May 2016 - Freeradius-Users - lists.freeradius.org

Unable to authenticate a user
by TOURE Amidou Florian 11 May '16

11 May '16

Hi all I'm using a NAC solution which is Packetefcence and I want to authenticate an Active Directory user but I got this 3 specifics errors,please I need help :(16) mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)'(16) mschap: External script failed(16) mschap: ERROR: External script says: Logon failure (0xc000006d)(16) mschap: ERROR: MS-CHAP2-Response is incorrect Ans this is my full radius debug file FreeRADIUS-Proxied-To = 127.0.0.1(21) User-Name = "Administrateur"(21) State = 0x42fe33fd42f7296034bd9bd88f2ca30f(21) Service-Type = Framed-User(21) Framed-MTU = 1500(21) Calling-Station-Id := "00:40:d0:67:d0:b1"(21) Cisco-AVPair = "audit-session-id=C0A801050000003200BCDD37"(21) NAS-Port-Type = Ethernet(21) NAS-Port = 50003(21) NAS-Port-Id = "FastEthernet0/3"(21) NAS-IP-Address = 192.168.1.5(21) Called-Station-Id := "ec:44:76:87:f0:83"(21) Event-Timestamp = "May 10 2016 16:57:28 CEST"(21) WARNING: Outer and inner identities are the same. User privacy is compromised.(21) server packetfence-tunnel {(21) session-state: No cached attributes(21) # Executing section authorize from file /usr/local/pf/raddb//sites-enabled/packetfence-tunnel(21) authorize {(21) policy filter_username {(21) if (&User-Name) {(21) if (&User-Name) -> TRUE(21) if (&User-Name) {(21) if (&User-Name =~ / /) {(21) if (&User-Name =~ / /) -> FALSE(21) if (&User-Name =~ /@[^@]*@/ ) {(21) if (&User-Name =~ /@[^@]*@/ ) -> FALSE(21) if (&User-Name =~ /\.\./ ) {(21) if (&User-Name =~ /\.\./ ) -> FALSE(21) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(21) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(21) if (&User-Name =~ /\.$/) {(21) if (&User-Name =~ /\.$/) -> FALSE(21) if (&User-Name =~ /(a)\./) {(21) if (&User-Name =~ /(a)\./) -> FALSE(21) } # if (&User-Name) = notfound(21) } # policy filter_username = notfound(21) [mschap] = noop(21) suffix: Checking for suffix after "@"(21) suffix: No '@' in User-Name = "Administrateur", skipping NULL due to config.(21) [suffix] = noop(21) ntdomain: Checking for prefix before "\"(21) ntdomain: No '\' in User-Name = "Administrateur", looking up realm NULL(21) ntdomain: No such realm "NULL"(21) [ntdomain] = noop(21) update control {(21) &Proxy-To-Realm := LOCAL(21) } # update control = noop(21) eap: Peer sent EAP Response (code 2) ID 9 length 73(21) eap: No EAP Start, assuming it's an on-going EAP conversation(21) [eap] = updated(21) policy rewrite_called_station_id {(21) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) {(21) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) -> TRUE(21) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) {(21) update request {(21) &Called-Station-Id !* ANY(21) EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}(21) --> ec:44:76:87:f0:83(21) &Called-Station-Id := ec:44:76:87:f0:83(21) } # update request = noop(21) if ("%{8}") {(21) EXPAND %{8}(21) --> (21) if ("%{8}") -> FALSE(21) elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) {(21) elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE(21) elsif (Aruba-Essid-Name) {(21) elsif (Aruba-Essid-Name) -> FALSE(21) elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) {(21) EXPAND %{Cisco-AVPair}(21) --> audit-session-id=C0A801050000003200BCDD37(21) elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE(21) [updated] = updated(21) } # if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) = updated(21) ... skipping else for request 21: Preceding "if" was taken(21) } # policy rewrite_called_station_id = updated(21) [pap] = noop(21) } # authorize = updated(21) Found Auth-Type = eap(21) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence-tunnel(21) authenticate {(21) eap: Expiring EAP session with state 0x42fe33fd42f72960(21) eap: Finished EAP session with state 0x42fe33fd42f72960(21) eap: Previous EAP request found for state 0x42fe33fd42f72960, released from the list(21) eap: Peer sent packet with method EAP MSCHAPv2 (26)(21) eap: Calling submodule eap_mschapv2 to process data(21) eap_mschapv2: # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence-tunnel(21) eap_mschapv2: Auth-Type MS-CHAP {(21) packetfence: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'Administrateur'(21) packetfence: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '192.168.1.5'(21) packetfence: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '50003'(21) packetfence: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User'(21) packetfence: $RAD_REQUEST{'Framed-MTU'} = &request:Framed-MTU -> '1500'(21) packetfence: $RAD_REQUEST{'State'} = &request:State -> '0x42fe33fd42f7296034bd9bd88f2ca30f'(21) packetfence: $RAD_REQUEST{'Called-Station-Id'} = &request:Called-Station-Id -> 'ec:44:76:87:f0:83'(21) packetfence: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '00:40:d0:67:d0:b1'(21) packetfence: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet'(21) packetfence: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'May 10 2016 16:57:28 CEST'(21) packetfence: $RAD_REQUEST{'EAP-Message'} = &request:EAP-Message -> '0x020900491a0209004431eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a1410041646d696e697374726174657572'(21) packetfence: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> 'FastEthernet0/3'(21) packetfence: $RAD_REQUEST{'Cisco-AVPair'} = &request:Cisco-AVPair -> 'audit-session-id=C0A801050000003200BCDD37'(21) packetfence: $RAD_REQUEST{'FreeRADIUS-Proxied-To'} = &request:FreeRADIUS-Proxied-To -> '127.0.0.1'(21) packetfence: $RAD_REQUEST{'MS-CHAP-Challenge'} = &request:MS-CHAP-Challenge -> '0xc3bbd40002f9ff77a7078554def335eb'(21) packetfence: $RAD_REQUEST{'MS-CHAP2-Response'} = &request:MS-CHAP2-Response -> '0x0964eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141'(21) packetfence: $RAD_REQUEST{'EAP-Type'} = &request:EAP-Type -> 'MSCHAPv2'(21) packetfence: $RAD_REQUEST{'MS-CHAP-User-Name'} = &request:MS-CHAP-User-Name -> 'Administrateur'(21) packetfence: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'eap'(21) packetfence: $RAD_CHECK{'Proxy-To-Realm'} = &control:Proxy-To-Realm -> 'LOCAL'(21) packetfence: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'eap'(21) packetfence: $RAD_CONFIG{'Proxy-To-Realm'} = &control:Proxy-To-Realm -> 'LOCAL'(21) packetfence: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet'(21) packetfence: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User'(21) packetfence: &request:Called-Station-Id = $RAD_REQUEST{'Called-Station-Id'} -> 'ec:44:76:87:f0:83'(21) packetfence: &request:State = $RAD_REQUEST{'State'} -> '0x42fe33fd42f7296034bd9bd88f2ca30f'(21) packetfence: &request:FreeRADIUS-Proxied-To = $RAD_REQUEST{'FreeRADIUS-Proxied-To'} -> '127.0.0.1'(21) packetfence: &request:EAP-Type = $RAD_REQUEST{'EAP-Type'} -> 'MSCHAPv2'(21) packetfence: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '192.168.1.5'(21) packetfence: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> 'FastEthernet0/3'(21) packetfence: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '00:40:d0:67:d0:b1'(21) packetfence: &request:MS-CHAP-User-Name = $RAD_REQUEST{'MS-CHAP-User-Name'} -> 'Administrateur'(21) packetfence: &request:MS-CHAP-Challenge = $RAD_REQUEST{'MS-CHAP-Challenge'} -> '0xc3bbd40002f9ff77a7078554def335eb'(21) packetfence: &request:Cisco-AVPair = $RAD_REQUEST{'Cisco-AVPair'} -> 'audit-session-id=C0A801050000003200BCDD37'(21) packetfence: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'Administrateur'(21) packetfence: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'May 10 2016 16:57:28 CEST'(21) packetfence: &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} -> '0x020900491a0209004431eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a1410041646d696e697374726174657572'(21) packetfence: &request:MS-CHAP2-Response = $RAD_REQUEST{'MS-CHAP2-Response'} -> '0x0964eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141'(21) packetfence: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '50003'(21) packetfence: &request:Framed-MTU = $RAD_REQUEST{'Framed-MTU'} -> '1500'(21) packetfence: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'eap'(21) packetfence: &control:Proxy-To-Realm = $RAD_CHECK{'Proxy-To-Realm'} -> 'LOCAL'(21) [packetfence] = noop(21) if (PacketFence-Domain) {(21) if (PacketFence-Domain) -> FALSE(21) else {(21) mschap: Creating challenge hash with username: Administrateur(21) mschap: Client is using MS-CHAPv2(21) mschap: Executing: /usr/local/pf/bin/ntlm_auth_wrapper -- --request-nt-key --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}:(21) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}}(21) mschap: --> --username=Administrateur(21) mschap: Creating challenge hash with username: Administrateur(21) mschap: EXPAND --challenge=%{mschap:Challenge:-00}(21) mschap: --> --challenge=c330d9e5a3d1ecdf(21) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}(21) mschap: --> --nt-response=fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141(21) mschap: ERROR: Abnormal child exit: No error(21) mschap: External script failed(21) mschap: ERROR: External script says: Logon failure (0xc000006d)(21) mschap: ERROR: MS-CHAP2-Response is incorrect(21) [mschap] = reject(21) } # else = reject(21) } # Auth-Type MS-CHAP = reject(21) eap: Sending EAP Failure (code 4) ID 9 length 4(21) eap: Freeing handler(21) [eap] = reject(21) } # authenticate = reject(21) Failed to authenticate the user(21) Login incorrect (mschap: Abnormal child exit: No error): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1 via TLS tunnel)(21) Using Post-Auth-Type Reject(21) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence-tunnel(21) Post-Auth-Type REJECT {(21) policy request-timing {(21) if (control:PacketFence-Request-Time != 0) {(21) ERROR: Failed retrieving values required to evaluate condition(21) } # policy request-timing = noop(21) sql_reject: EXPAND type.reject.query(21) sql_reject: --> type.reject.query(21) sql_reject: Using query template 'query'rlm_sql (sql): Reserved connection (6)(21) sql_reject: EXPAND %{User-Name}(21) sql_reject: --> Administrateur(21) sql_reject: SQL-User-Name set to 'Administrateur'(21) sql_reject: EXPAND INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '%{request:Calling-Station-Id}', '%{request:Framed-IP-Address}', '%{%{control:PacketFence-Computer-Name}:-N/A}', '%{request:User-Name}', '%{request:Stripped-User-Name}', '%{request:Realm}', 'Radius-Access-Request', '%{%{control:PacketFence-Switch-Id}:-N/A}', '%{%{control:PacketFence-Switch-Mac}:-N/A}', '%{%{control:PacketFence-Switch-Ip-Address}:-N/A}', '%{Packet-Src-IP-Address}', '%{request:Called-Station-Id}', '%{request:Calling-Station-Id}', '%{request:NAS-Port-Type}', '%{request:Called-Station-SSID}', '%{request:NAS-Port-Id}', '%{%{control:PacketFence-IfIndex}:-N/A}', '%{request:NAS-Port}', '%{%{control:PacketFence-Connection-Type}:-N/A}', '%{request:NAS-IP-Address}', '%{request:NAS-Identifier}', 'Reject', '%{request:Module-Failure-Message}', '%{control:Auth-Type}', '%{request:EAP-Type}', '%{%{control:PacketFence-Role}:-N/A}', '%{%{control:PacketFence-Status}:-N/A}', '%{%{control:PacketFence-Profile}:-N/A}', '%{%{control:PacketFence-Source}:-N/A}', '%{%{control:PacketFence-AutoReg}:-N/A}', '%{%{control:PacketFence-IsPhone}:-N/A}', '%{request:PacketFence-Domain}', '', '%{pairs:&request:[*]}','%{pairs:&reply:[*]}', '%{%{control:PacketFence-Request-Time}:-N/A}')(21) sql_reject: --> INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '00:40:d0:67:d0:b1', '', 'N/A', 'Administrateur', '', '', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '192.168.1.5', 'ec:44:76:87:f0:83', '00:40:d0:67:d0:b1', 'Ethernet', '', 'FastEthernet0/3', 'N/A', '50003', 'N/A', '192.168.1.5', '', 'Reject', 'mschap: Abnormal child exit: No error', 'eap', 'MSCHAPv2', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', '', '', 'NAS-Port-Type =3D Ethernet=2C Service-Type =3D Framed-User=2C Called-Station-Id =3D =22ec:44:76:87:f0:83=22=2C State =3D 0x42fe33fd42f7296034bd9bd88f2ca30f=2C FreeRADIUS-Proxied-To =3D 127.0.0.1=2C EAP-Type =3D MSCHAPv2=2C NAS-IP-Address =3D 192.168.1.5=2C NAS-Port-Id =3D =22FastEthernet0/3=22=2C Calling-Station-Id =3D =2200:40:d0:67:d0:b1=22=2C MS-CHAP-User-Name =3D =22Administrateur=22=2C MS-CHAP-Challenge =3D 0xc3bbd40002f9ff77a7078554def335eb=2C Cisco-AVPair =3D =22audit-session-id=3DC0A801050000003200BCDD37=22=2C User-Name =3D =22Administrateur=22=2C Event-Timestamp =3D =22May 10 2016 16:57:28 CEST=22=2C EAP-Message =3D 0x020900491a0209004431eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a1410041646d696e697374726174657572=2C MS-CHAP2-Response =3D 0x0964eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141=2C NAS-Port =3D 50003=2C Framed-MTU =3D 1500=2C Module-Failure-Message =3D =22mschap: Abnormal child exit: No error=22=2C Module-Failure-Message =3D =22mschap: External script says: Logon failure =280xc000006d=29=22=2C Module-Failure-Message =3D =22mschap: MS-CHAP2-Response is incorrect=22=2C Module-Failure-Message =3D =22Failed retrieving values required to evaluate condition=22=2C SQL-User-Name =3D =22Administrateur=22','MS-CHAP-Error =3D =22=5CtE=3D691 R=3D0 C=3D45ea37e23aa1e0bb6635a42ede246a62 V=3D3 M=3DAuthentication failed=22=2C EAP-Message =3D 0x04090004=2C Message-Authenticator =3D 0x00000000000000000000000000000000', 'N/A')(21) sql_reject: Executing query: INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '00:40:d0:67:d0:b1', '', 'N/A', 'Administrateur', '', '', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '192.168.1.5', 'ec:44:76:87:f0:83', '00:40:d0:67:d0:b1', 'Ethernet', '', 'FastEthernet0/3', 'N/A', '50003', 'N/A', '192.168.1.5', '', 'Reject', 'mschap: Abnormal child exit: No error', 'eap', 'MSCHAPv2', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', '', '', 'NAS-Port-Type =3D Ethernet=2C Service-Type =3D Framed-User=2C Called-Station-Id =3D =22ec:44:76:87:f0:83=22=2C State =3D 0x42fe33fd42f7296034bd9bd88f2ca30f=2C FreeRADIUS-Proxied-To =3D 127.0.0.1=2C EAP-Type =3D MSCHAPv2=2C NAS-IP-Address =3D 192.168.1.5=2C NAS-Port-Id =3D =22FastEthernet0/3=22=2C Calling-Station-Id =3D =2200:40:d0:67:d0:b1=22=2C MS-CHAP-User-Name =3D =22Administrateur=22=2C MS-CHAP-Challenge =3D 0xc3bbd40002f9ff77a7078554def335eb=2C Cisco-AVPair =3D =22audit-session-id=3DC0A801050000003200BCDD37=22=2C User-Name =3D =22Administrateur=22=2C Event-Timestamp =3D =22May 10 2016 16:57:28 CEST=22=2C EAP-Message =3D 0x020900491a0209004431eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a1410041646d696e697374726174657572=2C MS-CHAP2-Response =3D 0x0964eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141=2C NAS-Port =3D 50003=2C Framed-MTU =3D 1500=2C Module-Failure-Message =3D =22mschap: Abnormal child exit: No error=22=2C Module-Failure-Message =3D =22mschap: External script says: Logon failure =280xc000006d=29=22=2C Module-Failure-Message =3D =22mschap: MS-CHAP2-Response is incorrect=22=2C Module-Failure-Message =3D =22Failed retrieving values required to evaluate condition=22=2C SQL-User-Name =3D =22Administrateur=22','MS-CHAP-Error =3D =22=5CtE=3D691 R=3D0 C=3D45ea37e23aa1e0bb6635a42ede246a62 V=3D3 M=3DAuthentication failed=22=2C EAP-Message =3D 0x04090004=2C Message-Authenticator =3D 0x00000000000000000000000000000000', 'N/A')(21) sql_reject: SQL query returned: success(21) sql_reject: 1 record(s) updatedrlm_sql (sql): Released connection (6)rlm_sql (sql): Need 1 more connections to reach 10 sparesrlm_sql (sql): Opening additional connection (8), 1 of 62 pending slots usedrlm_sql_mysql: Starting connect to MySQL serverrlm_sql_mysql: Connected to database 'pf' on Localhost via UNIX socket, server version 5.1.73, protocol version 10(21) [sql_reject] = ok(21) attr_filter.access_reject: EXPAND %{User-Name}(21) attr_filter.access_reject: --> Administrateur(21) attr_filter.access_reject: Matched entry DEFAULT at line 11(21) [attr_filter.access_reject] = updated(21) update outer.session-state {(21) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: Abnormal child exit: No error'(21) } # update outer.session-state = noop(21) } # Post-Auth-Type REJECT = updated(21) } # server packetfence-tunnel(21) Virtual server sending reply(21) MS-CHAP-Error = "\tE=691 R=0 C=45ea37e23aa1e0bb6635a42ede246a62 V=3 M=Authentication failed"(21) EAP-Message = 0x04090004(21) Message-Authenticator = 0x00000000000000000000000000000000(21) eap_peap: Got tunneled reply code 3(21) eap_peap: MS-CHAP-Error = "\tE=691 R=0 C=45ea37e23aa1e0bb6635a42ede246a62 V=3 M=Authentication failed"(21) eap_peap: EAP-Message = 0x04090004(21) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000(21) eap_peap: Got tunneled reply RADIUS code 3(21) eap_peap: MS-CHAP-Error = "\tE=691 R=0 C=45ea37e23aa1e0bb6635a42ede246a62 V=3 M=Authentication failed"(21) eap_peap: EAP-Message = 0x04090004(21) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000(21) eap_peap: Tunneled authentication was rejected(21) eap_peap: FAILURE(21) eap: Sending EAP Request (code 1) ID 10 length 43(21) eap: EAP session adding &reply:State = 0x951d7ff092176631(21) [eap] = handled(21) } # authenticate = handled(21) Using Post-Auth-Type Challenge(21) Post-Auth-Type sub-section not found. Ignoring.(21) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence(21) session-state: Saving cached attributes(21) Module-Failure-Message := "mschap: Abnormal child exit: No error"(21) Sent Access-Challenge Id 232 from 192.168.10.1:1812 to 192.168.1.5:1645 length 0(21) EAP-Message = 0x010a002b190017030100201ed3bed6b95fc062e4214f5873237f64dd93b7c3d63baf0b3d3f4768bb2e1c53(21) Message-Authenticator = 0x00000000000000000000000000000000(21) State = 0x951d7ff092176631b7716540afc4a8a1(21) Finished requestWaking up in 4.8 seconds.(22) Received Access-Request Id 233 from 192.168.1.5:1645 to 192.168.10.1:1812 length 251(22) User-Name = "Administrateur"(22) Service-Type = Framed-User(22) Framed-MTU = 1500(22) Called-Station-Id = "EC-44-76-87-F0-83"(22) Calling-Station-Id = "00-40-D0-67-D0-B1"(22) EAP-Message = 0x020a002b190017030100208dd4569e8656380cf464c8a46b0823720880d6c90e1207ec982375a8254bc4ff(22) Message-Authenticator = 0xaae91e23d504d18abb24df64cae111ce(22) Cisco-AVPair = "audit-session-id=C0A801050000003200BCDD37"(22) NAS-Port-Type = Ethernet(22) NAS-Port = 50003(22) NAS-Port-Id = "FastEthernet0/3"(22) State = 0x951d7ff092176631b7716540afc4a8a1(22) NAS-IP-Address = 192.168.1.5(22) Restoring &session-state(22) &session-state:Module-Failure-Message := "mschap: Abnormal child exit: No error"(22) # Executing section authorize from file /usr/local/pf/raddb//sites-enabled/packetfence(22) authorize {(22) update {(22) EXPAND %{Packet-Src-IP-Address}(22) --> 192.168.1.5(22) &request:FreeRADIUS-Client-IP-Address := 192.168.1.5(22) &control:PacketFence-RPC-Server = 127.0.0.1(22) &control:PacketFence-RPC-Port = 7070(22) &control:PacketFence-RPC-User = (22) &control:PacketFence-RPC-Pass = (22) &control:PacketFence-RPC-Proto = http(22) EXPAND %l(22) --> 1462892248(22) &control:Tmp-Integer-0 := 1462892248(22) &control:PacketFence-Request-Time := 0(22) } # update = noop(22) policy rewrite_calling_station_id {(22) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {(22) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE(22) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {(22) update request {(22) EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}(22) --> 00:40:d0:67:d0:b1(22) &Calling-Station-Id := 00:40:d0:67:d0:b1(22) } # update request = noop(22) [updated] = updated(22) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated(22) ... skipping else for request 22: Preceding "if" was taken(22) } # policy rewrite_calling_station_id = updated(22) policy rewrite_called_station_id {(22) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) {(22) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) -> TRUE(22) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) {(22) update request {(22) &Called-Station-Id !* ANY(22) EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}(22) --> ec:44:76:87:f0:83(22) &Called-Station-Id := ec:44:76:87:f0:83(22) } # update request = noop(22) if ("%{8}") {(22) EXPAND %{8}(22) --> (22) if ("%{8}") -> FALSE(22) elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) {(22) elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE(22) elsif (Aruba-Essid-Name) {(22) elsif (Aruba-Essid-Name) -> FALSE(22) elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) {(22) EXPAND %{Cisco-AVPair}(22) --> audit-session-id=C0A801050000003200BCDD37(22) elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE(22) [updated] = updated(22) } # if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) = updated(22) ... skipping else for request 22: Preceding "if" was taken(22) } # policy rewrite_called_station_id = updated(22) policy filter_username {(22) if (&User-Name) {(22) if (&User-Name) -> TRUE(22) if (&User-Name) {(22) if (&User-Name =~ / /) {(22) if (&User-Name =~ / /) -> FALSE(22) if (&User-Name =~ /@[^@]*@/ ) {(22) if (&User-Name =~ /@[^@]*@/ ) -> FALSE(22) if (&User-Name =~ /\.\./ ) {(22) if (&User-Name =~ /\.\./ ) -> FALSE(22) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(22) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(22) if (&User-Name =~ /\.$/) {(22) if (&User-Name =~ /\.$/) -> FALSE(22) if (&User-Name =~ /(a)\./) {(22) if (&User-Name =~ /(a)\./) -> FALSE(22) } # if (&User-Name) = updated(22) } # policy filter_username = updated(22) policy filter_password {(22) if (&User-Password && (&User-Password != "%{string:User-Password}")) {(22) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE(22) } # policy filter_password = updated(22) [preprocess] = ok(22) suffix: Checking for suffix after "@"(22) suffix: No '@' in User-Name = "Administrateur", skipping NULL due to config.(22) [suffix] = noop(22) ntdomain: Checking for prefix before "\"(22) ntdomain: No '\' in User-Name = "Administrateur", looking up realm NULL(22) ntdomain: No such realm "NULL"(22) [ntdomain] = noop(22) eap: Peer sent EAP Response (code 2) ID 10 length 43(22) eap: Continuing tunnel setup(22) [eap] = ok(22) } # authorize = ok(22) Found Auth-Type = eap(22) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence(22) authenticate {(22) eap: Expiring EAP session with state 0x951d7ff092176631(22) eap: Finished EAP session with state 0x951d7ff092176631(22) eap: Previous EAP request found for state 0x951d7ff092176631, released from the list(22) eap: Peer sent packet with method EAP PEAP (25)(22) eap: Calling submodule eap_peap to process data(22) eap_peap: Continuing EAP-TLS(22) eap_peap: [eaptls verify] = ok(22) eap_peap: Done initial handshake(22) eap_peap: [eaptls process] = ok(22) eap_peap: Session established. Decoding tunneled attributes(22) eap_peap: PEAP state send tlv failure(22) eap_peap: Received EAP-TLV response(22) eap_peap: The users session was previously rejected: returning reject (again.)(22) eap_peap: This means you need to read the PREVIOUS messages in the debug output(22) eap_peap: to find out the reason why the user was rejected(22) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you(22) eap_peap: what went wrong, and how to fix the problem(22) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed(22) eap: Sending EAP Failure (code 4) ID 10 length 4(22) eap: Failed in EAP select(22) [eap] = invalid(22) } # authenticate = invalid(22) Failed to authenticate the user(22) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1)(22) Using Post-Auth-Type Reject(22) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence(22) Post-Auth-Type REJECT {(22) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) {(22) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) -> FALSE(22) attr_filter.access_reject: EXPAND %{User-Name}(22) attr_filter.access_reject: --> Administrateur(22) attr_filter.access_reject: Matched entry DEFAULT at line 11(22) [attr_filter.access_reject] = updated(22) attr_filter.packetfence_post_auth: EXPAND %{User-Name}(22) attr_filter.packetfence_post_auth: --> Administrateur(22) attr_filter.packetfence_post_auth: Matched entry DEFAULT at line 10(22) [attr_filter.packetfence_post_auth] = updated(22) [eap] = noop(22) policy remove_reply_message_if_eap {(22) if (&reply:EAP-Message && &reply:Reply-Message) {(22) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE(22) else {(22) [noop] = noop(22) } # else = noop(22) } # policy remove_reply_message_if_eap = noop(22) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default}(22) linelog: --> messages.Access-Reject(22) linelog: EXPAND %t : [mac:%{Calling-Station-Id}] Rejected user: %{User-Name}(22) linelog: --> Tue May 10 16:57:28 2016 : [mac:00:40:d0:67:d0:b1] Rejected user: Administrateur(22) linelog: EXPAND /usr/local/pf/logs/radius.log(22) linelog: --> /usr/local/pf/logs/radius.log(22) [linelog] = ok(22) } # Post-Auth-Type REJECT = updated(22) Delaying response for 1.000000 secondsWaking up in 0.3 seconds.Waking up in 0.6 seconds.(22) Sending delayed response(22) Sent Access-Reject Id 233 from 192.168.10.1:1812 to 192.168.1.5:1645 length 44(22) EAP-Message = 0x040a0004(22) Message-Authenticator = 0x00000000000000000000000000000000Waking up in 3.7 seconds.(14) Cleaning up request packet ID 225 with timestamp +160(15) Cleaning up request packet ID 226 with timestamp +160(16) Cleaning up request packet ID 227 with timestamp +160(17) Cleaning up request packet ID 228 with timestamp +160(18) Cleaning up request packet ID 229 with timestamp +160(19) Cleaning up request packet ID 230 with timestamp +160(20) Cleaning up request packet ID 231 with timestamp +160Waking up in 0.1 seconds.(21) Cleaning up request packet ID 232 with timestamp +160(22) Cleaning up request packet ID 233 with timestamp +160Ready to process requests

2 1

Parse error for non-hex characters in users file
by Derek Wuelfrath 11 May '16

11 May '16

Hello list, Working with a FreeRADIUS 2.2.8 (I know, it’s “old” but for the moment, upgrade is not really a possible way) I am getting the following error when trying to start radiusd. Error: Parse error (check) for entry my_awesome_username: Non-hex characters at gX The users file specified by the error message does contains some “hex characters” as the “hashed password” for a user entry. ie: “my_awesome_username” MD5-Password := “0X………" It looks to me like FreeRADIUS is trying to interpret the password as an hexadecimal value and then breaks… I found out that there may be a fix for this exact “issue” introduced in FreeRADIUS 3.0.6 (https://lists.freeradius.org/pipermail/freeradius-users/2015-February/07588… <https://lists.freeradius.org/pipermail/freeradius-users/2015-February/07588…>) Handle NT-Hash in rlm_pap. This allows passwords to have backslashes in them. I was wondering if someone could point me to the patch file / the fix itself so that I can evaluate if it is something possible to port that fix onto my 2.2.8 version. Thanks! Cheers! -dw. — Derek Wuelfrath dwuelfrath(a)inverse.ca :: +1.514.447.4918 (x110) :: +1.866.353.6153 (x110) Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

3 3

Fwd: ERROR: pap : Cleartext password does not match "known good" password
by orion doty 11 May '16

11 May '16

I don't understand what is happening to the password as I can see it correctly in the access request. I also would have expected to see the password on this line just before the error: (0) Auth-Type PAP { (0) pap : Login attempt with password [SHOULDN'T THE PASSWORD BE HERE??? IT IS NOT] Here is the full output (minus the IP addresses): Received Access-Request Id 8 from X:18852 to X:1812 length 107 User-Name = '20c9d081bcc3' User-Password = '20c9d081bcc3' NAS-Identifier = '58-B6-33-1A-7D-20' NAS-IP-Address = X Service-Type = Login-User NAS-Port-Type = Wireless-802.11 Message-Authenticator = 0xafa4b69194ca031fd61fa4c300b0198c (0) Received Access-Request packet from host X port 18852, id=8, length=107 (0) User-Name = '20c9d081bcc3' (0) User-Password = '20c9d081bcc3' (0) NAS-Identifier = '58-B6-33-1A-7D-20' (0) NAS-IP-Address = X (0) Service-Type = Login-User (0) NAS-Port-Type = Wireless-802.11 (0) Message-Authenticator = 0xafa4b69194ca031fd61fa4c300b0198c (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) sql : EXPAND %{User-Name} (0) sql : --> 20c9d081bcc3 (0) sql : SQL-User-Name set to '20c9d081bcc3' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '20c9d081bcc3' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '20c9d081bcc3' ORDER BY id' (0) sql : User found in radcheck table (0) sql : Check items matched (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '20c9d081bcc3' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = '20c9d081bcc3' ORDER BY id' (0) sql : User found in radreply table (0) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT groupname FROM radusergroup WHERE username = '20c9d081bcc3' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = '20c9d081bcc3' ORDER BY priority' (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) if (notfound) (0) if (notfound) -> FALSE (0) expiration : Account will expire at 'May 12 2016 13:00:00 UTC' (0) [expiration] = ok (0) if (userlock) (0) if (userlock) -> FALSE (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap : Login attempt with password *(0) ERROR: pap : Cleartext password does not match "known good" password* (0) pap : Passwords don't match (0) [pap] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> 20c9d081bcc3 (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response Waking up in 3.9 seconds. (0) Cleaning up request packet ID 8 with timestamp +6 of note: records in the mysql radcheck table related to the user | 54 | 20C9D081BCC3 | Expiration | := | 12 May 2016 13:00 | | 55 | 20C9D081BCC3 | Cleartext-Password | := | 20C9D081BCC3 | | 56 | 20C9D081BCC3 | Site-Id | := | LAB |

3 3

Issue with cuisql timing out on FR 3.12
by Alex Sharaz 11 May '16

11 May '16

Got a batch of FR server acting as our ORPS servers, two are FR 3.12 and two are 2.2.9. FR 3.12b config based upon 2.2.9 config as that;s been stable and hasn't changed for years. Fr 2.2.9 just works. With 3.12 however, since I brought them on line I've had problems with accessing a mysql CUI table. There's a scheduled backup of our mysql servers at 4:07 every morning. So I'm seeing Tue May 10 04:07:57 2016 : Error: (457308) Ignoring duplicate packet from client roaming1.ja.net port 61546 - ID: 179 due to unfinished request in component post-auth module cuisql and ..... Tue May 10 04:14:14 2016 : Error: rlm_sql (cuisql): No connections available and at max connection limit Tue May 10 04:14:14 2016 : Auth: (457515) Rejected in post-auth: [nagios] (from client systems0 port 0 cli 02-ED-79-28-F8-2A) So the above is happening because of the mysql backups and hence, every morning I get text messages saying both eduroam3 & eduroam4 are down .. which they're not. Guess I could skip the cuisql statements for the healthchecks, but that would be cheating ... Guess you're going to tell me to fix the mysql database access .... or is there something I can do to ignore cui stuff while the database is being backed up? A

4 8

freeRadius instance without Authentication for Accounting
by liran kessel 10 May '16

10 May '16

Hi, I am interested in setting up an instance of freeRadius that will receive cloned data from a Radius Server in a telco operator environment. The purpose of the server is for us to be able to collect usage data and load it into our Datastore for analysis and BI. can anyone assist me in how I would set up the server once installed to prevent the server from performing authentication ,and accepting all messages. In addition we need to load the usage data info received initially into csv files that can then be loaded in to both a relational database (Oracle) and a NoSql (MongoDB) environment? Lastly is there a way to configure filtering of what messages are saved and logged? filtering would be needed to be performed by certain fields in the message , Thanks in advance to everyones time and help. Liran Kessel

3 9

Fwd: Freeradius 2.2.9 eap/peap problem
by Mr Dini 10 May '16

10 May '16

Hi Alan! At the Git page of the project You told me (my nick is MrDini) to use the older freeradius (2.2.9) in my nas. I compiled it and I set up to a mysql database, but it sends Access-reject and something like this: [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: SSLv3 read client certificate A [peap] TLS_accept: Need to read more data: SSLv3 read client key exchange A [peap] TLS_accept: Need to read more data: SSLv3 read client key exchange A Here <http://pastebin.com/TTXY4Ngd> is the full output of the radiusd -X. Is it a compile error? Or what Do You think, What is that? Thanks! Dan

2 6

Authorizing using LDAP attributes
by Clayton Knorr 09 May '16

09 May '16

Running radius 2.1.12 and Openldap (openldap just for testing at this point) Ok, my situation in a nutshell. Trying to solve a problem. Need to provide EAP authentication for wifi to many devices. The freeradius server will be hitting an LDAP directory which is not in my control. I need to be able to have conditional logic to allow only certain users with certain attributes in the LDAP directory connect to certain RADIUS clients. I don't control the LDAP directory so using groups or OUs is not an option. So for example if the ldap user has an attribute Location that equals "A1234" I only want them to connect to one or a subset of Aps/controllers. I have gotten to the point where everything works for EAP, just the LDAP attributes mapping to RADIUS attributes is giving me fits. So I have a test ldap directory in which I have set users up with the attribute businessCategory set to A1000. I have added an entry to the main dictionary file: ATTRIBUTE My-Local-String 3000 string I have added a line to ldap.attrmap: checkItem My-Local-String businessCategory I have the following in my post-auth section in sites-enabled/default: if ( Called-Station-Id == "AC-85-75-46-55-91:Peep" && My-Local-String == "A1000" ) { noop } else { reject } Here are some logs from what happens when I try to log in: ... [ldap] looking for check items in directory... [ldap] businessCategory -> My-Local-String == "A1000" [ldap] userPassword -> Cleartext-Password == "password" [ldap] userPassword -> Password-With-Header == "password" [ldap] looking for reply items in directory... [ldap] user uuserton authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] return ..... # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++? if (Called-Station-Id == "AC-85-75-46-55-91:Peep" && My-Local-String == "A1000" ) ? Evaluating (Called-Station-Id == "AC-86-74-46-65-91:Peep" ) -> TRUE (Attribute My-Local-String was not found) ? Evaluating (My-Local-String == "A1000" ) -> FALSE ++? if (Called-Station-Id == "AC-86-74-46-65-91:Peep" && My-Local-String == "A1000" ) -> FALSE ++- entering else else {...} +++[reject] returns reject ++- else else returns reject Using Post-Auth-Type Reject The baffling part is where it says "Attribute My-Local-String was not found." Am I completely barking up the wrong tree here? Is ldap.attrmap meant to be used for something completely different? Thanks....

2 4

Re: EAP-TLS: Same cert, multiple servers and locations?
by Ted Hyde 07 May '16

07 May '16

>> Can I use a single common name (ie. myglobalsites) for the certificate set >> across my entire domain, and simply copy the entire set, (ca/pem/der/p12) >> from site to site? Does openssl and freeradius together use any hardware >> info (CPU serial, resolved ip addr, etc) that would cause a copied cert to >> crash? > Same server cert across multiple servers is fine. > > The client doesn't see anything about the server when it connects > to an SSID apart from the certificate, so it has no idea which > particular server the response came from. Unlike HTTPS etc there's > no existing network connection and therefore no DNS, so it can't > even check that the "hostname" it's connecting to is the same as > the cert name returned. > > Matthew > > Matthew - many thanks, exactly the answer I was looking for! Ted.

4 5

Re: EAP error
by Alan DeKok 07 May '16

07 May '16

> On May 7, 2016, at 9:52 AM, TOURE Amidou Florian <amidoufloriantoure(a)yahoo.fr> wrote: > > I have read the output and it is the only information that I have. The DEBUG OUTPUT contains the real error. You're just not reading it. The DEBUG OUTPUT YOU POSTED TO THE LIST says that you should go read the REST of the debug output. You clearly understand English, so you should be able to understand that message. Go read the REST of the debug output. Stop complaining. Alan DeKok.

1 0

EAP error
by TOURE Amidou Florian 07 May '16

07 May '16

Hi all ,Ecxuse me to disturb again but I have a problem when I want to authenticate a radius local user on a NAC solution which is Packetfence.I have installed a windows certificate on the client and on my server. But I got this specific error : (8) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1) Is someone know how to solve this? This my radius debug output Regards Amidou 8) eap_peap: This means you need to read the PREVIOUS messages in the debug output (8) eap_peap: to find out the reason why the user was rejected (8) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (8) eap_peap: what went wrong, and how to fix the problem (8) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (8) eap: Sending EAP Failure (code 4) ID 10 length 4 (8) eap: Failed in EAP select (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1) (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence (8) Post-Auth-Type REJECT { (8) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { (8) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) -> FALSE (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> Administrateur (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) attr_filter.packetfence_post_auth: EXPAND %{User-Name} (8) attr_filter.packetfence_post_auth: --> Administrateur (8) attr_filter.packetfence_post_auth: Matched entry DEFAULT at line 10 (8) [attr_filter.packetfence_post_auth] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (8) linelog: --> messages.Access-Reject (8) linelog: EXPAND %t : [mac:%{Calling-Station-Id}] Rejected user: %{User-Name} (8) linelog: --> Sat May 7 17:23:12 2016 : [mac:00:40:d0:67:d0:b1] Rejected user: Administrateur (8) linelog: EXPAND /usr/local/pf/logs/radius.log (8) linelog: --> /usr/local/pf/logs/radius.log (8) [linelog] = ok (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 54 from 192.168.10.1:1812 to 192.168.1.5:1645 length 44 (8) EAP-Message = 0x040a0004 (8) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. (0) Cleaning up request packet ID 46 with timestamp +3 (1) Cleaning up request packet ID 47 with timestamp +3 (2) Cleaning up request packet ID 48 with timestamp +3 (3) Cleaning up request packet ID 49 with timestamp +3 (4) Cleaning up request packet ID 50 with timestamp +4 (5) Cleaning up request packet ID 51 with timestamp +4 (6) Cleaning up request packet ID 52 with timestamp +4 Waking up in 0.1 seconds. (7) Cleaning up request packet ID 53 with timestamp +4 (8) Cleaning up request packet ID 54 with timestamp +4 Ready to process requests Envoyé depuis Yahoo Mail pour Android

2 1