May 2016 - Freeradius-Users - lists.freeradius.org

Checkrad and Cisco WLC
by David Jimenez 17 May '16

17 May '16

Hello: I am trying to use Simultaneous-Use with freeradius and a Cisco WLC. However, it is not working correctly, since the checkrad script is not pointing to the right OID, so it cannot get information from the WLC of what clients are connected. Using snmpwalk I can reach the Cisco WLC, with no problem, from the machine hosting freeradius. And I know that I’m supposed to edit the checkrad script to point to the correct OID, however... I am sure the OIDs defined by default in the script, do not exist in the Cisco WLC. So I have been searching in Cisco’s SNMP Object Navigator (http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en) but the amount of OIDs is just enormous and I’m not even sure exactly what value I’m supposed to look for. Anyone that could help me on how to proceed? This is on a freeradius 3.0.11, on OpenBSD 5.9. The controller is a Cisco WLC 2504 with firmware 8.0.133.0.

2 2

How can I do an auth test to an RSA server?
by Ricardo NUNEZ 16 May '16

16 May '16

Hi, I'm trying to use radtest and radclient commands to test if some RSA servers radius authentication is working. That is, I send the user and password of a test account and expect to receive an "access-accept" from the server. However, this is not working. These are the tests and results: $radtest account password server 0 secret (...) rad_recv: Access-Challenge packet from host x.x.x.x port 1812, id-30,length=93 Prompt = No-Echo Reply-message = "\r\nEnter a new Pin having 8 alpha-numeric characters:" (...) Same result with: echo "User-Name = account, User-Password = password" | radclient - x server auth secret It seems their radius version is "6.1.7". Thanks! Ricardo Envoyé depuis mon HTC

2 1

MD5-Password attribute
by Michael Hocke 16 May '16

16 May '16

Hi everybody, up until now we stored the base64_md5 formatted hash in MD5-Password. Then somebody came along whose hash starts with ‘0X’ and it broke the SQL module because it tried (and failed, of course) to convert the base64 string into hex since it starts with 0X and the type of the MD5-Password, as defined in the dictionary, is Octet. I believe this should be documented and the rlm_pap man page should not suggest that a base64 encoded MD5 hash can be stored in the MD5-Password attribute. Or maybe this is a bug and the conversion should work just fine? What is a more favorable approach now? Using just the hex presentation of the hash and leave it in MD5-Password or rather use Password-With-Header and prepend {base64_md5}? Is one preferred over the other? Thanks! - Michael

2 1

Ldap searches don't seem to honour connect_timeout
by Franks Andy (IT Technical Architecture Manager) 14 May '16

14 May '16

Hi all, FR 3.1.0 git#64aa7f9 I've been doing some testing around HA and servers looking at multiple ldap sources. For the most part everything is fine and dandy, but when the ldap search can't be made (e.g. one of the round robin dns entries goes off line), the connection timeout doesn't seem to behave. I've tried setting the connect_timeout ldap option, and also the NETWORK_TIMEOUT option in /etc/ldap/ldap.conf, but to no avail; connection timeouts take at least a minute or more. Using ldapsearch does seem to honour the latter perfectly. It's difficult to show the behaviour in a debug readout, since Are there any known issues with FR or the ldap library version that would cause this? Am I missing something!? Config: rlm_ldap (ldap_sath): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap_sath): Couldn't find configuration for post-auth, will return NOOP for calls from this section rlm_ldap (ldap_sath): Initialising connection pool pool { start = 0 min = 4 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 20 connect_timeout = 3.000000 retry_delay = 1 spread = no FR output: Tue May 10 17:46:39 2016 : Info: rlm_ldap (ldap_sath): Opening additional connection (2), 1 of 10 pending slots used Tue May 10 17:46:39 2016 : Debug: rlm_ldap (ldap_sath): Connecting to ldaps://sath.nhs.uk:636 Tue May 10 17:46:39 2016 : Debug: rlm_ldap (ldap_sath): New libldap handle 0x2a2ea10 Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Waiting for bind result... Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Bind successful Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Reserved connection (2) Tue May 10 17:48:46 2016 : Debug: (3) Performing search in "dc=SATH,dc=nhs,dc=uk" with filter "sAMAccountName=989096b80618", scope "sub" Tue May 10 17:48:46 2016 : Debug: (3) Waiting for search result... Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Released connection (2) Tue May 10 17:48:46 2016 : Info: rlm_ldap (ldap_sath): Need 3 more connections to reach 3 spares Tue May 10 17:48:46 2016 : Info: rlm_ldap (ldap_sath): Opening additional connection (3), 1 of 9 pending slots used Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Connecting to ldaps://sath.nhs.uk:636 Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): New libldap handle 0x2aa2d00 Ldapsearch (it's set to 6 seconds here, but 3 in FR, I was seeing which took precendence. Not setting the ldap.conf, i.e. commenting out gives same result btw). time ldapsearch -x -H ldaps://10.128.176.1 -D "ldapquery" -b "OU=Phones,OU=MAC Addresses,OU=Trust owned,OU=Wired 802.1x MAC,OU=SATHNetwork,DC=SATH,DC=nhs,DC=uk" -s sub "(cn=*)" cn mail sn dn -w <hidden> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) real 0m6.009s user 0m0.000s sys 0m0.000s Thanks Andy

9 28

Templating sections :-)
by Stefan Paetow 13 May '16

13 May '16

Hi! A quick question for you guys... I'm trying to help out a site with redundant load balancing and went back into my archive to dig up Jonathan's thread the other day about this. In it Arran mentioned templating... can you expand on that? How do we set up templates? The page says" templates { target_stanza { directives ... } } How would you define the ldap configuration items? Something like this? templates { ldap { base_dn = '...' } ldap.update { control:NT-Password := '...' } : } Or am I misunderstanding the format? Any help is much appreciated :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

4 4

Updates to the web sites
by Alan DeKok 13 May '16

13 May '16

We've put a lot of work over the past few months into web site updates. More will be coming in the future. The Wiki has a new theme / look: http://wiki.freeradius.org/Home It uses a newly generated logo (not one that's 10 years old). It has more consistent colours / fonts throughout. We've also used a public certificate for the packages: https://packages.networkradius.com/debian/ This should make it easier for people to use debian / ubuntu updates. The packages on the server are old (sorry). We're working on getting them updated. Alan DeKok.

1 0

EAP-SIM Error "Failed continuing EAP SIM (18) session. EAP sub-module failed"
by Li Zhaoxing 13 May '16

13 May '16

Hi, I am new here and here is my problem: I am using FreeRADIUS version 3.0.4 and I am working on configure the FreeRADIUS as a local RADIUS server in hotspot2.0 network. I am now in trouble with EAP-SIM authentication. I have configure the EAP-SIM in the file eap under /mods-enabled, and change the order of "eap" after "files" in authorize part in the file default under /sites-enabled. I have tested the EAP-SIM using radeapclient successfully. I tested EAP-TTLS with MSCHAPv2 authentication in my experimental network successfully which use an username and password. Everything seems going well until I tested the EAP-SIM in the hotspot2.0 network. I tested the EAP-SIM authentication using a real smartphone with a SIM card in which I specified an Ki by myself. The AP(the NAI of RADIUS) is a hostspot2.0-supported wireless access point running hostapd on it. and when I try to access the network through AP I got ERROR "Failed continuing EAP SIM (18) session. EAP sub-module failed". Here is my configurations and debug output In users file my account is: 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org EAP-Type := SIM, EAP-Sim-KI := 0x8baf473f2f8fd09487cccbd7097c6862, EAP-Sim-Algo-Version := 1 Here is the radiusd -X debug output when I require to access the network: (6) Received Access-Request Id 20 from 192.168.0.129:45017 to 192.168.0.200:1812 length 249 (6) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (6) NAS-IP-Address = 192.168.0.129 (6) Called-Station-Id = "00-14-D5-91-C0-FD:hs20" (6) NAS-Port-Type = Wireless-802.11 (6) NAS-Port = 1 (6) Calling-Station-Id = "68-3E-34-9B-32-C7" (6) Connect-Info = "CONNECT 54Mbps 802.11g" (6) Framed-MTU = 1400 (6) EAP-Message = 0x02330038013132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f7267 (6) HS20-AP-Version = 1 (6) Message-Authenticator = 0x440d0fe99fb6058bc76eb93698cf224d (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: Looking up realm "wlan.mnc093.mcc208.3gppnetwork.org" for User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (6) suffix: No such realm "wlan.mnc093.mcc208.3gppnetwork.org" (6) [suffix] = noop (6) files: users: Matched entry 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org at line 3 (6) [files] = ok (6) eap: Peer sent EAP Response (code 2) ID 51 length 56c (6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) authenticate { (6) eap: Peer sent packet with method EAP Identity (1) (6) eap: Calling submodule eap_sim to process data (6) eap_sim: Generated following triplets for round 0: (6) eap_sim: RAND : 0x872b74dc0e5582cdd217f486e088008e (6) eap_sim: SRES : 0x2d989648 (6) eap_sim: Kc : 0xff85b4f6889f9800 (6) eap_sim: Generated following triplets for round 1: (6) eap_sim: RAND : 0xf3fe491aaf74d6b894e94af1ada52ca6 (6) eap_sim: SRES : 0x056b09ed (6) eap_sim: Kc : 0xdbf228d55f6fcc00 (6) eap_sim: Generated following triplets for round 2: (6) eap_sim: RAND : 0xaf2c073cb54b1861ee429fe7a3e3f60b (6) eap_sim: SRES : 0xe1445dc1 (6) eap_sim: Kc : 0x65a776abc0f43c00 (6) eap: Sending EAP Request (code 1) ID 180 length 20 (6) eap: EAP session adding &reply:State = 0x14c723b2147331b1 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) Post-Auth-Type sub-section not found. Ignoring. (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) Sent Access-Challenge Id 20 from 192.168.0.200:1812 to 192.168.0.129:45017 length 0 (6) EAP-Message = 0x01b40014120a00000f0200020001000011010100 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x14c723b2147331b1a0c3c29e8d6db7ba (6) Finished request Waking up in 4.9 seconds. (7) Received Access-Request Id 21 from 192.168.0.129:45017 to 192.168.0.200:1812 length 299 (7) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (7) NAS-IP-Address = 192.168.0.129 (7) Called-Station-Id = "00-14-D5-91-C0-FD:hs20" (7) NAS-Port-Type = Wireless-802.11 (7) NAS-Port = 1 (7) Calling-Station-Id = "68-3E-34-9B-32-C7" (7) Connect-Info = "CONNECT 54Mbps 802.11g" (7) Framed-MTU = 1400 (7) EAP-Message = 0x02b40058120a000007050000ef994301bfa74fda8473e5ce391e2bc5100100010e0e00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 (7) State = 0x14c723b2147331b1a0c3c29e8d6db7ba (7) HS20-AP-Version = 1 (7) Message-Authenticator = 0xd9cb8b33b442579671f1b5ebe828ff41 (7) session-state: No cached attributes (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: Looking up realm "wlan.mnc093.mcc208.3gppnetwork.org" for User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (7) suffix: No such realm "wlan.mnc093.mcc208.3gppnetwork.org" (7) [suffix] = noop (7) files: users: Matched entry 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org at line 3 (7) [files] = ok (7) eap: Peer sent EAP Response (code 2) ID 180 length 88 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [expiration] = noop (7) [logintime] = noop (7) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (7) pap: WARNING: Authentication will fail unless a "known good" password is available (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = eap (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x14c723b2147331b1 (7) eap: Finished EAP session with state 0x14c723b2147331b1 (7) eap: Previous EAP request found for state 0x14c723b2147331b1, released from the list (7) eap: Peer sent packet with method EAP SIM (18) (7) eap: Calling submodule eap_sim to process data (7) eap_sim: EAP-SIM decoded packet (7) eap_sim: User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (7) eap_sim: NAS-IP-Address = 192.168.0.129 (7) eap_sim: Called-Station-Id = "00-14-D5-91-C0-FD:hs20" (7) eap_sim: NAS-Port-Type = Wireless-802.11 (7) eap_sim: NAS-Port = 1 (7) eap_sim: Calling-Station-Id = "68-3E-34-9B-32-C7" (7) eap_sim: Connect-Info = "CONNECT 54Mbps 802.11g" (7) eap_sim: Framed-MTU = 1400 (7) eap_sim: EAP-Message = 0x02b40058120a000007050000ef994301bfa74fda8473e5ce391e2bc5100100010e0e00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 (7) eap_sim: State = 0x14c723b2147331b1a0c3c29e8d6db7ba (7) eap_sim: HS20-AP-Version = 1 (7) eap_sim: Message-Authenticator = 0xd9cb8b33b442579671f1b5ebe828ff41 (7) eap_sim: Event-Timestamp = "May 13 2016 14:52:36 CST" (7) eap_sim: EAP-Type = SIM (7) eap_sim: EAP-Sim-Subtype = Start (7) eap_sim: EAP-Sim-NONCE_MT = 0x0000ef994301bfa74fda8473e5ce391e2bc5 (7) eap_sim: EAP-Sim-SELECTED_VERSION = 0x0001 (7) eap_sim: EAP-Sim-IDENTITY = 0x00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 (7) eap: Sending EAP Request (code 1) ID 181 length 80 (7) eap: EAP session adding &reply:State = 0x14c723b2157231b1 (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) Post-Auth-Type sub-section not found. Ignoring. (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) Sent Access-Challenge Id 21 from 192.168.0.200:1812 to 192.168.0.129:45017 length 0 (7) EAP-Message = 0x01b50050120b0000010d0000872b74dc0e5582cdd217f486e088008ef3fe491aaf74d6b894e94af1ada52ca6af2c073cb54b1861ee429fe7a3e3f60b0b0500006ccc60941e49dc60ae915c9edba32357 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x14c723b2157231b1a0c3c29e8d6db7ba (7) Finished request Waking up in 4.9 seconds. (8) Received Access-Request Id 22 from 192.168.0.129:45017 to 192.168.0.200:1812 length 223 (8) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (8) NAS-IP-Address = 192.168.0.129 (8) Called-Station-Id = "00-14-D5-91-C0-FD:hs20" (8) NAS-Port-Type = Wireless-802.11 (8) NAS-Port = 1 (8) Calling-Station-Id = "68-3E-34-9B-32-C7" (8) Connect-Info = "CONNECT 54Mbps 802.11g" (8) Framed-MTU = 1400 (8) EAP-Message = 0x02b5000c120e000016010000 (8) State = 0x14c723b2157231b1a0c3c29e8d6db7ba (8) HS20-AP-Version = 1 (8) Message-Authenticator = 0x602535e3fc71889877b3e8ff37557d10 (8) session-state: No cached attributes (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "wlan.mnc093.mcc208.3gppnetwork.org" for User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (8) suffix: No such realm "wlan.mnc093.mcc208.3gppnetwork.org" (8) [suffix] = noop (8) files: users: Matched entry 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org at line 3 (8) [files] = ok (8) eap: Peer sent EAP Response (code 2) ID 181 length 12 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x14c723b2157231b1 (8) eap: Finished EAP session with state 0x14c723b2157231b1 (8) eap: Previous EAP request found for state 0x14c723b2157231b1, released from the list (8) eap: Peer sent packet with method EAP SIM (18) (8) eap: Calling submodule eap_sim to process data (8) eap: ERROR: Failed continuing EAP SIM (18) session. EAP sub-module failed (8) eap: Sending EAP Failure (code 4) ID 181 length 4 (8) eap: Failed in EAP select (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 22 from 192.168.0.200:1812 to 192.168.0.129:45017 length 44 (8) EAP-Message = 0x04b50004 (8) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. (6) Cleaning up request packet ID 20 with timestamp +61 (7) Cleaning up request packet ID 21 with timestamp +61 Waking up in 0.3 seconds. (8) Cleaning up request packet ID 22 with timestamp +61 It seems that my radius server failed in calling EAP SIM module to process the MAC Challenge response. Anyone gets some ideas? Since the log gets only one line ERROR, I can't tell what's going wrong. Thank you for your attention and if any information is required to locate my error I am very pleased to offer my configuration and logs. Li Zhaoxing Beijing University of Posts and Telecommunications

2 1

free radius authentication query not working as expected
by Amardeep Singh 13 May '16

13 May '16

Hi, Greetings. Hope you all are doing great! I want to achieve zone migration using Nomadix with free Radius. I have made the desired settings on the Nomadix for zone migration. However when I switch between the SSIDs it does not redirect me to the AAA page. Although I get authenticated on Nomadix but the redirection is not working. I have added the authentication query on free radius as (/etc/raddb/sites-enabled/default):- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' and \ vlan_id='%{NAS-Port}'}" } if (&Tmp-String-0 != "") { update request { Tmp-String-1 := "%{sql: update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } else { reject } } I stopped the radius daemon - '/etc/init.d/radiusd stop' and then ran the radius in debug mode - radiusd -X. After enabling the zone migration I tried again switching the SSIDs with no portal page redirection. Now when I see the radius log file - (radius_log_switch.txt attached) both the times while switching SSIDs I got Auth: Login OK response. Then I reviewed the radius debug window (radius_debug_log.txt attached) on line 16 it seems that even the authentication query returns nothing still the update query ran and sets the username to null value. So I believe the condition “if (&Tmp-String-0 != "") { “ in the authentication query is not working as expected. And while switching the authentication query is making the groupname column empty. Please suggest. mysql> select * from radusergroup; +------------------------+----------------+----------+ | username | groupname | priority | +------------------------+----------------+----------+ | 78-9E-D0-31-29-7E | | 1 | +------------------------+----------------+----------+ raduserzone is a custom table :- mysql> select * from raduserzone ; +----+---------+-------------------+---------+-------------------+ | id | site_id | mac_address | vlan_id | radius_group_name | +----+---------+-------------------+---------+-------------------+ | 1 | 100051 | 78-9E-D0-31-29-7E | 99 | 78-9E-D0-31-29-7E | +----+---------+-------------------+---------+-------------------+ I am using custom radius table here to track the guest data, while switching , in the database. Afer switching the SSIDs I did not get any portal page (AAA , authentication URL) but I got authenticated on Nomadix and the only thing that changed on Nomadix is that the Port and Room changed from 93 to 77. Can you please share your thoughts here and guide me if I am going in the right direction? Thanks a lot in advance!! Amardeep Singh

2 3

request log line items
by Betibeteka Beranduetxea 12 May '16

12 May '16

Hi, first post here, We are using FreeRADIUS Version 2.1.12 and PEAP auth for wifi clients since a quite long time. It has ben satisfactory, but now we are trying to log requests and I fear I'm possibly wrong. Could you explain what the lines in the log means? i.e, I'm getting lines like this one: Thu May 12 11:56:39 2016 : Auth: Login OK: [xxx.xxx] (from client xxxx08 port 0 cli C0-38-96-26-37-B3) Which obviously means that user has sucessful logon and comes from NAS xxxx08. I guess the "port" part means the port at NAS, but this is less clear for me, since we use freeradius exclusively for wifi access and I'm getting some log lines with other ports. But the main problem for me is the "cli" part, I guessed this would be some MAC address, may be the user's device one, may be NAS one, maybe some NATing router's one, but none of these possibilities are yet confirmed. After logging from my own laptop, that logged "MAC addres" is not my laptop's one, nor NAS or router one so I'm now quite puzzled Any pointers to documentation would be greatly appreciated, I have been unable to get good results from any google search including mailing list, so I fear I'm not getting it right at all. TIA, Roman

2 2

Problem expanding "%{Calling-Station-Id}"
by Ana Gallardo Gómez 11 May '16

11 May '16

Hello all :) I'm using FreeRADIUS Version 3.0.8in a debian 8. I want to exec a sql query to return a value in Reply-Message, but I don't know why freeradius doesn't expand Calling-Station-Id every time... I use: Reply-Message := "%{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1}" My log: Wed May 4 11:48:37 2016 : Debug: (0) Received Access-Request Id 215 from 192.168.1.15:47353 to 192.168.1.3:1812 length 80 Wed May 4 11:48:37 2016 : Debug: (0) User-Name = 'nodowifi(a)nodo.unex.es' Wed May 4 11:48:37 2016 : Debug: (0) User-Password = 'password' Wed May 4 11:48:37 2016 : Debug: (0) Calling-Station-Id = 'f0:f6:1c:58:da:cd' Wed May 4 11:48:37 2016 : Debug: (0) session-state: No State attribute Wed May 4 11:48:37 2016 : Debug: (0) # Executing section authorize from file /etc/freeradius/sites-enabled/captive In Hints, freeradius doesn't expand Calling-Station-Id: DEFAULT Realm == "nodo.unex.es" Reply-Message = "%{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1}", Log: Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: Examining Reply-Message Wed May 4 11:48:37 2016 : Debug: %{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1} Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: xlat --> sqllocal Wed May 4 11:48:37 2016 : Debug: { Wed May 4 11:48:37 2016 : Debug: literal --> SELECT username FROM radpostauth WHERE client like 'PA Wed May 4 11:48:37 2016 : Debug: literal --> % Wed May 4 11:48:37 2016 : Debug: literal --> ' and reply='Access-Accept' and mac=' Wed May 4 11:48:37 2016 : Debug: attribute --> Calling-Station-Id Wed May 4 11:48:37 2016 : Debug: literal --> ' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1 Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: if { Wed May 4 11:48:37 2016 : Debug: attribute --> Stripped-User-Name Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: else { Wed May 4 11:48:37 2016 : Debug: if { Wed May 4 11:48:37 2016 : Debug: attribute --> User-Name Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: else { Wed May 4 11:48:37 2016 : Debug: literal --> DEFAULT Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: (0) preprocess: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed May 4 11:48:37 2016 : Debug: (0) preprocess: --> nodowifi(a)nodo.unex.es Wed May 4 11:48:37 2016 : Debug: (0) preprocess: SQL-User-Name set to ' nodowifi(a)nodo.unex.es' Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: FROM 1 TO 1 MAX 2 Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: Examining SQL-User-Name Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: APPENDING SQL-User-Name FROM 0 TO 1 Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: TO in 1 out 2 Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: to[0] = User-Name Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: to[1] = SQL-User-Name Wed May 4 11:48:37 2016 : Debug: rlm_sql (sqllocal): Reserved connection (4) Wed May 4 11:48:37 2016 : Debug: /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: literal --> /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) preprocess: EXPAND /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) preprocess: --> /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) preprocess: Executing select query: SELECT username FROM radpostauth WHERE client like 'PA%' and reply='Access-Accept' and mac='' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1 Wed May 4 11:48:37 2016 : Debug: (0) preprocess: SQL query returned no results In users, freeradius expand Calling-Station-Id: nodowifi Cleartext-Password := "password" Reply-Message := "%{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1}" Wed May 4 11:48:37 2016 : Debug: (0) files: ::: Examining Reply-Message Wed May 4 11:48:37 2016 : Debug: %{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1} Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: xlat --> sqllocal Wed May 4 11:48:37 2016 : Debug: { Wed May 4 11:48:37 2016 : Debug: literal --> SELECT username FROM radpostauth WHERE client like 'PA Wed May 4 11:48:37 2016 : Debug: literal --> % Wed May 4 11:48:37 2016 : Debug: literal --> ' and reply='Access-Accept' and mac=' Wed May 4 11:48:37 2016 : Debug: attribute --> Calling-Station-Id Wed May 4 11:48:37 2016 : Debug: literal --> ' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1 Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: if { Wed May 4 11:48:37 2016 : Debug: attribute --> Stripped-User-Name Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: else { Wed May 4 11:48:37 2016 : Debug: if { Wed May 4 11:48:37 2016 : Debug: attribute --> User-Name Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: else { Wed May 4 11:48:37 2016 : Debug: literal --> DEFAULT Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: (0) files: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed May 4 11:48:37 2016 : Debug: (0) files: --> nodowifi Wed May 4 11:48:37 2016 : Debug: (0) files: SQL-User-Name set to 'nodowifi' Wed May 4 11:48:37 2016 : Debug: (0) files: ::: FROM 1 TO 9 MAX 10 Wed May 4 11:48:37 2016 : Debug: (0) files: ::: Examining SQL-User-Name Wed May 4 11:48:37 2016 : Debug: (0) files: ::: APPENDING SQL-User-Name FROM 0 TO 9 Wed May 4 11:48:37 2016 : Debug: (0) files: ::: TO in 9 out 10 Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[0] = User-Name Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[1] = User-Password Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[2] = Calling-Station-Id Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[3] = Stripped-User-Name Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[4] = Realm Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[5] = Event-Timestamp Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[6] = NAS-IP-Address Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[7] = Reply-Message Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[8] = Tipo-Usuario Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[9] = SQL-User-Name Wed May 4 11:48:37 2016 : Debug: rlm_sql (sqllocal): Reserved connection (4) Wed May 4 11:48:37 2016 : Debug: /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: literal --> /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) files: EXPAND /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) files: --> /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) files: Executing select query: SELECT username FROM radpostauth WHERE client like 'PA%' and reply='Access-Accept' and mac='f0:f6:1c:58:da:cd' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1 Wed May 4 11:48:37 2016 : Debug: rlm_sql (sqllocal): Released connection (4) Wed May 4 11:48:37 2016 : Debug: (0) files: EXPAND %{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1} Wed May 4 11:48:37 2016 : Debug: (0) files: --> 961621qb(a)nodo.unex.es Thank you very much in advance. :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

4 10