (&User-Name =~ /@.*@/ ) -> FALSE (89) if (&User-Name =~ /\\.\\./ ) { (89) if (&User-Name =~ /\\.\\./ ) -> FALSE (89) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) { (89) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (89) if (&User-Name =~ /\\.$/) { (89) if (&User-Name =~ /\\.$/) -> FALSE (89) if (&User-Name =~ /(a)\\./) { (89) if (&User-Name =~ /(a)\\./) -> FALSE (89) } # policy filter_username = notfound (89) [preprocess] = ok (89) [chap] = noop (89) [mschap] = noop (89) [digest] = noop (89) suffix: Checking for suffix after "@" (89) suffix: No '@' in User-Name = "foobar", looking up realm NULL (89) suffix: No such realm "NULL" (89) [suffix] = noop (89) eap: Peer sent EAP Response (code 2) ID 10 length 107 (89) eap: Continuing tunnel setup (89) [eap] = ok (89) } # authorize = ok (89) Found Auth-Type = eap (89) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (89) authenticate { (89) eap: Expiring EAP session with state 0xe59bffd0e591e5ca (89) eap: Finished EAP session with state 0x8fd58b5b87df9215 (89) eap: Previous EAP request found for state 0x8fd58b5b87df9215, released from the list (89) eap: Peer sent packet with method EAP PEAP (25) (89) eap: Calling submodule eap_peap to process data (89) eap_peap: Continuing EAP-TLS (89) eap_peap: [eaptls verify] = ok (89) eap_peap: Done initial handshake (89) eap_peap: [eaptls process] = ok (89) eap_peap: Session established. Decoding tunneled attributes (89) eap_peap: PEAP state phase2 (89) eap_peap: EAP method MSCHAPv2 (26) (89) eap_peap: Got tunneled request (89) eap_peap: EAP-Message = 0x020a00461a020a00413164683e249719e1424a4f04aa609ee5610000000000000000d98c65626c0650346ebf7aa6c322f6bd97c564ad4a64afc1003839303238333234323133 (89) eap_peap: Setting User-Name to foobar (89) eap_peap: Sending tunneled request to inner-tunnel (89) eap_peap: EAP-Message = 0x020a00461a020a00413164683e249719e1424a4f04aa609ee5610000000000000000d98c65626c0650346ebf7aa6c322f6bd97c564ad4a64afc1003839303238333234323133 (89) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (89) eap_peap: User-Name = "foobar" (89) eap_peap: State = 0x6ba19a7c6bab8024eb49697d02fb30b2 (89) Virtual server inner-tunnel received request (89) EAP-Message = 0x020a00461a020a00413164683e249719e1424a4f04aa609ee5610000000000000000d98c65626c0650346ebf7aa6c322f6bd97c564ad4a64afc1003839303238333234323133 (89) FreeRADIUS-Proxied-To = 127.0.0.1 (89) User-Name = "foobar" (89) State = 0x6ba19a7c6bab8024eb49697d02fb30b2 (89) WARNING: Outer and inner identities are the same. User privacy is compromised. (89) server inner-tunnel { (89) session-state: No cached attributes (89) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (89) authorize { (89) [chap] = noop (89) [mschap] = noop (89) suffix: Checking for suffix after "@" (89) suffix: No '@' in User-Name = "foobar", looking up realm NULL (89) suffix: No such realm "NULL" (89) [suffix] = noop (89) update control { (89) Proxy-To-Realm := LOCAL (89) } # update control = noop (89) eap: Peer sent EAP Response (code 2) ID 10 length 70 (89) eap: No EAP Start, assuming it's an on-going EAP conversation (89) [eap] = updated (89) [files] = noop (89) sql: EXPAND %{User-Name} (89) sql: --> foobar (89) sql: SQL-User-Name set to 'foobar' rlm_sql (sql): Reserved connection (3) (89) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (89) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'foobar' ORDER BY id (89) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'foobar' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (89) sql: User found in radcheck table (89) sql: Conditional check items matched, merging assignment check items (89) sql: Cleartext-Password := "XXXXX" (89) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (89) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'foobar' ORDER BY id (89) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'foobar' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (89) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (89) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='foobar' ORDER BY priority (89) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='foobar' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 (89) sql: User found in the group table (89) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id (89) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'public-wifi' ORDER BY id (89) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'public-wifi' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (89) sql: Group "public-wifi": Conditional check items matched (89) sql: Group "public-wifi": Merging assignment check items (89) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id (89) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'public-wifi' ORDER BY id (89) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'public-wifi' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 (89) sql: Group "public-wifi": Merging reply items (89) sql: Cisco-AVPair = "ssid=vivat" (89) sql: Simultaneous-Use := 1 rlm_sql (sql): Released connection (3) (89) [sql] = ok (89) [expiration] = noop (89) [logintime] = noop (89) noresetcounter: WARNING: Couldn't find check attribute, control:Max-All-Session, doing nothing... (89) [noresetcounter] = noop (89) pap: WARNING: Auth-Type already set. Not setting to PAP (89) [pap] = noop (89) } # authorize = updated (89) Found Auth-Type = eap (89) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (89) authenticate { (89) eap: Expiring EAP session with state 0xe59bffd0e591e5ca (89) eap: Finished EAP session with state 0x6ba19a7c6bab8024 (89) eap: Previous EAP request found for state 0x6ba19a7c6bab8024, released from the list (89) eap: Peer sent packet with method EAP MSCHAPv2 (26) (89) eap: Calling submodule eap_mschapv2 to process data (89) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (89) eap_mschapv2: Auth-Type MS-CHAP { (89) mschap: Found Cleartext-Password, hashing to create NT-Password (89) mschap: Found Cleartext-Password, hashing to create LM-Password (89) mschap: Creating challenge hash with username: foobar (89) mschap: Client is using MS-CHAPv2 (89) mschap: Adding MS-CHAPv2 MPPE keys (89) [mschap] = ok (89) } # Auth-Type MS-CHAP = ok (89) MSCHAP Success (89) eap: Sending EAP Request (code 1) ID 11 length 51 (89) eap: EAP session adding &reply:State = 0x6ba19a7c6aaa8024 (89) [eap] = handled (89) } # authenticate = handled (89) } # server inner-tunnel (89) Virtual server sending reply (89) Cisco-AVPair = "ssid=vivat" (89) Simultaneous-Use = 1 (89) EAP-Message = 0x010b00331a030a002e533d41443344413037333132463933303143393530353131383337313442324445464131393430423343 (89) Message-Authenticator = 0x00000000000000000000000000000000 (89) State = 0x6ba19a7c6aaa8024eb49697d02fb30b2 (89) eap_peap: Got tunneled reply code 11 (89) eap_peap: Cisco-AVPair = "ssid=vivat" (89) eap_peap: Simultaneous-Use = 1 (89) eap_peap: EAP-Message = 0x010b00331a030a002e533d41443344413037333132463933303143393530353131383337313442324445464131393430423343 (89) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (89) eap_peap: State = 0x6ba19a7c6aaa8024eb49697d02fb30b2 (89) eap_peap: Got tunneled reply RADIUS code 11 (89) eap_peap: Cisco-AVPair = "ssid=vivat" (89) eap_peap: Simultaneous-Use = 1 (89) eap_peap: EAP-Message = 0x010b00331a030a002e533d41443344413037333132463933303143393530353131383337313442324445464131393430423343 (89) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (89) eap_peap: State = 0x6ba19a7c6aaa8024eb49697d02fb30b2 (89) eap_peap: Got tunneled Access-Challenge (89) eap: Sending EAP Request (code 1) ID 11 length 91 (89) eap: EAP session adding &reply:State = 0x8fd58b5b86de9215 (89) [eap] = handled (89) } # authenticate = handled (89) Using Post-Auth-Type Challenge (89) Post-Auth-Type sub-section not found. Ignoring. (89) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (89) Sent Access-Challenge Id 254 from 192.168.6.144:1812 to 192.168.6.150:1645 length 0 (89) EAP-Message = 0x010b005b19001703010050656716e02838a7522fcd13490f1dba51f91b56e37051fa10585c76459287436e8c326917890fcf38cf35cc531b729d4224a90bd8f9cb2ca2cf5ddc799baa5035360f255734b399a66285f3e608b95092 (89) Message-Authenticator = 0x00000000000000000000000000000000 (89) State = 0x8fd58b5b86de92156a8b280739c58aaf (89) Finished request Waking up in 4.8 seconds. (90) Received Access-Request Id 255 from 192.168.6.150:1645 to 192.168.6.144:1812 length 251 (90) User-Name = "foobar" (90) Framed-MTU = 1400 (90) Called-Station-Id = "001f.ca27.9ea0" (90) Calling-Station-Id = "2c20.0b2a.a0c2" (90) Cisco-AVPair = "ssid=irma" (90) WISPr-Location-Name = "First floor, Hyper, Perm" (90) Service-Type = Login-User (90) Message-Authenticator = 0x856525b7e21a444be06ff736c2a08952 (90) EAP-Message = 0x020b002b19001703010020da2c83c5e5598f4a88b319137aec7e134578362f376c816596640bad33010fde (90) NAS-Port-Type = Wireless-802.11 (90) NAS-Port = 859591 (90) NAS-Port-Id = "859591" (90) State = 0x8fd58b5b86de92156a8b280739c58aaf (90) NAS-IP-Address = 192.168.6.150 (90) NAS-Identifier = "kosm65-hyper-ap1" (90) session-state: No cached attributes (90) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (90) authorize { (90) policy filter_username { (90) if (!&User-Name) { (90) if (!&User-Name) -> FALSE (90) if (&User-Name =~ / /) { (90) if (&User-Name =~ / /) -> FALSE (90) if (&User-Name =~ /@.*@/ ) { (90) if (&User-Name =~ /@.*@/ ) -> FALSE (90) if (&User-Name =~ /\\.\\./ ) { (90) if (&User-Name =~ /\\.\\./ ) -> FALSE (90) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) { (90) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (90) if (&User-Name =~ /\\.$/) { (90) if (&User-Name =~ /\\.$/) -> FALSE (90) if (&User-Name =~ /(a)\\./) { (90) if (&User-Name =~ /(a)\\./) -> FALSE (90) } # policy filter_username = notfound (90) [preprocess] = ok (90) [chap] = noop (90) [mschap] = noop (90) [digest] = noop (90) suffix: Checking for suffix after "@" (90) suffix: No '@' in User-Name = "foobar", looking up realm NULL (90) suffix: No such realm "NULL" (90) [suffix] = noop (90) eap: Peer sent EAP Response (code 2) ID 11 length 43 (90) eap: Continuing tunnel setup (90) [eap] = ok (90) } # authorize = ok (90) Found Auth-Type = eap (90) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (90) authenticate { (90) eap: Expiring EAP session with state 0xe59bffd0e591e5ca (90) eap: Finished EAP session with state 0x8fd58b5b86de9215 (90) eap: Previous EAP request found for state 0x8fd58b5b86de9215, released from the list (90) eap: Peer sent packet with method EAP PEAP (25) (90) eap: Calling submodule eap_peap to process data (90) eap_peap: Continuing EAP-TLS (90) eap_peap: [eaptls verify] = ok (90) eap_peap: Done initial handshake (90) eap_peap: [eaptls process] = ok (90) eap_peap: Session established. Decoding tunneled attributes (90) eap_peap: PEAP state phase2 (90) eap_peap: EAP method MSCHAPv2 (26) (90) eap_peap: Got tunneled request (90) eap_peap: EAP-Message = 0x020b00061a03 (90) eap_peap: Setting User-Name to foobar (90) eap_peap: Sending tunneled request to inner-tunnel (90) eap_peap: EAP-Message = 0x020b00061a03 (90) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (90) eap_peap: User-Name = "foobar" (90) eap_peap: State = 0x6ba19a7c6aaa8024eb49697d02fb30b2 (90) Virtual server inner-tunnel received request (90) EAP-Message = 0x020b00061a03 (90) FreeRADIUS-Proxied-To = 127.0.0.1 (90) User-Name = "foobar" (90) State = 0x6ba19a7c6aaa8024eb49697d02fb30b2 (90) WARNING: Outer and inner identities are the same. User privacy is compromised. (90) server inner-tunnel { (90) session-state: No cached attributes (90) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (90) authorize { (90) [chap] = noop (90) [mschap] = noop (90) suffix: Checking for suffix after "@" (90) suffix: No '@' in User-Name = "foobar", looking up realm NULL (90) suffix: No such realm "NULL" (90) [suffix] = noop (90) update control { (90) Proxy-To-Realm := LOCAL (90) } # update control = noop (90) eap: Peer sent EAP Response (code 2) ID 11 length 6 (90) eap: No EAP Start, assuming it's an on-going EAP conversation (90) [eap] = updated (90) [files] = noop (90) sql: EXPAND %{User-Name} (90) sql: --> foobar (90) sql: SQL-User-Name set to 'foobar' rlm_sql (sql): Reserved connection (4) (90) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (90) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'foobar' ORDER BY id (90) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'foobar' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 (90) sql: User found in radcheck table (90) sql: Conditional check items matched, merging assignment check items (90) sql: Cleartext-Password := "XXXXX" (90) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (90) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'foobar' ORDER BY id (90) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'foobar' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (90) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (90) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='foobar' ORDER BY priority (90) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='foobar' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 (90) sql: User found in the group table (90) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id (90) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'public-wifi' ORDER BY id (90) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'public-wifi' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 (90) sql: Group "public-wifi": Conditional check items matched (90) sql: Group "public-wifi": Merging assignment check items (90) sql: EXPAND SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id (90) sql: --> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'public-wifi' ORDER BY id (90) sql: Executing select query: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'public-wifi' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 (90) sql: Group "public-wifi": Merging reply items (90) sql: Cisco-AVPair = "ssid=vivat" (90) sql: Simultaneous-Use := 1 rlm_sql (sql): Released connection (4) (90) [sql] = ok (90) [expiration] = noop (90) [logintime] = noop (90) noresetcounter: WARNING: Couldn't find check attribute, control:Max-All-Session, doing nothing... (90) [noresetcounter] = noop (90) pap: WARNING: Auth-Type already set. Not setting to PAP (90) [pap] = noop (90) } # authorize = updated (90) Found Auth-Type = eap (90) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (90) authenticate { (90) eap: Expiring EAP session with state 0xe59bffd0e591e5ca (90) eap: Finished EAP session with state 0x6ba19a7c6aaa8024 (90) eap: Previous EAP request found for state 0x6ba19a7c6aaa8024, released from the list (90) eap: Peer sent packet with method EAP MSCHAPv2 (26) (90) eap: Calling submodule eap_mschapv2 to process data (90) eap: Sending EAP Success (code 3) ID 11 length 4 (90) eap: Freeing handler (90) [eap] = ok (90) } # authenticate = ok (90) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (90) post-auth { (90) sql: EXPAND .query (90) sql: --> .query (90) sql: Using query template 'query' rlm_sql (sql): Reserved connection (0) (90) sql: EXPAND %{User-Name} (90) sql: --> foobar (90) sql: SQL-User-Name set to 'foobar' (90) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW()) (90) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('foobar', 'Chap-Password', 'Access-Accept', NOW()) (90) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('foobar', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 (90) sql: SQL query returned: success (90) sql: 1 record(s) updated rlm_sql (sql): Released connection (0) (90) [sql] = ok (90) } # post-auth = ok (90) Login OK: [foobar] (from client kosm65-hyper-ap1 port 0 via TLS tunnel) (90) } # server inner-tunnel (90) Virtual server sending reply (90) Cisco-AVPair = "ssid=vivat" (90) Simultaneous-Use = 1 (90) MS-MPPE-Encryption-Policy = Encryption-Allowed (90) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (90) MS-MPPE-Send-Key = 0x06b51149dd60a7dd863fbdf63d4e5aae (90) MS-MPPE-Recv-Key = 0x2aa6f2b25652dbed7cc71d010c2ba3b0 (90) EAP-Message = 0x030b0004 (90) Message-Authenticator = 0x00000000000000000000000000000000 (90) User-Name = "foobar" (90) eap_peap: Got tunneled reply code 2 (90) eap_peap: Cisco-AVPair = "ssid=vivat" (90) eap_peap: Simultaneous-Use = 1 (90) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (90) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (90) eap_peap: MS-MPPE-Send-Key = 0x06b51149dd60a7dd863fbdf63d4e5aae (90) eap_peap: MS-MPPE-Recv-Key = 0x2aa6f2b25652dbed7cc71d010c2ba3b0 (90) eap_peap: EAP-Message = 0x030b0004 (90) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (90) eap_peap: User-Name = "foobar" (90) eap_peap: Got tunneled reply RADIUS code 2 (90) eap_peap: Cisco-AVPair = "ssid=vivat" (90) eap_peap: Simultaneous-Use = 1 (90) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (90) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (90) eap_peap: MS-MPPE-Send-Key = 0x06b51149dd60a7dd863fbdf63d4e5aae (90) eap_peap: MS-MPPE-Recv-Key = 0x2aa6f2b25652dbed7cc71d010c2ba3b0 (90) eap_peap: EAP-Message = 0x030b0004 (90) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (90) eap_peap: User-Name = "foobar" (90) eap_peap: Tunneled authentication was successful (90) eap_peap: SUCCESS (90) eap: Sending EAP Request (code 1) ID 12 length 43 (90) eap: EAP session adding &reply:State = 0x8fd58b5b85d99215 (90) [eap] = handled (90) } # authenticate = handled (90) Using Post-Auth-Type Challenge (90) Post-Auth-Type sub-section not found. Ignoring. (90) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (90) Sent Access-Challenge Id 255 from 192.168.6.144:1812 to 192.168.6.150:1645 length 0 (90) EAP-Message = 0x010c002b19001703010020e91613a106bb295cae7b0a87d027ebd712cc411de499bb18808b90b53cc2f15e (90) Message-Authenticator = 0x00000000000000000000000000000000 (90) State = 0x8fd58b5b85d992156a8b280739c58aaf (90) Finished request Waking up in 4.7 seconds. (91) Received Access-Request Id 0 from 192.168.6.150:1645 to 192.168.6.144:1812 length 251 (91) User-Name = "foobar" (91) Framed-MTU = 1400 (91) Called-Station-Id = "001f.ca27.9ea0" (91) Calling-Station-Id = "2c20.0b2a.a0c2" (91) Cisco-AVPair = "ssid=irma" (91) WISPr-Location-Name = "First floor, Hyper, Perm" (91) Service-Type = Login-User (91) Message-Authenticator = 0x3154a2b0721aee2ca63c2e6768d81709 (91) EAP-Message = 0x020c002b19001703010020ff094574edca9264a4ba9029f063f398dab865c21940041c73d7f143fc9a963b (91) NAS-Port-Type = Wireless-802.11 (91) NAS-Port = 859591 (91) NAS-Port-Id = "859591" (91) State = 0x8fd58b5b85d992156a8b280739c58aaf (91) NAS-IP-Address = 192.168.6.150 (91) NAS-Identifier = "kosm65-hyper-ap1" (91) session-state: No cached attributes (91) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (91) authorize { (91) policy filter_username { (91) if (!&User-Name) { (91) if (!&User-Name) -> FALSE (91) if (&User-Name =~ / /) { (91) if (&User-Name =~ / /) -> FALSE (91) if (&User-Name =~ /@.*@/ ) { (91) if (&User-Name =~ /@.*@/ ) -> FALSE (91) if (&User-Name =~ /\\.\\./ ) { (91) if (&User-Name =~ /\\.\\./ ) -> FALSE (91) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) { (91) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (91) if (&User-Name =~ /\\.$/) { (91) if (&User-Name =~ /\\.$/) -> FALSE (91) if (&User-Name =~ /(a)\\./) { (91) if (&User-Name =~ /(a)\\./) -> FALSE (91) } # policy filter_username = notfound (91) [preprocess] = ok (91) [chap] = noop (91) [mschap] = noop (91) [digest] = noop (91) suffix: Checking for suffix after "@" (91) suffix: No '@' in User-Name = "foobar", looking up realm NULL (91) suffix: No such realm "NULL" (91) [suffix] = noop (91) eap: Peer sent EAP Response (code 2) ID 12 length 43 (91) eap: Continuing tunnel setup (91) [eap] = ok (91) } # authorize = ok (91) Found Auth-Type = eap (91) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (91) authenticate { (91) eap: Expiring EAP session with state 0xe59bffd0e591e5ca (91) eap: Finished EAP session with state 0x8fd58b5b85d99215 (91) eap: Previous EAP request found for state 0x8fd58b5b85d99215, released from the list (91) eap: Peer sent packet with method EAP PEAP (25) (91) eap: Calling submodule eap_peap to process data (91) eap_peap: Continuing EAP-TLS (91) eap_peap: [eaptls verify] = ok (91) eap_peap: Done initial handshake (91) eap_peap: [eaptls process] = ok (91) eap_peap: Session established. Decoding tunneled attributes (91) eap_peap: PEAP state send tlv success (91) eap_peap: Received EAP-TLV response (91) eap_peap: Success (91) eap_peap: No information to cache: session caching will be disabled for session 85f521474efac4e2d92b4333ade31b11457b502efa6f66a4fe382c1035a654ca (91) eap: Sending EAP Success (code 3) ID 12 length 4 (91) eap: Freeing handler (91) [eap] = ok (91) } # authenticate = ok (91) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (91) post-auth { (91) sql: EXPAND .query (91) sql: --> .query (91) sql: Using query template 'query' rlm_sql (sql): Reserved connection (5) (91) sql: EXPAND %{User-Name} (91) sql: --> foobar (91) sql: SQL-User-Name set to 'foobar' (91) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW()) (91) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('foobar', 'Chap-Password', 'Access-Accept', NOW()) (91) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES('foobar', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 (91) sql: SQL query returned: success (91) sql: 1 record(s) updated rlm_sql (sql): Released connection (5) (91) [sql] = ok (91) [exec] = noop (91) policy remove_reply_message_if_eap { (91) if (&reply:EAP-Message && &reply:Reply-Message) { (91) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (91) else { (91) [noop] = noop (91) } # else = noop (91) } # policy remove_reply_message_if_eap = noop (91) } # post-auth = ok (91) Login OK: [foobar] (from client kosm65-hyper-ap1 port 859591 cli 2c20.0b2a.a0c2) (91) Sent Access-Accept Id 0 from 192.168.6.144:1812 to 192.168.6.150:1645 length 0 (91) MS-MPPE-Recv-Key = 0xc82a301b5b4493b1aea74d7f93996bec688a0dfe8c4858989d4dca2e2d8436f0 (91) MS-MPPE-Send-Key = 0x1abe38ea076f9ba252e4bd2d42bb73aa9ad2ae4812b80b808e496b4c7e80e1aa (91) EAP-Message = 0x030c0004 (91) Message-Authenticator = 0x00000000000000000000000000000000 (91) User-Name = "foobar" (91) Finished request Waking up in 4.7 seconds. ===Cut=== What bothers me is that after the line Login OK: [foobar] (from client kosm65-hyper-ap1 port 0 via TLS tunnel) I see a full Access-Accept answer, which does contain the Cisco-AVPair attribute. But then for some reason there is a second Access-Request from the same AP, and this time freeradius answers with a short Access-Accept message, after a line Login OK: [foobar] (from client kosm65-hyper-ap1 port 859591 cli 2c20.0b2a.a0c2) Why does this happens and how do I fix it ? Thanks. Eugene.

1 1

libmemcached and FR 3.0.12 on CentOS 6.x
by Stefan Paetow 08 Nov '16

08 Nov '16

Hi, I've just tried to build FR 3.0.12 on CentOS 6.x. The rlm_cache_memcached module doesn't build because libmemcached is not available, yet... it is. Arran, Alan, what are you looking for to build with libmemcached (version-wise)? I have both libmemcached and libmemcached-devel packages installed, ditto memcached and memcached-devel. In /usr/lib64, I have several libmemcached.* files, make's found the includes, so... What are we missing? With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

3 5

Help with getting a client to receive a DHCP request
by Toby Walsh 07 Nov '16

07 Nov '16

As per my other threads I'm trying to set up DHCP on Freeradius. Everyone's helped me to get DHCP to seem to be processing requests however my client device is not getting a response so I think I've screwed up the configuration and being a noob I don't know where to start. My topology: (1) ESXi Linux VM <- (2) ESXi pfSense VM -> (3) Unifi switch -> (4) Unifi wifi AP -> (5) test client device I'm ssh'd into (1), (2), (3) and (4) and running: tcpdump -i respective_interface port 67 or port 68 and the output in each is: current_time, IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:11:22:33:44:55 (oui Unknown), length 314 and nothing else, just lines of request in all of (1) - (4). Here's the output from freeradius -X, so you can see how it's responding - http://pastebin.com/raw/74ekNSNF. Any advice to what I've set up wrong? Could it be the message: "DHCP: Reply will be unicast to your-ip-address" where your-ip-address is the address I actually want the test client device to receive in the response, so therefore I need to broadcast to the whole subnet, or at least (4) so that (5) can see it (and I can see it in tcpdump throughout the network)?

2 2

Re: Matching a prefix in huntgroups file
by Brian Candler 07 Nov '16

07 Nov '16

On 06/11/2016 17:48, Alan DeKok wrote: > I am VERY wary of putting automagic casting rules in. I absolutely agree: the more explicit and the less magic, the better. I would rather see an immediate failure with type error than silently continuing with unexpected behaviour. I understand that in FreeRADIUS 4, to reference an attribute you will always have to include the '&'. Are you also going to require that a string literal must be enclosed in double quotes? I think that would be a good idea. In particular, it would protect against accidentally missing an '&', which could otherwise mean that e.g. if (Service-Type == Login-User) # missing '&' is interpreted as if ("Service-Type" == "Login-User") # -> always FALSE But it also means that an unquoted literal like 1.2.3.4 or 1.2.3.4/30, even on the LHS, could be unambiguously parsed as an ipaddr or ipv4prefix respectively. Regards, Brian.

2 1

DHCP server failing to add ARP entry?
by Toby Walsh 07 Nov '16

07 Nov '16

I have a box running Freeradius as a backend to pfSense. I'd like to use FR as a DHCP server. With Alan's help I set up DHCP and EAP on separate sql modules. It works OK when pfSense is serving IPs (FR fails to add an ARP entry but pfSense's DHCP server overrides/ignores FR's anyway). When I turn off the DHCP server on pfSense and try to run exclusively FR's, I get the following key message in my debug: "Failed adding ARP entry: Failed to add entry in ARP cache: Operation not permitted (1)" I read the doco for FR's DHCP server and used the command: "sudo setcap cap_net_admin=ei /usr/sbin/freeradius" and tried eip as well but it had no effect. I'm running: "sudo freeradius -X" as well, just to make sure the privileges are OK. Here is the debug output from a sample connection attempt - http://pastebin.com/raw/acNazHPA . I probably set up my dhcp server incorrectly. Here's an example of my sites-enabled/dhcp_static : http://pastebin.com/raw/S1mb4bFc One thing I did not do is obey the comments at the top of that file instructing to call setfib because I thought the comments implied it was unnecessary when a config doesn't have multiple interfaces. It won't surprise me if many of those server settings are completely incorrect and that is the source of my problem. More info - when I run: "arp -s some_ip some_mac" I get: "SIOCSARP: Operation not permitted" So that's a pretty big clue corresponding to my debug output. However when I run it as sudo it works, obviously. And I run freeradius as sudo so I presumed along with the set capabilities it _should_ work, right? The only other time I found a mailing list response referring to my problem the two solutions were: (i) set broadcast = no in the dhcp server (ii) find out why the arp setting isn't working I'm trying to work out (ii) but the OP never responded in that thread so there was no resolution from them. Thanks, Toby

3 8

Configuring 3.0.12 for RadSec
by Philipp Trenz 07 Nov '16

07 Nov '16

Hi list, I need some help to configure FR for eduroam via RadSec with PEAP/MSChapv2. Depending on the REALM requests, if it is has and is not the local REALM, requests should get proxied to one of two external radius server via RadSec (server_pool ?). And also the other way around FR should be able to receive requests from an external source and authenticate them as local users. Requests, coming from an Access Point or via RadSec, should be processed equally. I'm not quite shure where to start, has anyone a example configuration for me how to do it? Many thanks! Best regards, Philipp Trenz

2 1

PERL and EAL-TLS Modul -> Failed to create pair &request:EAP-Message = $RAD_REQUEST{'EAP-Message'}
by Poltorak, Paul (CT DD DS EVO O BFD TM&ISEC 1) 07 Nov '16

07 Nov '16

Hello all, i'm using source complied version 3.0.12 on an SUSE SLES 12 SP1 x64. EAP-TLS is working fine without PERL. Now I would like to add PERL to do some stuff too. But with enabled perl module it results in error and REJECT. This is my default server server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } authorize { filter_username preprocess auth_log GoPerl EAP } authenticate { EAP } accounting { detail } } This is a snip of the perl script the authorize part. It default return "OK" for testing. I have added RAD_REPLY values for testing too. sub authorize { # # For debugging purposes only # &log_request_attributes; # # # Here's where your authorization code comes # # You can call another function from here: # &test_call; $RAD_REPLY{"Tunnel-Private-Group-id"} = "2"; $RAD_REPLY{"Tunnel-Type"} = "VLAN"; $RAD_REPLY{"Tunnel-Medium-Type"} = "IEEE-802"; return RLM_MODULE_OK; } In that constellation I've got the error " ERROR: (5) GoPerl: Failed to create pair &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} ->" and "There was no response configured: rejecting request ... Using Post-Auth-Type Reject" I have found this https://github.com/FreeRADIUS/freeradius-server/issues/1697, I have changed as "dhpark21" described but then I have many errors at perl modul RAD_REQUEST and RAD_REPLY -> undef then perl modul will not be executed but working with EAP-TLS. Hope someone could help. That is a snip of the debug: --------------------------------------- Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'host/~~~~~~~~~' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> ~~~~~~~~~ Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '60000' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Framed-MTU'} = &request:Framed-MTU -> '9216' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'State'} = &request:State -> '0x217dacef257ba1999dff0cf1ce39de5f' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Called-Station-Id'} = &request:Called-Station-Id -> ~~~~~~~~~ Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> ~~~~~~~~~ Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Proxy-State'} = &request:Proxy-State -> '0x8b16a47700000efc' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'Nov 4 2016 09:09:42 CET' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'EAP-Message'} = &request:EAP-Message -> '0x020605d40dc00000073016030106f00b0005a000059d00059a30820596308204ffa0030201020213160000d0096957d9bd45cc808400060000d009300d06092a864886f70d01010b0500308198311e301c06092a864886f70d010901160f6564764065766f736f66742e636f6d310b30090603550406130244453110300e060355040813074261766172696131123010060355040713094e7572656d6265726731153013060355040a130c45766f736f667420476d624831153013060355040b130c45766f736f667420476d6248311530130603550403130c45766f736f667420476d6248301e170d3136303831353134303134305a170d3138303831353134303134305a301f311d301b0603550403131445564f30323130302e65766f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100afc52515cdb53d2173c492869d2fdf296c2afde310c301240746d2140f93482d2a08c4cda93eed450533635c932804c1776fd15f69ac8942a15a529b4689adf2a0f9db8613f250e91601a964e7611e0815e10d225df9e22ca0119c58f9dede6cc8775ef0f5add475325cd3ad87a93065a1948f9a53d01f10e66ec141fc83a32b571b5ad910a98a016044c39c8832e40fcf6d88cbb5b11a4173877464016d1fc786c28c5d2a04a215e8eecaa6b62241d88bf6d0ca789def' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Message-Authenticator'} = &request:Message-Authenticator -> '0x2bebafeecaeb11596c759f7208148ddf' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> ~~~~~~~~~ Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Cisco-AVPair'}[0] = &request:Cisco-AVPair -> 'service-type=Framed' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Cisco-AVPair'}[1] = &request:Cisco-AVPair -> 'audit-session-id=0A016E020002255B4748D1E8' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: $RAD_REQUEST{'Cisco-AVPair'}[2] = &request:Cisco-AVPair -> 'method=dot1x' SOFT ASSERT FAILED src/modules/rlm_perl/rlm_perl.c[703]: *vps Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Message-Authenticator = $RAD_REQUEST{'Message-Authenticator'} -> '0x2bebafeecaeb11596c759f7208148ddf' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet' Fri Nov 4 09:09:42 2016 : ERROR: (5) GoPerl: Failed to create pair &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} -> '0x020605d40dc00000073016030106f00b0005a000059d00059a30820596308204ffa0030201020213160000d0096957d9bd45cc808400060000d009300d06092a864886f70d01010b0500308198311e301c06092a864886f70d010901160f6564764065766f736f66742e636f6d310b30090603550406130244453110300e060355040813074261766172696131123010060355040713094e7572656d6265726731153013060355040a130c45766f736f667420476d624831153013060355040b130c45766f736f667420476d6248311530130603550403130c45766f736f667420476d6248301e170d3136303831353134303134305a170d3138303831353134303134305a301f311d301b0603550403131445564f30323130302e65766f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100afc52515cdb53d2173c492869d2fdf296c2afde310c301240746d2140f93482d2a08c4cda93eed450533635c932804c1776fd15f69ac8942a15a529b4689adf2a0f9db8613f250e91601a964e7611e0815e10d225df9e22ca0119c58f9dede6cc8775ef0f5add475325cd3ad87a93065a1948f9a53d01f10e66ec141fc83a32b571b5ad910a98a016044c39c8832e40fcf6d88cbb5b11a4173877464016d1fc786c28c5d2a04a215e8eecaa6b62241d88bf6d0ca789def' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> ~~~~~~~~~ Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Proxy-State = $RAD_REQUEST{'Proxy-State'} -> '0x8b16a47700000efc' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'Nov 4 2016 09:09:42 CET' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Framed-MTU = $RAD_REQUEST{'Framed-MTU'} -> '9216' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> ~~~~~~~~~ Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Cisco-AVPair += $RAD_REQUEST{'Cisco-AVPair'} -> 'service-type=Framed' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Cisco-AVPair += $RAD_REQUEST{'Cisco-AVPair'} -> 'audit-session-id=0A016E020002255B4748D1E8' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Cisco-AVPair += $RAD_REQUEST{'Cisco-AVPair'} -> 'method=dot1x' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> ~~~~~~~~~ Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:State = $RAD_REQUEST{'State'} -> '0x217dacef257ba1999dff0cf1ce39de5f' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Called-Station-Id = $RAD_REQUEST{'Called-Station-Id'} -> ~~~~~~~~~ Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> ~~~~~~~~~ Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '60000' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' SOFT ASSERT FAILED src/modules/rlm_perl/rlm_perl.c[703]: *vps Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &reply:Tunnel-Type = $RAD_REPLY{'Tunnel-Type'} -> 'VLAN' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &reply:Tunnel-Private-Group-id = $RAD_REPLY{'Tunnel-Private-Group-id'} -> '2' Fri Nov 4 09:09:42 2016 : Debug: (5) GoPerl: &reply:Tunnel-Medium-Type = $RAD_REPLY{'Tunnel-Medium-Type'} -> 'IEEE-802' Fri Nov 4 09:09:42 2016 : Debug: (5) modsingle[authorize]: returned from GoPerl (rlm_perl) Fri Nov 4 09:09:42 2016 : Debug: (5) [GoPerl] = ok Fri Nov 4 09:09:42 2016 : Debug: (5) modsingle[authorize]: calling EAP (rlm_eap) Fri Nov 4 09:09:42 2016 : Debug: (5) EAP: Got EAP_START message Fri Nov 4 09:09:42 2016 : Debug: (5) modsingle[authorize]: returned from EAP (rlm_eap) Fri Nov 4 09:09:42 2016 : Debug: (5) [EAP] = handled Fri Nov 4 09:09:42 2016 : Debug: (5) } # authorize = handled Fri Nov 4 09:09:42 2016 : Debug: (5) There was no response configured: rejecting request Fri Nov 4 09:09:42 2016 : Debug: (5) Using Post-Auth-Type Reject Fri Nov 4 09:09:42 2016 : Debug: (5) Post-Auth-Type sub-section not found. Ignoring. Fri Nov 4 09:09:42 2016 : Debug: (5) Delaying response for 1.000000 seconds Fri Nov 4 09:09:42 2016 : Debug: Waking up in 0.3 seconds. Fri Nov 4 09:09:43 2016 : Debug: Waking up in 0.6 seconds. Fri Nov 4 09:09:43 2016 : Debug: (5) Sending delayed response Fri Nov 4 09:09:43 2016 : Debug: (5) Sent Access-Reject Id 113 from ~~~~~~~~~to ~~~~~~~~~length 52 Fri Nov 4 09:09:43 2016 : Debug: (5) Tunnel-Type = VLAN Fri Nov 4 09:09:43 2016 : Debug: (5) Tunnel-Private-Group-Id = "2" Fri Nov 4 09:09:43 2016 : Debug: (5) Tunnel-Medium-Type = IEEE-802 Fri Nov 4 09:09:43 2016 : Debug: (5) EAP-Message = 0x0100000501 Fri Nov 4 09:09:43 2016 : Debug: (5) Proxy-State = 0x8b16a47700000efc Fri Nov 4 09:09:43 2016 : Debug: Waking up in 3.9 seconds. Fri Nov 4 09:09:47 2016 : Debug: (0) Cleaning up request packet ID 108 with timestamp +21 Fri Nov 4 09:09:47 2016 : Debug: (1) Cleaning up request packet ID 109 with timestamp +21 Fri Nov 4 09:09:47 2016 : Debug: (2) Cleaning up request packet ID 110 with timestamp +21 Fri Nov 4 09:09:47 2016 : Debug: (3) Cleaning up request packet ID 111 with timestamp +21 Fri Nov 4 09:09:47 2016 : Debug: (4) Cleaning up request packet ID 112 with timestamp +21 Fri Nov 4 09:09:47 2016 : Debug: (5) Cleaning up request packet ID 113 with timestamp +21 Fri Nov 4 09:09:47 2016 : Info: Ready to process requests Fri Nov 4 09:09:47 2016 : Debug: (6) Received Access-Request Id 114 from ~~~~~~~~~to ~~~~~~~~~length 300 Fri Nov 4 09:09:47 2016 : Debug: (6) User-Name = "host/EVO02100.evosoft.com" Fri Nov 4 09:09:47 2016 : Debug: (6) Service-Type = Framed-User Fri Nov 4 09:09:47 2016 : Debug: (6) Framed-MTU = 9216 Fri Nov 4 09:09:47 2016 : Debug: (6) Called-Station-Id = "~~~~~~~~~" Fri Nov 4 09:09:47 2016 : Debug: (6) Calling-Station-Id = "~~~~~~~~~" Fri Nov 4 09:09:47 2016 : Debug: (6) EAP-Message = 0x0201001e01686f73742f45564f30323130302e65766f736f66742e636f6d Fri Nov 4 09:09:47 2016 : Debug: (6) Message-Authenticator = 0xe22b7d268bf88355559f7445f864ad63 Fri Nov 4 09:09:47 2016 : Debug: (6) NAS-IP-Address = ~~~~~~~~~ Fri Nov 4 09:09:47 2016 : Debug: (6) NAS-Port = 60000 Fri Nov 4 09:09:47 2016 : Debug: (6) NAS-Port-Id = "~~~~~~~~~" Fri Nov 4 09:09:47 2016 : Debug: (6) NAS-Port-Type = Ethernet Fri Nov 4 09:09:47 2016 : Debug: (6) Cisco-AVPair = "service-type=Framed" Fri Nov 4 09:09:47 2016 : Debug: (6) Cisco-AVPair = "audit-session-id=0A016E020002255B4748D1E8" Fri Nov 4 09:09:47 2016 : Debug: (6) Cisco-AVPair = "method=dot1x" Fri Nov 4 09:09:47 2016 : Debug: (6) Proxy-State = 0x8b16a47700000efd Fri Nov 4 09:09:47 2016 : Debug: (6) session-state: No State attribute Best Regards, Paul

3 8

RE: rad-error
by Ejaz 06 Nov '16

06 Nov '16

Would you please assist me to get rid of this problem, When I am forwarding request from my NAS/router to radius server, getting below error, attached is complete logs. Thanks in advance for the kind help. (31) sql: ERROR: Error fetching row (31) sql: ERROR: rlm_sql_oracle: ORA-01403: no data found (31) sql: EXPAND SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' (31) sql: --> SELECT GroupName FROM usergroup WHERE UserName='' (31) sql: Executing select query: SELECT GroupName FROM usergroup WHERE UserName='' (31) sql: ERROR: Error fetching row (31) sql: ERROR: rlm_sql_oracle: ORA-01403: no data found (31) sql: User not found in any groups rlm_sql (sql): Released connection (9) (31) [sql] = notfound (31) [expiration] = noop (31) [logintime] = noop (31) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (31) pap: WARNING: Authentication will fail unless a "known good" password is available (31) [pap] = noop (31) } # authorize = ok (31) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (31) Failed to authenticate the user (31) Using Post-Auth-Type Reject (31) # Executing group from file /usr/local/freeradius3/etc/raddb/sites-enabled/default

4 4

DHCP with static IPs and EAP
by Toby Walsh 06 Nov '16

06 Nov '16

> *What you probably need to do (I'm guessing, because you didn't really describe your requirements), is to set up *two* SQL modules:**> * *> * > *# normal RADIUS sql module> sql {> ....**> * *}**> * *> * *# and an SQL module for DHCP**> * *#**> * *sql sql_dhcp {**> * *...**> * *}**> * *> * * The "sql_dhcp" module should initially be copied from "sql", and then modified to work with DHCP.**> * *> * * Then, in the DHCP virtual server, use "sql_dhcp" instead of "sql". And in the RADIUS virtual server, use "sql".**> * *> ** Using two different configurations like this means that they don't conflict with each other.* Thanks Alan, that did the trick nicely. It's spawned a new question so I'll start a new thread. Toby

1 0

DHCP with static IPs and EAP
by Toby Walsh 05 Nov '16

05 Nov '16

I'm new to Freeradius. I'm trying to set up a back-end to talk nicely with a pfSense router and walking through various tutorials and doco pages. I had EAP working nicely but wanted to use DHCP and assign static IPs to devices based on MAC stored in either mac2ip or mysql (mostly mysql since that's what I'm trying to use for config). I get to a stage where, after following the DHCP tutorial I set sql_user_name = "%{DHCP-Client-Hardware-Address}". This works for the purpose of assigning an IP, I assume. But then when FR tries to authenticate EAP, it uses sql_user_name as a query into the radcheck table and by that stage sql_user_name has been set to '' (an empty string) by the EAP process I presume. So my EAP user name is ignored and the authentication fails. Do I rewrite the queries to use 'User-name', or is there someone who has combined DHCP/EAP and has a better method I should use? Bear in mind I'm new to FR, DHCP, EAP, pretty much all of it and just doing home networking for fun here so maybe I'm on the wrong track altogether. Here's sudo freeradius -X that hopefully helps (sorry for the duplicates, it's quick enough that it tried to login several times before I killed it) http://pastebin.com/raw/hGSjjD6j Thanks in advance.

2 1