March 2016 - Freeradius-Users - lists.freeradius.org

TTLS Issue after Ubuntu upgrade
by Arjan Sinnige 07 Mar '16

07 Mar '16

Hi all, For months I had a working server on Ubuntu 14.10 with a build from source freeradius 2.2.9. As Ubuntu 14.10 was running out of support, I decided to upgrade. As openSSL version was changed I had to rebuild freeradius from source again. I stumbled into 2 issues during the build : - I had to disable ikev2 in debian/rules with --without-rlm_eap_ikev2 because it would not finish the build with it. - I had to disable iodbc in debian/rules with --without-rlm_sql_iodbc because it would not finish the build with it. As I am running LDAP as backend the second I could care less about but the first gave me a few frowns. Now when clients try to connect, most of them succeed (probably because they are using TLS / PEAP ) but I had a few apple products that would not connect. Some IOS and some versions of OSX. All PCs were ok, android were ok etc.. So I traced it down to TTLS - pap configurations which seem to fail (I think) but I cannot find out why ? Probably because of TLS Length issues but I cannot find an answer on the list how to solve it. I "fixed" it temporarily by forcing eap { default_eap_type = "peap" } But I would like to know what is going on. I will probably upgrade to v3.0 when Ubuntu 16.04.1 is out but for now I am stuck with this. I've chopped a few parts out as this was a live system with 200 users and edited the passwords and domain. Hope I did not screw that up.. Any ideas ? Arjan Sinnige root@studentserv:/etc/freeradius# freeradius -X freeradius: FreeRADIUS Version 2.2.9, for host x86_64-pc-linux-gnu, built on Mar 6 2016 at 20:52:16 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "root" group = "root" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 51200 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "Password" nastype = "other" } client 192.168.112.100 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-RestArea" nastype = "other" } client 192.168.112.101 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-2-PracticalArea" nastype = "other" } client 192.168.112.102 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-3-HLOffice" nastype = "other" } client 192.168.112.103 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-4-Test" nastype = "other" } client 192.168.112.104 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-5-Classroom" nastype = "other" } client 192.168.112.105 { require_message_authenticator = no secret = "Password" shortname = "TestWifi2" nastype = "other" } client 192.168.112.106 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-6-Classroom1" nastype = "other" } client 192.168.112.107 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-7-TestWifi2" nastype = "other" } client 192.168.110.0/24 { require_message_authenticator = no secret = "Password" shortname = "Admin-Switch-Test" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Auth-Type = LDAP Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/modules/ldap ldap { server = "127.0.0.1" port = 389 password = "Password" expect_password = yes identity = "cn=admin,dc=domain,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 max_uses = 0 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=Users,dc=domain,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x28090b0 Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 2048 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "peap" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 46610 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=244, length=152 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0204000b016a6b6c6f6d70 Message-Authenticator = 0x3232b6337d14a535a22e851f877b629c # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [ldap] performing user authorization for jklomp [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> jklomp [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jklomp) [ldap] expand: ou=Users,dc=domain,dc=com -> ou=Users,dc=domain,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Users,dc=domain,dc=com, with filter (uid=jklomp) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}llBem5VF9 PASSWORD IR4pE1r4FoeaC" [ldap] sambaNtPassword -> NT-Password == 0x43333444444446443545 PASSWORD 54236454144363038464632453336 [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 244 to 192.168.112.103 port 65528 EAP-Message = 0x010500061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa864765a58fb7dc9e26e92fa4d Finished request 153. Going to the next request Waking up in 2.3 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=245, length=311 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0205009815800000008e160301008901000085030156dd8dbcbd6ce79975595ea9dd76603c1efecca658dbd8a96bb0ef52252f8a1c00004a00ffc024c023c00ac009c007c008c028c027c014c013c011c012c026c025c02ac029c005c004c002c003c00fc00ec00cc00d003d003c002f000500040035000a0067006b00330039001601000012000a00080006001700180019000b00020100 State = 0x64734fa864765a58fb7dc9e26e92fa4d Message-Authenticator = 0x61c50a4ed101236a4fb26298dfcbd7b2 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 152 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 142 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< Unknown TLS version [length 0005] [ttls] <<< TLS 1.0 Handshake [length 0089], ClientHello [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 0039], ServerHello [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 083e], Certificate [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] TLS_accept: Need to read more data: unknown state [ttls] TLS_accept: Need to read more data: unknown state In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 245 to 192.168.112.103 port 65528 EAP-Message = 0x0106040015c0000009da16030100390200003503016f7cd2530342d027d7e4ba0bda86b76a4759c3c68f4c58f76cfceadf0ee9f42500c01400000dff01000100000b000403000102160301083e0b00083a0008370004203082041c30820304a003020102020101300d06092a864886f70d01010b050030819c310b3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d310b3009060355040b0c0249543125302306035504030c1c73747564656e74736572762e736165616d7374657264616d2e636f6d3120301e06092a864886 EAP-Message = 0xf70d0109011611612e73696e6e696765407361652e656475301e170d3135303330323131323334325a170d3335303232353131323334325a308188310b3009060355040613024e4c310b300906035504080c024e4831163014060355040a0c0d53414520416d7374657264616d310b3009060355040b0c0249543125302306035504030c1c73747564656e74736572762e736165616d7374657264616d2e636f6d3120301e06092a864886f70d0109011611612e73696e6e696765407361652e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100c76004cdcb06fcb74bce3805c09ebe17282b9cd96927e6bfc1 EAP-Message = 0xab41c4a1f0a648c21520d148f8508afe67612d874dbbfdc37bb5d2c2b09e0b4a1046ae62d1d176de4d8174d1cc48369d07fffda97973d9778ec84990b3707df6e539ed51ab897e865aebfca87344b043edcbe089f07381176ecdac490a3401c8050563b4057b997ed61a469fb41645b0154c4aa9b5dd006af37218b6062adc8a30c3bc7de2c1da7f46892ff53307f5b694db237a885ea91fd2da99e2097697002415212570a7a9694ffddb64d715f2281a10fb0ca316f0158582e63863bdf9d75526fcb4d0be6e1ae1aca1da5b2f3083841da3af6df40168f6b2499192a7015da2088a58fdf6ab0203010001a37b307930090603551d1304023000302c EAP-Message = 0x06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414816c6f35c114a96b985a08623ff393e24214853d301f0603551d230418301680142cfa18f7883dcd9d155090d65d150b83d383b7f2300d06092a864886f70d01010b050003820101009c067332f471e54de7e4f9a47ccda16f57845aefa95d18555f906599eaff46d5631264aff3331b82bcd43f5c664e8019a2abee96715bdbdf65aaf11889d7e329383dc0f7586a91a144664156ee5cd46b7485883835cb786964fa9c48d1a26948cc04bc4328679d9263503624361cc299b9121488269bfa69167ea783e3 EAP-Message = 0xc6883c3fa35b3ecb9fa3eec7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa865755a58fb7dc9e26e92fa4d Finished request 154. Going to the next request Waking up in 2.3 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=246, length=165 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020600061500 State = 0x64734fa865755a58fb7dc9e26e92fa4d Message-Authenticator = 0x9f3d287f3f67bf96b8531b783b37c359 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 246 to 192.168.112.103 port 65528 EAP-Message = 0x0107040015c0000009daaba29398f826982d45762f90dabf8040dff8ba33fd01a66cbbbf265fcc3a72dc7c0af33a9f2866b5e159f4d3f661da918c6ea78dfb6940ed5d11f2e7cc4ea71d5ae8065edcb0b64ef09c125015edacbd262fe80692eb5a24a1052b2c06fd6af221b19ce3039061969dd4c176c5dcda3a86ee913998410e0004113082040d308202f5a003020102020900cafefe4577df2257300d06092a864886f70d01010b050030819c310b3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d310b3009060355040b EAP-Message = 0x0c0249543125302306035504030c1c73747564656e74736572762e736165616d7374657264616d2e636f6d3120301e06092a864886f70d0109011611612e73696e6e696765407361652e656475301e170d3135303330323131313430305a170d3335303232353131313430305a30819c310b3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d310b3009060355040b0c0249543125302306035504030c1c73747564656e74736572762e736165616d7374657264616d2e636f6d3120301e06092a864886f70d0109011611612e EAP-Message = 0x73696e6e696765407361652e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100e11800b0bbe3444cd3b693e054f2cf7d7f9b13deca592e169766cda08bf1de158bde6dd215417051fddc32277030e19bc60c2c5fc1d3ff73a2f70bda312d70f24bde61951f85b908896bba6528ee39828691f64e854bf60855b901db2a4731cfb65fc42641de5328e5f5904edeaa55514c130b354574eefbbc11fbcdf36908a5c810298f5d1f36773f23a8933b338a6258b1068b0af11902f41147a36f877512001683b8eeb17c708e4bf815d417aca8255a27af2e9451019d9f4d3b99ccb3bce8aaf4a84a35e47a03e8817826 EAP-Message = 0x3d886270c8f6791a2d5a886d74da1ad1ab67c3b7e2ea915be7d7bf622b4d1977bacba0d45223acc23edc0e12b5f39e15188e430203010001a350304e301d0603551d0e041604142cfa18f7883dcd9d155090d65d150b83d383b7f2301f0603551d230418301680142cfa18f7883dcd9d155090d65d150b83d383b7f2300c0603551d13040530030101ff300d06092a864886f70d01010b05000382010100d5e3812906be81a4eda4400cf52b2d8b0323d33c6355020704390b58480ac3ff34fe125c6cafb0c77e0afff9a2cd99267e0d71b1461e67c0e7092c89eb6bb1a0c8d7071056b3549ca70b808be49c7aaec2b4278fcbdfd6f612df6bad7ab2c4 EAP-Message = 0xbfb6dcb06a90bf20feddbda5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa866745a58fb7dc9e26e92fa4d Finished request 155. Going to the next request Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=247, length=165 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020700061500 State = 0x64734fa866745a58fb7dc9e26e92fa4d Message-Authenticator = 0x5988184f00ae2bedef7b30d46c4a893e # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 247 to 192.168.112.103 port 65528 EAP-Message = 0x010801f81580000009da2037165fe68bb780b62d77bb0229e415a82b2805a0e4e4fcf3e95e77dc2954c0b9e2d23b3668be4ae5b324c3b6236b65670acc7f16c9c3e43819fe3a19470edebdd5c1bdcd4a6e032cb61308bd52d368f292a8a6c60101fa30cc1cd541e3344a5c58143375914c8b6c68963e87eb0af0cebd5b47111269fabc5e8a674e972ddc0a975253be159911be90589f9e897ad58cf474bef9160301014b0c000147030017410446637b8b54084745ae7c65ae7cebf6f6f0862226a7741788b45fa83b6a60182671273a13782a8793b9ac843f001a8977c8632936689f32e67473fa592386ef0d01005504c6a225f1766b948853a9d326 EAP-Message = 0x9c4095cbf95fa1dd6aeaaf3b40a9fc4fbfbea88eb95323dba9adbca7b3b04c2686601b210287b9e561b769ebe02b92bdd5183ba33ef57022c262e23616329a87ce568fd4dfa7a286f2bb1aeda42b234b72539a8b8b7059de94061a96a23602adf117d97989b33aff32195e28a36423dfec36bbbc60597274565c3a848925a17a33a234d8d23e9415e5a045641e853fa8a99ddef03cdbb7d94df5466f95280c07c1955fe5c2812013f3d9bebadf20bf45a70f4e981c681e851a07a1ff376f646575853101113fa212d4f885e3016f28c1c7c4c97403070f2994d16a07a322710605bde1a8cd96df726c59adf10da82290ad2e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa8677b5a58fb7dc9e26e92fa4d Finished request 156. Going to the next request rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=248, length=303 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020800901580000000861603010046100000424104a223bbaa71fe2ed39f74f1301e6ac0c3576eccd0d960573e9c0a27ae2f2729b000d8590dc38a075da5529ef00a9586efde3666ab8c22d93858d9fdce62a844531403010001011603010030a88619ab87f1d095c41d1f81f5746c7b8ec9af68d8fe9e7ff81a12eb2171ea53d1d048de8730d045e9dc8f8106bf7154 State = 0x64734fa8677b5a58fb7dc9e26e92fa4d Message-Authenticator = 0xefcc0e4362978abf61cfcaff33c113a8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 8 length 144 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 134 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< Unknown TLS version [length 0005] [ttls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] <<< Unknown TLS version [length 0005] [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< Unknown TLS version [length 0005] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 248 to 192.168.112.103 port 65528 EAP-Message = 0x0109004515800000003b140301000101160301003028333450e9283ceb9da0d25d4d8cf007557f10fc07ac0f1650b36f3c62930461415acedab4bb2940cc8d588ff492039b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa8607a5a58fb7dc9e26e92fa4d Finished request 157. Going to the next request Waking up in 2.4 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=249, length=318 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0209009f1580000000951703010090359451bedeb5bc07e07b321e50ee73176f2c5cdc3a885af614316d5c171c94ac4d3a86363f41498298a699e5cf7344bc1c8abdbb742ee55d7296e85b57388d3f0ac2dab18e88825bc5914c8ef5d4ec275a16214ce0d00aa062269283d2791cf6679e3618bac6c627072620b7ee55ef4e0e7c32cda51a17bea0d4063fac69220740658af2214e4a3512903089db147cfb State = 0x64734fa8607a5a58fb7dc9e26e92fa4d Message-Authenticator = 0xd63dc4932627eb1ff878a9768bd65415 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 9 length 159 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 149 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< Unknown TLS version [length 0005] [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "jklomp" MS-CHAP-Challenge = 0x16d14d2b3d24edda4c389fa4cfc1969c MS-CHAP2-Response = 0x9c008afbe33218827ffcc6fb348cf840d0eb0000000000000000431508b1e60c95a4c535288f42ff0f06a3565780c5ec7a18 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "jklomp" MS-CHAP-Challenge = 0x16d14d2b3d24edda4c389fa4cfc1969c MS-CHAP2-Response = 0x9c008afbe33218827ffcc6fb348cf840d0eb0000000000000000431508b1e60c95a4c535288f42ff0f06a3565780c5ec7a18 FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] = ok [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop [ldap] performing user authorization for jklomp [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> jklomp [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jklomp) [ldap] expand: ou=Users,dc=domain,dc=com -> ou=Users,dc=domain,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Users,dc=domain,dc=com, with filter (uid=jklomp) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}llBem5VF92aO PASSWORD R4pE1r4FoeaC" [ldap] sambaNtPassword -> NT-Password == 0x43333444444446443545443 PASSWORD 36454144363038464632453336 [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = ok Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group MS-CHAP { [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Creating challenge hash with username: jklomp [mschap] Client is using MS-CHAPv2 for jklomp, we need NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] = ok +} # group MS-CHAP = ok Login OK: [jklomp] (from client AMS-AP-4-Test port 0 via TLS tunnel) WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel } # server inner-tunnel [ttls] Got tunneled reply code Access-Accept MS-CHAP2-Success = 0x9c533d33383837444136454433443939314545394643363631373336464144394534423732413444423132 MS-MPPE-Recv-Key = 0x952807638f14573bdc5017b5129b35a6 MS-MPPE-Send-Key = 0xf6672997d235901f0ab3d32439733f30 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. [ttls] >>> Unknown TLS version [length 0005] ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 249 to 192.168.112.103 port 65528 EAP-Message = 0x010a005f15800000005517030100508771ba9f57012a44867992b71c9ca682898b14690dbe3c15370db3e2dbc3fcd82ac2a84dff1bd58bce9f726b239510ea16359b665a1b5b6db4debbfbda13ee1417acbe034b97d186350d68f39c241c0b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa861795a58fb7dc9e26e92fa4d Finished request 158. Going to the next request Waking up in 2.3 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=250, length=165 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020a00061500 State = 0x64734fa861795a58fb7dc9e26e92fa4d Message-Authenticator = 0x0944fef5966c1129212adfb8f7ae102a # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 10 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK default [ttls] Invalid ACK received: 0 [ttls] eaptls_verify returned 4 [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Login incorrect: [jklomp] (from client AMS-AP-4-Test port 0 cli E0-F8-47-FB-E0-61) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> jklomp attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 159 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 159 Sending Access-Reject of id 250 to 192.168.112.103 port 65528 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.3 seconds.

2 1

3.0.11 Always escaping = and ,
by Peter Lambrechtsen 07 Mar '16

07 Mar '16

I'm trying to set some request temporary variables that I can use further down in the flow for lookups. update request { RealmLookup := "ou=Realms" } ldap.nodeauth But when it comes to do the lookup, the = and , get escaped so it makes an invalid DN. (0) update request { (0) RealmLookup := "ou=Realms," (0) } # update request = noop rlm_ldap (ldap.nodeauth): Reserved connection (0) (0) ldap.nodeauth: EXPAND (cn=%{AuthCred}) (0) ldap.nodeauth: --> (cn=m2m) (0) ldap.nodeauth: EXPAND %{RealmLookup}ou=Proxy (0) ldap.nodeauth: --> ou\3dRealms\2cou=Proxy (0) ldap.nodeauth: Performing search in "ou\3dRealms\2cou=Proxy" with filter "(cn=m2m)", scope "sub" (0) ldap.nodeauth: Waiting for search result... (0) ldap.nodeauth: ERROR: Failed performing search: Invalid DN syntax Any way to stop the xlat from expanding the value, I've tried unescape and a number of different options without success? Or will I need to just define multiple modules with different DNs of the places I would like to search in the hierarchy.

5 9

freeradius with wpa-supplicant eap-tls mode configuration
by ammad rehmat 07 Mar '16

07 Mar '16

<http://stackoverflow.com/questions/35838822/trying-to-set-up-freeradius-in-…> I am trying to setup freeraadius in eap-tls mode. I am using freeradius as a server and wpa-supplicant as a client. I have installed both packages in Ubuntu-14.04.3. I am using the sample certificates provided along with freeradius package. I use the script bootstrap provided in */freerad/raddb/cert* . I donot know if this script properly signs the certificate or not as i am not an expert in this area. I simply provide the paths to these certificates in client.conf to freeradius and configuration file in wpa-supplicant. Following is the wpa-supplicant configuration i am using network={ ssid="YOUR-SSID" scan_ssid=1 key_mgmt=WPA-EAP eap=TLS identity="alice" ca_cert="/home/areh/freeradius-server-3.0.11/raddb/certs/ca.pem" client_cert="/home/areh/freeradius-server-3.0.11/raddb/certs/client.pem" private_key="/home/areh/freeradius-server-3.0.11/raddb/certs/client.key" } I am running freeradius using *Freeradius -X* command and *eapol_test -c eap-tls.conf -s testing123* for wpa-supplicant command. I receive the following error on wpa-supplicant terminal: OpenSSL: tls_connection_client_cert - SSL_use_certificate_file (DER) failed error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:140C800D:SSL routines:SSL_use_certificate_file:ASN1 lib OpenSSL: SSL_use_certificate_file (PEM) --> OK OpenSSL: tls_connection_private_key - SSL_use_PrivateKey_File (DER) failed error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error OpenSSL: pending error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:04093004:rsa routines:OLD_RSA_PRIV_DECODE:RSA lib OpenSSL: pending error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:140CB00D:SSL routines:SSL_use_PrivateKey_file:ASN1 lib OpenSSL: tls_connection_private_key - SSL_use_PrivateKey_File (PEM) failed error:0907B068:PEM routines:PEM_READ_BIO_PRIVATEKEY:bad password read OpenSSL: pending error: error:140CB009:SSL routines:SSL_use_PrivateKey_file:PEM lib OpenSSL: tls_read_pkcs12 - Failed to use PKCS#12 file error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: Failed to load private key TLS: Failed to load private key '/home/areh/freeradius-server-3.0.11/raddb/certs/client.key' TLS: Failed to set TLS connection parameters I am using wpa_supplicant-0.7.3 and also tried with 2.5 version, freeradius version is freeradius-server-3.0.11. I would really appreciate any clue or help. I am debugging using wireshark and I can see access-challenge and access-request packets being exchanged but never reach the next message stage. Kindly help with this problem. Any help will be appreciated. Ammad Rehmat

2 1

Two different ldap module instances
by Angel L. Mateo 07 Mar '16

07 Mar '16

Hello, I need two different ldap module instances in my freeradius (3.0.10) server, so I have one with "ldap" name and the other named "ldap-eduroam". In my eduroam site configuration I have: authorize { preprocess eduroam_inner_log suffix eap ldap-eduroam files_eduroam_inner mschap pap } And in its authorized file I have entries like: DEFAULT ..., Ldap-Group == 1001 User-Name = "%{User-Name}", Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = <VLAN tag>, Fall-Through = No My problem is that this Ldap-Group is using "ldap" module instead of "ldap-eduroam" one. Why? Is there any way to force it to use ldap-eduroam? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868887590 Fax: 868888337

3 4

Framed-Ip-Address - IpPool 0.0.0.0
by Luiz Fernando Softov 07 Mar '16

07 Mar '16

Hi, I'm using FreeRadius with sql_ippool (postgresql) I am using default config. So, I make the configuration in Mikrotik to use FreeRadius. In Mikrotik i have ~1500 clients making pppoe and grabbing IP from FreeRadius. The problem is: sometimes clients get IP 0.0.0.0. I already activate debug log, but can't figure the problem. Someone know this problem and can help me? Thanks...

2 3

Trying to restrict simultaneous-use
by Michael Martinez 06 Mar '16

06 Mar '16

I'm doing some tests from localhost to restrict simultaneous-use. * I have a user defined in the users file with Simultaneous-Use := 1. * I have the following file which I feed to radclient to initiate an accounting session for this user: Packet-Type=4 Packet-Dst-Port=1813 Acct-Session-Id = "4D2BB8AC-00000098" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "spackle" NAS-Port = 0 Connect-Info = "CONNECT 48Mbps 802.11b" * In sites-enabled/default I have uncommented "radutmp" and "sradumtp" in accounting{} and I have uncommented radutmp in session{} (yes I know sql is faster but this is just for testing) After running radclient, I see the following with "radwho": Login Name What TTY When From Location spackle spackle shell S0 Sat 08:08 127.0.0.1 All good so far. Now i try to simulate logging in again: radtest spartan password 127.0.0.1 101 hello I am expecting this to be Rejected, but it gets Accepted instead: Received Access-Accept Id 212 from 127.0.0.1:1812 to 0.0.0.0:0 length 35 The debug file shows: (2) # Executing section session from file /usr/local/freeradius/etc/raddb/sites-enabled/default (2) session { (2) radutmp: EXPAND /usr/local/freeradius/var/log/radius/radutmp (2) radutmp: --> /usr/local/freeradius/var/log/radius/radutmp (2) radutmp: EXPAND %{User-Name} (2) radutmp: --> spackle checkrad: No NAS type, or type "other" not checking (2) [radutmp] = fail (2) } # session = fail radutmp is failing but it still sends an Access-Accept. Any thoughts? -- --- Michael Martinez http://www.michael--martinez.com

2 5

Freeradius with sql
by Mr Dini 06 Mar '16

06 Mar '16

Hello! I'm using freeradius server 3.0.11 compiled from source on a zyxel nsa320s. It is an arm5 based nas which has 2.6.31.8 kernel. It works perfectly, but I decided to use it with a mysql database. I Can't found the sql in mods-available folder, so i looked for what is wrong. I found the error. The redis package missing... So i compiled the redis and i recompiled freeradius. After it the sql module appeared and now useable. I edited the module and I tried to start it. It seems like started, but when I make a radtest in a parallel ssh window it rejects the attempt... Here is the output: http://pastebin.com/raw/pkEDuSrC And here is my module edit: http://pastebin.com/raw/nHTv8uQ2 Some technical info: - the nas ssh has chroot to /ffp - it has uClibc If you know the answer, please tell me about it! Best regards, Dan Ps: sorry for my bad English...

2 6

Freeradius 3.0.11 SQL Xlat problem
by Devrim Seral 05 Mar '16

05 Mar '16

Hello freeradius Users, I have some strange problem with SQL Xlat that i haven't find out the way to fix it. I was used freeradius 2.x before and my SQL Xlat working. But when i was switched to 3.0.11 my SQL Xlat not working anymore. As you can see following debug log has; sql: ERROR: Error marking pair for xlat sql: ERROR: Error parsing user data from database result sql: ERROR: Error retrieving reply pairs for group 15GB_Quota_2048KBurst My database contains following lines in radgroupreply table; 15GB_Quota_2048KBurst Mikrotik-Recv-Limit := `%{sql:SELECT trafsumdw('%{User-Name}',15360)}` 15GB_Quota_2048KBurst Mikrotik-Xmit-Limit := `%{sql:SELECT trafsumup('%{User-Name}',3840)}` As i understand %{sql: SQL } routines has a problem. How can i fix it.. Thanks devrim Following part have my debug output; radiusd: FreeRADIUS Version 3.0.11, for host x86_64-pc-linux-gnu, built on Feb 13 2016 at 16:58:54 (4) Received Access-Request Id 161 from 127.0.0.1:38043 to 127.0.0.1:1812 length 76 (4) User-Name = "dseral" (4) User-Password = "123" (4) NAS-IP-Address = 127.0.1.1 (4) NAS-Port = 111 (4) Message-Authenticator = 0x01a430a9fdf69589934e577266f130f2 (4) # Executing section authorize from file /etc/freeradius/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "dseral", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: No EAP-Message, not doing EAP (4) [eap] = noop (4) [files] = noop (4) sql: EXPAND %{User-Name} (4) sql: --> dseral (4) sql: SQL-User-Name set to 'dseral' rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (10): Hit idle_timeout, was idle for 4561 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (8): Hit idle_timeout, was idle for 4561 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (11), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.47-0+deb8u1, protocol version 10 rlm_sql (sql): Reserved connection (11) (4) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (4) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dseral' ORDER BY id (4) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dseral' ORDER BY id (4) sql: User found in radcheck table (4) sql: Conditional check items matched, merging assignment check items (4) sql: Cleartext-Password := "123" (4) sql: Expiration := "Feb 24 2017 00:00:00 EET" (4) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (4) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dseral' ORDER BY id (4) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dseral' ORDER BY id (4) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (4) sql: --> SELECT groupname FROM radusergroup WHERE username = 'dseral' ORDER BY priority (4) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'dseral' ORDER BY priority (4) sql: User found in the group table (4) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (4) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '15GB_Quota_2048KBurst' ORDER BY id (4) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '15GB_Quota_2048KBurst' ORDER BY id (4) sql: Group "15GB_Quota_2048KBurst": Conditional check items matched (4) sql: Group "15GB_Quota_2048KBurst": Merging assignment check items (4) sql: Simultaneous-Use := 1 (4) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (4) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '15GB_Quota_2048KBurst' ORDER BY id (4) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '15GB_Quota_2048KBurst' ORDER BY id (4) sql: ERROR: Error marking pair for xlat (4) sql: ERROR: Error parsing user data from database result (4) sql: ERROR: Error retrieving reply pairs for group 15GB_Quota_2048KBurst rlm_sql (sql): Released connection (11) rlm_sql (sql): Need 2 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (12), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.47-0+deb8u1, protocol version 10 (4) [sql] = fail (4) } # authorize = fail (4) Using Post-Auth-Type Reject (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) Post-Auth-Type REJECT { (4) sql: EXPAND .query (4) sql: --> .query (4) sql: Using query template 'query' rlm_sql (sql): Reserved connection (11) (4) sql: EXPAND %{User-Name} (4) sql: --> dseral (4) sql: SQL-User-Name set to 'dseral' (4) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, date) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (4) sql: --> INSERT INTO radpostauth (username, pass, reply, date) VALUES ( 'dseral', '123', 'Access-Reject', '2016-03-03 20:48:36') (4) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, date) VALUES ( 'dseral', '123', 'Access-Reject', '2016-03-03 20:48:36') ...

3 6

segfault in master 3.0.x checking for empty realm
by Peter Lambrechtsen 04 Mar '16

04 Mar '16

Ran into an interesting issue with my realm code that should have just given me a reject rather than a segfault. In my default site I have added to the end the realm: realm "~.*$" { } So that suffix matches every realm as I don't have control over the realm names and need to perform lookups in the database on the realm. But if I then try and run suffix with an empty realm and do if check to see if it's not a particular realm I get a segfault. suffix if ( Realm == "testing" ) { reject } or if ( &Realm == "testing" ) { reject } or if ( "%{Realm}" == "testing" ) { reject } I always get the segfault. (0) Received Access-Request Id 46 from 127.0.0.1:34518 to 127.0.0.1:1812 length 256 (0) User-Password = "1234" (0) User-Name = "user" (0) # Executing section authorize from file ./sites-enabled/default ... (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "user", looking up realm NULL (0) suffix: Found realm "~.*$" (0) suffix: Adding Stripped-User-Name = "user" (0) suffix: Adding Realm = "(null)" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) if ( Realm == "testing" ) { Segmentation fault That's a bit nasty response really. Granted it's not exactly elegant that I am doing the lookup in the first place. But I didn't expect a segfault from that. I've worked around it by doing a check to make sure the realm isn't empty first. if ( !&Realm == "" ) { if ( Realm == "testing" ) { reject } } else { reject } And that drops into the else nicely (0) if ( !&Realm == "" ) { (0) if ( !&Realm == "" ) -> FALSE (0) else { (0) [reject] = reject (0) } # else = reject (0) } # authorize = reject Haven't gone looking into the code to see where the issue is yet, but I will have a look tomorrow.

2 3

moving ahead with eap-sim under 3.0.11
by Michael Martinez 04 Mar '16

04 Mar '16

I've done some research and now I understand how eap-sim works: in theory the server generates a random number (RAND) and gives this to the client. The client uses it along with some secret key Ki to generate response values RES and Kc. It gives these back to the server. If the server also knows what Ki is, then it can generate those response values itself and check to make sure they match. But in practice the only two places where Ki is known is on the SIM card and the mobile network operator. The mobile network operator will probably never give out those values (and if they did it would probably be a bureaucratic nightmare to get them). So the next best thing is the following workaround: obtain a SIM card reader and some reader software, feed some different RAND numbers to it to get the RES and Kc values and hard code these into the Radius server. The radius server will then know what the expected RES and Kc values are for said RANDs. The drawback is that it is not truly randomizing the numbers,it's picking from a small set of hardcoded values every time. But it's the only thing we can do. That's my understanding to this point; hopefully I am understanding correctly. Here's where I'm stuck. It appears there is a scarcity of SIM card readers. I found one at my local electronics store: a Sunpak 72-in-1 high speed card reader - a $10 piece of junk (i guess USB 2.0 is "high speed" to these folks) that not only fails to read any sort of card I put into it, but also rather consistently locks up both my Window 8 laptop and my Windows 7 PC. Online doesn't look any better. There's a couple cheap SIM card readers in the $5 range. Of course I have doubts about these. So my first question is: can anyone recommend a reliable, quality Sim reader? -- --- Michael Martinez http://www.michael--martinez.com

4 10