September 2016 - Freeradius-Users - lists.freeradius.org

Troubleshooting EAP-TLS with External Certificates
by Matthew West 16 Sep '16

16 Sep '16

Hello FreeRADIUS Users, Thank you for taking my question. I am in the process of troubleshooting the EAP-TLS process using the following version of FreeRADIUS: radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu openssl: openssl-1.0.1e-48.el6_8.1.x86_64 I've gotten successful authentication using PAP through a switch with a test user, so the service is available and the client switch is communicating correctly. FreeRADIUS starts just fine, has the correct client, EAP loads, and points to the correct certs. I also have a client certificate in the certificate directory. Server certificate (star.companyname.net) was issued by GoDaddy and my (client) certificate was issued by VeriSign. I am pointing to the GoDaddy CA bundle for the server, but am not sure where to put the 'user' certificate chain (or does the whole chain need to be in the user cert)? Am I interpreting the error correctly? That the client cert appears to be self signed? radius -X OUTPUT: ==================== ... radiusd: #### Loading Clients #### client ***-CORP-SW1 { ipaddr = 10.x.x.123 require_message_authenticator = no secret = "xxxxxx" } ... ... Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } ... ... Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/star.XXX.net.key" certificate_file = "/etc/raddb/certs/star.XXX.net.crt" CA_file = "/etc/raddb/certs/gd_bundle-g2.crt" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } ... ... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ... When a request is made, I receive the following output: ... # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "Matthew West", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 20 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 11fa], Certificate --> verify error:num=19:self signed certificate in certificate chain [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> Matthew West attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 39 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 39 Sending Access-Reject of id 104 to 10.***.***.123 port 1645 EAP-Message = 0x04140004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 30 ID 95 with timestamp +227 Cleaning up request 31 ID 96 with timestamp +227 Cleaning up request 32 ID 97 with timestamp +227 Cleaning up request 33 ID 98 with timestamp +227 Cleaning up request 34 ID 99 with timestamp +227 Cleaning up request 35 ID 100 with timestamp +227 Cleaning up request 36 ID 101 with timestamp +227 Cleaning up request 37 ID 102 with timestamp +227 Cleaning up request 38 ID 103 with timestamp +227 Waking up in 1.0 seconds. Cleaning up request 39 ID 104 with timestamp +227 Ready to process requests. ... Any help appreciated. Thank You, Matthew

8 32

Metrics and timings
by Louis Munro 16 Sep '16

16 Sep '16

Hello, I am curious to know what people use, if anything, to collect metrics about the various database calls that FreeRADIUS does. E.g. How fast is that LDAP server, or that SQL database? Sure you can measure some of that from the database side itself, and radsniff can give you some idea of the latency for your requests, but what do you do if you make multiple calls to a series of servers, some of which you may not have access to (cough.. AD server )? I have in the past written a wrapper for ntlm_auth that was logging the times (and sent them to a statsd server) but that process is now going away -- which is a good thing -- and that case does not cover metrics for FR's own modules. Ideally I'd like to be able to point to a slowdown in one submodule (redis, ldap, sql, winbind etc.) to explain why the total latency has increased. Short of adding metrics to each module I want them from (something I have played with using a statsd client library) is there a recommended way of getting that information? Especially if I want historical data to be able to compare against for anomaly detection or capacity planning? Any suggestions are welcome and appreciated. -- Louis Munro lmunro(a)inverse.ca <mailto:lmunro@inverse.ca> :: www.inverse.ca <http://www.inverse.ca/> +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu <http://www.sogo.nu/>) and PacketFence (www.packetfence.org <http://www.packetfence.org/>)

3 4

Help troubleshooting No EAP session matching...
by Dave Aldwinckle 16 Sep '16

16 Sep '16

Hi List, During periods of high load, we are seeing many messages like the following: radiusd[28187]: rlm_eap: No EAP session matching the State variable. I understand the meaning of the message, but I need some assistance on how to go about locating the source of the problem. During peak times, we have about 8K wireless logins per minute, for extended periods. We have 6 wireless controllers, from which the Access-Requests are sent. Due to the high load, I am unable to run the server with -X, because it gets crushed while running single threaded. I can use radmin, but I'm not sure what to set the debug condition to. I don't see any errors about child processes being hung, or winbind/ntlm_auth taking too long. Some values which may be relevant: radiusd.conf: max_request_time = 30 radiusd.conf: cleanup_delay = 5 radiusd.conf: max_requests = 8000000 #about 30K wireless users at peak * 256 ~= 8million radiusd.conf: start_servers = 5 radiusd.conf: max_servers = 32 radiusd.conf: min_spare_servers = 3 radiusd.conf: max_spare_servers = 10 radiusd.conf: # max_queue_size = 65536 (unsure why this is commented out) mods-enabled/eap: timer_expire = 60 mods-enabled/eap: cache = disabled $ openssl speed rsa2048 Doing 2048 bit private rsa's for 10s: 5263 2048 bit private RSA's in 10.01s Doing 2048 bit public rsa's for 10s: 176233 2048 bit public RSA's in 10.00s OpenSSL 1.0.1e-fips 11 Feb 2013 built on: Mon May 2 06:13:20 EDT 2016 options:bn(64,64) md2(int) rc4(16x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx) compiler: gcc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -DKRB5_MIT -m64 -DL_ENDIAN -DTERMIO -Wall -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic -Wa,--noexecstack -DPURIFY -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM sign verify sign/s verify/s rsa 2048 bits 0.001902s 0.000057s 525.8 17623.3 So, a couple questions: 1. Is there a way to get more info along with the message "rlm_eap: No EAP session matching the State variable." ? - eg. Which NAS it came from, calling-station-id, etc. 2. Are the aforementioned values OK? Any advice would be appreciated. Regards, Dave

4 16

CoA reply a wrong Session-Timeout
by prometeotv＠tiscali.it 16 Sep '16

16 Sep '16

Hi to all I am running freeradius ver 2.1.12-6 on CentOS 6.0. I have configured freeradius with sql_counter module and all is working fine. Now I have to configure CoA but on my NAS (Mikrotik) I receive the Session-Timeout equal to 0 and the same is for the Traffic (Mikrotik-XMit-Limit attribute) Which is the freeradius variable to pass to Session-Timeout inside the "update coa{" in order to have the residual credit time of the user? This is the freeradius configuration: /ETC/SITE-AVAILABLE/DEFAULT authorize { rewrite.calling_station_id preprocess chap mschap suffix eap { ok = return } unix sql expiration logintime pap noresetcounter dailycounter monthlycounter noresettrafficcounter dailytraffic monthlytraffic pppoetrafficcounter pppoedailytraffic pppoemonthlytraffic update control { Auth-Type := `/usr/bin/php -f /sitiweb/hotspot/functions/freeradiusauthorize.php %{User-Name} %{User-Password} %{Calling-Station-Id} %{NAS-IP-Address} %{Called-Station-ID}` } } accounting { rewrite.calling_station_id unix sql #COA update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" Framed-IP-Address = "%{Framed-IP-Address}" Session-Timeout = "%{Session-Timeout}" # Session-Timeout = "%{Credit-Time}" # Session-Timeout = "%{noresetcounter:Credit-Time}" # Session-Timeout = "%{Session-Timeout}" # Session-Timeout = "%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'}" # Session-Timeout = "%{noresetcounter}" # Session-Timeout = "%{rlm_sqlcounter:noresetcounter}" Mikrotik-XMit-Limit = "%{Mikrotik-XMit-Limit}" # Mikrotik-XMit-Limit = "%{Monthly-Credit-Traffic}" } # update control { # Send-CoA-Request = Yes # } } CLIENTS.CONF: client 0.0.0.0/0 { secret = hshelioos require_message_authenticator = no nastype = other } #COA home_server piazzalaterale-coa { type = coa # # Note that a home server of type "coa" MUST be a real NAS, # with an ipaddr or ipv6addr. It CANNOT point to a virtual # server. # ipaddr = 192.168.0.201 port = 3799 # This secret SHOULD NOT be the same as the shared # secret in a "client" section. secret = hshelioos # CoA specific parameters. See raddb/proxy.conf for details. coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } SQLCOUNTER.CONF: sqlcounter noresetcounter { counter-name = Max-All-Session-Time check-name = Credit-Time sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}'" } sqlcounter dailycounter { driver = "rlm_sqlcounter" counter-name = Daily-Session-Time check-name = Daily-Credit-Time sqlmod-inst = sql key = User-Name #reset = daily reset = never #query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" #query = "SELECT SUM(SessionTime) FROM (SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) AS SessionTime FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b' UNION SELECT 0 AS SessionTime) AS Results" query = "SELECT SUM(SessionTime) FROM (SELECT SUM(AcctSessionTime) AS SessionTime FROM radacct WHERE UserName='%{%k}' AND DATE(NOW())=DATE(acctstoptime) UNION SELECT 0 AS SessionTime) AS Results" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Monthly-Credit-Time sqlmod-inst = sql key = User-Name #reset = daily reset = never #query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" #query = "SELECT SUM(SessionTime) FROM (SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) AS SessionTime FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b' UNION SELECT 0 AS SessionTime) AS Results" query = "SELECT SUM(SessionTime) FROM (SELECT SUM(AcctSessionTime) AS SessionTime FROM radacct WHERE UserName='%{%k}' AND MONTH(acctstoptime) = MONTH(NOW()) AND YEAR(acctstoptime) = YEAR(NOW()) UNION SELECT 0 AS SessionTime) AS Results" } and this is the LOG of "radiusd -X" command: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.201 port 33465, id=32, length=230 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:22:5F:0F:58:84" Called-Station-Id = "Piazza Laterale" NAS-Port-Id = "hs-bridge" User-Name = "00393383880766@BarCentrale" NAS-Port = 2151677962 Acct-Session-Id = "8040000a" Framed-IP-Address = 10.0.200.105 Mikrotik-Host-IP = 10.0.200.105 CHAP-Challenge = 0x980558b3c7d785a90bcc313cb3d36f05 CHAP-Password = 0xb857266bd68f0ad533ce1801e25f165f64 Service-Type = Login-User WISPr-Logoff-URL = "http://0.0.0.0/logout" NAS-Identifier = "Piazza Laterale" NAS-IP-Address = 192.168.0.201 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++- entering policy rewrite.calling_station_id {...} +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) ?? Evaluating (Calling-Station-Id) -> TRUE expand: %{Calling-Station-Id} -> 00:22:5F:0F:58:84 expand: policy.mac-addr -> policy.mac-addr expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++- entering if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) {...} expand: %{1}:%{2}:%{3}:%{4}:%{5}:%{6} -> 00:22:5F:0F:58:84 expand: %{toupper:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}} -> 00:22:5F:0F:58:84 ++++[request] returns notfound ++++[updated] returns updated +++- if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) returns updated +++ ... skipping else for request 0: Preceding "if" was taken ++- policy rewrite.calling_station_id returns updated ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] Looking up realm "BarCentrale" for User-Name = "00393383880766@BarCentrale" [suffix] No such realm "BarCentrale" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [sql] expand: %{User-Name} -> 00393383880766@BarCentrale [sql] sql_set_user escaped user --> '00393383880766@BarCentrale' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '00393383880766@BarCentrale' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '00393383880766@BarCentrale' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '00393383880766@BarCentrale' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'DEFAULT2048K-256K-5DEVICES' ORDER BY id [sql] User found in group DEFAULT2048K-256K-5DEVICES [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'DEFAULT2048K-256K-5DEVICES' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop rlm_sqlcounter: Entering module authorize code WARNING: Please replace '%k' with '${key}' sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='00393383880766@BarCentrale' WARNING: Please replace '%S' with '${sqlmod-inst}' sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='00393383880766@BarCentrale'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> 00393383880766@BarCentrale [noresetcounter] sql_set_user escaped user --> '00393383880766@BarCentrale' [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='00393383880766@BarCentrale' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='00393383880766@BarCentrale' rlm_sql (sql): Reserving sql socket id: 3 [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='00393383880766@BarCentrale'} -> 747 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user 00393383880766@BarCentrale, check_item=2700, counter=747 rlm_sqlcounter: Sent Reply-Item for user 00393383880766@BarCentrale, Type=Session-Timeout, value=1953 ++[noresetcounter] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresettrafficcounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailytraffic] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlytraffic] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[pppoetrafficcounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[pppoedailytraffic] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[pppoemonthlytraffic] returns noop expand: %{User-Name} -> 00393383880766@BarCentrale expand: %{User-Password} -> expand: %{Calling-Station-Id} -> 00:22:5F:0F:58:84 expand: %{NAS-IP-Address} -> 192.168.0.201 expand: %{Called-Station-ID} -> Piazza Laterale Exec-Program output: Exec-Program: returned: 0 ++[control] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. CHAP-Password is correct. # Executing section session from file /etc/raddb/sites-enabled/default +- entering group session {...} [sql] expand: %{User-Name} -> 00393383880766@BarCentrale [sql] sql_set_user escaped user --> '00393383880766@BarCentrale' [sql] expand: SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL -> SELECT COUNT(*) FROM radacct WHERE username = '00393383880766@BarCentrale' AND acctstoptime IS NULL rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 00393383880766@BarCentrale [sql] sql_set_user escaped user --> '00393383880766@BarCentrale' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0xb857266bd68f0ad533ce1801e25f165f64 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '00393383880766@BarCentrale', '0xb857266bd68f0ad533ce1801e25f165f64', 'Access-Accept', '2016-09-16 14:22:23') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '00393383880766@BarCentrale', '0xb857266bd68f0ad533ce1801e25f165f64', 'Access-Accept', '2016-09-16 14:22:23') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 32 to 192.168.0.201 port 33465 SESSION-TIMEOUT := 1953 Idle-Timeout := 180 WISPr-Bandwidth-Max-Down := 2048000 WISPr-Bandwidth-Max-Up := 256000 Mikrotik-Rate-Limit := "256000/2048000" Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 192.168.0.201 port 55450, id=33, length=176 Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:22:5F:0F:58:84" Called-Station-Id = "Piazza Laterale" NAS-Port-Id = "hs-bridge" User-Name = "00393383880766@BarCentrale" NAS-Port = 2151677962 Acct-Session-Id = "8040000a" Framed-IP-Address = 10.0.200.105 Mikrotik-Host-IP = 10.0.200.105 Event-Timestamp = "Sep 16 2016 14:22:23 CEST" NAS-Identifier = "Piazza Laterale" Acct-Delay-Time = 0 NAS-IP-Address = 192.168.0.201 # Executing section preacct from file /etc/raddb/radiusd.conf +- entering group preacct {...} [acct_unique] Hashing 'Client-IP-Address = 192.168.0.201,NAS-IP-Address = 192.168.0.201,Acct-Session-Id = "8040000a",User-Name = "00393383880766@BarCentrale"' [acct_unique] Acct-Unique-Session-ID = "9fbe06198361f0df". ++[acct_unique] returns ok # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} ++- entering policy rewrite.calling_station_id {...} +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) ?? Evaluating (Calling-Station-Id) -> TRUE expand: %{Calling-Station-Id} -> 00:22:5F:0F:58:84 expand: policy.mac-addr -> policy.mac-addr expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++? if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++- entering if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) {...} expand: %{1}:%{2}:%{3}:%{4}:%{5}:%{6} -> 00:22:5F:0F:58:84 expand: %{toupper:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}} -> 00:22:5F:0F:58:84 ++++[request] returns noop ++++[updated] returns updated +++- if ((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) returns updated +++ ... skipping else for request 1: Preceding "if" was taken ++- policy rewrite.calling_station_id returns updated ++[unix] returns ok [sql] expand: %{User-Name} -> 00393383880766@BarCentrale [sql] sql_set_user escaped user --> '00393383880766@BarCentrale' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> 00393383880766@BarCentrale attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated expand: %{User-Name} -> 00393383880766@BarCentrale expand: %{Acct-Session-Id} -> 8040000a expand: %{NAS-IP-Address} -> 192.168.0.201 expand: %{Framed-IP-Address} -> 10.0.200.105 EXPAND: %{SESSION-TIMEOUT} -> ++[coa] returns updated Sending Accounting-Response of id 33 to 192.168.0.201 port 55450 WARNING: Empty pre-proxy section. Using default return values. SENDING COA-REQUEST OF ID 217 TO 192.168.0.201 PORT 3799 User-Name = "00393383880766@BarCentrale" Acct-Session-Id = "8040000a" NAS-IP-Address = 192.168.0.201 Framed-IP-Address = 10.0.200.105 SESSION-TIMEOUT = 0 Finished request 1. Cleaning up request 1 ID 33 with timestamp +134 Going to the next request Waking up in 1.8 seconds. rad_recv: CoA-ACK packet from host 192.168.0.201 port 3799, id=217, length=43 NAS-Identifier = "Piazza Laterale" NAS-IP-Address = 192.168.0.201 # Executing section post-proxy from file /etc/raddb/sites-enabled/default As you can see from the LOG, CoA is working correctly but send as Session-Timeout 0, instead of the correct credit Traffic for the user that is 1953. I have tried a lot of variable on the "coa update" for Session-Timeout and Mikrotik-XMit-Limit but none work. Can someone help me? Best regards Con Smart 3 Giga a 9 euro/4 sett navighi veloce, chiami e invii SMS dal tuo smartphone verso tutti i fissi e mobili in Italia. Passa a Tiscali Mobile! http://casa.tiscali.it/mobile/

2 1

disable response for accounting
by liran kessel 14 Sep '16

14 Sep '16

> > Hi, > > we have a freereadius server that is only responsible for collecting accounting info from a mobile network and storing to mysql. > However the network administrators have requested we don’t send back respond messages to confirm we received the message. > > I have found this thread from a few years ago and did as it suggested. > > http://lists.freeradius.org/pipermail/freeradius-users/2012-May/060723.html <http://lists.freeradius.org/pipermail/freeradius-users/2012-May/060723.html> > > but while it seems to have stopped sending responses to the network, it stopped logging the info into the mysql DB, eventhough it continued to log to the detail log file. and so I had to roll back. > > Can anyone explain why this caused the server to stop writing to mysql? > > thanks > > Liran Kessel > liran(a)rizotec.com <mailto:liran@rizotec.com> > Tel:(972)-52 6786885 > www.rizotec.com <http://www.rizotec.com/> > > >

2 3

PEAP label in PRF
by Chitrang Srivastava 14 Sep '16

14 Sep '16

Hi, This is regarding seed label which is used in PRF(Pseudo random function) to derive session keys. PEAPv0: https://tools.ietf.org/html/draft-kamath-pppext-peapv0-00 - I don't see any mention of label but look like it uses *client EAP encryption ? *Any official draft or RFC mentioned PEAPv0 uses this label ? PEAPv1: https://tools.ietf.org/html/draft-josefsson-pppext-eap-tls-eap-05 *client PEAP encryption* PEAPv2: https://tools.ietf.org/html/draft-josefsson-pppext-eap-tls-eap-10 *client EAP encryption* So on the *client *side the code should be something like if(PEAP_version ==1) label is *client PEAP encryption* otherwise // For version 0 and 2 label is *client PEAP encryption* This look OK? Why PEAPv2 uses old label ?

2 3

maybe a bug: radius server did not response
by Jiang Jianping 14 Sep '16

14 Sep '16

Version: freeradius-server-3.0.11 Environment: gnugk->radius server(local relay)->radius accouting server Module: Relay Server: Accouting with detail, Accounting Server: Accouting with linelog Issue: Special characters（UTF-8 other than Ascii) wil cause radius server not response to accounting request Accounting record on Relay Server: Tue Sep 6 19:50:10 2016 Acct-Status-Type = Stop NAS-IP-Address = 123.59.170.71 NAS-Identifier = "GnuGk" NAS-Port-Type = Virtual Service-Type = Login-User Acct-Session-Id = "57c11224000006a2" User-Name = "諞\275丿\255" Framed-IP-Address = 111.23.46.106 Acct-Session-Time = 38 Calling-Station-Id = "諞\275丿\255" Called-Station-Id = "1935" h323-conf-id = "h323-conf-id=E04D5EB6 4C02001F 14FDCE5 BA6BC861" h323-gw-id = "h323-gw-id=GnuGk" h323-call-origin = "h323-call-origin=proxy" h323-call-type = "h323-call-type=VoIP" h323-setup-time = "h323-setup-time=2016-09-06 19:49:32 UTC+0800" h323-connect-time = "h323-connect-time=2016-09-06 19:49:32 UTC+0800" h323-disconnect-time = "h323-disconnect-time=2016-09-06 19:50:10 UTC+0800" h323-disconnect-cause = "h323-disconnect-cause=10" release-source = "release-source=1" gw-rxd-cgn = "preferred-codec=Unknown" gw-final-xlated-cgn = "rewritten-e164-num=1935" Cisco-AVPair = "h323pddtime=0" Cisco-AVPair = "h323ringtime=0" Cisco-AVPair = "h323routeattempts=0" Cisco-AVPair = "h323_rtp_proxy=1" Cisco-AVPair = "RTP_source_IP=123.59.170.86" Cisco-AVPair = "RTP_destination_IP=111.23.46.106" Cisco-AVPair = "RTCP_source_packet_count=0" Cisco-AVPair = "RTCP_source_packet_lost=0" Cisco-AVPair = "RTCP_source_jitter=0|0|0" Cisco-AVPair = "RTCP_destination_packet_count=0" Cisco-AVPair = "RTCP_destination_packet_lost=0" Cisco-AVPair = "RTCP_destination_jitter=0|0|0" h323-remote-address = "h323-remote-address=123.59.170.95" Cisco-AVPair = "h323-ivr-out=h323-call-id:373B5EB6 4C02001F 14FDCE5 BA6BC861" Acct-Delay-Time = 0 Realm = "radrelay" Module-Failure-Message = "Failing proxied request for user \"諞\275丿\255\", due to lack of any response from home server 10.10.10.22 port 1813" Freeradius-Proxied-To = 10.10.10.22 Timestamp = 1473162610 Linelog Configuration: Accounting-Request { Stop = "CDR:type=h323;%{h323-connect-time};%{h323-disconnect-time};duration=%{Acct-Session-Time};sessionid=%{Acct-Session-Id};caller=%{Calling-Station- Id};callee=%{Called-Station-Id};sourceip=%{Framed-IP-Address}" } Radius Accouting Server Halted at (with -X option:) (131) # Executing section accounting from file /opt/zjcloud/conf/raddb/radiusd.conf (131) accounting { (131) linelog: EXPAND Accounting-Request.%{%{Acct-Status-Type}:-unknown} (131) linelog: --> Accounting-Request.Stop (131) linelog: EXPAND /var/zjcloud/CDR/cdr-%Y%m%d%H (131) linelog: --> /var/zjcloud/CDR/cdr-2016091316 JP

3 4

COA
by Aurélio de Souza Ribeiro Neto 13 Sep '16

13 Sep '16

Hello All, I'm here again asking for Help. I'm using freeradius 2.2.9 with InnoDB MySQL database and Mikrotik 6.35 as NAS. Dynamic Ip's. I want to change some connection parameters "on fly" based on accounting packets. How can I do this? COA? I don't have a idea where I can start! Someone can help me? Thanks Aurelio

2 1

EAP-MD5 group auth failure
by Security Camera 12 Sep '16

12 Sep '16

Hi all, I am trying to narrow down this EAP-MD5 802.1x authentication for the last week and I unable to find exactly what the problem is. Can you please provide some pointers from the following logs on what could be the problem? What group auth it is expecting? Is it the user group in /etc/passwd file? I have put the user XXXX in the rad_users file along with Cleartext-Password as it was complaining that user needs to have Cleartext-Password. Thanks ash-4.3# /var/packages/RadiusServer/target/sbin/radiusd -X radiusd: FreeRADIUS Version 2.2.9 (git #e4cc22f), for host armle-unknown-linux-gnu, built on Aug 17 2016 at 14:40:46 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /var/packages/RadiusServer/tar get/etc/raddb/radiusd.conf including configuration file /usr/local/synoradius/rad_listen including configuration file /usr/local/synoradius/rad_port_auth including configuration file /usr/local/synoradius/rad_port_auth including configuration file /var/packages/RadiusServer/tar get/etc/raddb/clients.conf including configuration file /usr/local/synoradius/rad_clients including files in directory /var/packages/RadiusServer/tar get/etc/raddb/modules/ including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/ippool including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/replicate including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/mschap including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/policy including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/linelog including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/detail including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/attr_rewrite including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/cache including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/smsotp including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/sql_log including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/wimax including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/echo including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/logintime including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/perl including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/expiration including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/rediswho including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/inner-eap including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/opendirectory including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/exec including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/sradutmp including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/pap including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/unix including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/checkval including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/passwd including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/mac2ip including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/detail.example.com including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/otp including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/soh including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/counter including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/preprocess including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/chap including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/realm including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/krb5 including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/redis including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/files including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/attr_filter including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/acct_unique including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/detail.log including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/synorad including configuration file /usr/local/synoradius/synoconf including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/digest including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/etc_group including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/mschap_ad including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/expr including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/cui including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/dynamic_clients including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/smbpasswd including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/always including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/radutmp including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/ldap including configuration file /usr/local/synoradius/rad_ldap including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/pam including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/dhcp_sqlippool including configuration file /var/packages/RadiusServer/tar get/etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/ntlm_auth including configuration file /usr/local/synoradius/rad_ntlm_auth including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/mac2vlan including configuration file /var/packages/RadiusServer/tar get/etc/raddb/modules/radrelay including configuration file /var/packages/RadiusServer/tar get/etc/raddb/eap.conf including configuration file /usr/local/synoradius/rad_ca_cert including configuration file /var/packages/RadiusServer/tar get/etc/raddb/policy.conf including files in directory /var/packages/RadiusServer/tar get/etc/raddb/sites-enabled/ including configuration file /var/packages/RadiusServer/tar get/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/synoradius/rad_site_inn including configuration file /usr/local/synoradius/rad_site_inn_local including configuration file /usr/local/synoradius/rad_port_inner including configuration file /var/packages/RadiusServer/tar get/etc/raddb/sites-enabled/default including configuration file /usr/local/synoradius/rad_site_def including configuration file /usr/local/synoradius/rad_site_def_local including configuration file /var/packages/RadiusServer/tar get/etc/raddb/sites-enabled/control-socket main { allow_core_dumps = no } including dictionary file /var/packages/RadiusServer/tar get/etc/raddb/dictionary main { name = "radiusd" prefix = "/var/packages/RadiusServer/target/" localstatedir = "/var/packages/RadiusServer/target//var" sbindir = "/var/packages/RadiusServer/target//sbin" logdir = "/var/packages/RadiusServer/target//var/log/radius" run_dir = "/var/packages/RadiusServer/target//var/run/radiusd" libdir = "/var/packages/RadiusServer/target//lib" radacctdir = "/var/packages/RadiusServer/target//var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/packages/RadiusServer/target//var/run/radiusd/radiusd.pid" checkrad = "/var/packages/RadiusServer/target//sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client 192.168.2.0/24 { require_message_authenticator = no secret = "xxxxxxx" shortname = "xxxx" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /var/packages/RadiusServer/target/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /var/packages/RadiusServer/target/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /var/packages/RadiusServer/target/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /var/packages/RadiusServer/target/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /var/packages/RadiusServer/tar get/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /var/packages/RadiusServer/tar get/etc/raddb/eap.conf eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/certificate/Ra diusServer/radiusd/privkey.pem" certificate_file = "/usr/local/etc/certificate/Ra diusServer/radiusd/fullchain.pem" private_key_password = "12345" dh_file = "/var/packages/RadiusServer/target/etc/raddb/certs/dh" random_file = "/var/packages/RadiusServer/target/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384: DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE- ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA- AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA: ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE- RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE- RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES- CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA: AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256- SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS" ecdh_curve = "prime256v1" verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /var/packages/RadiusServer/target/etc/raddb/modules/preprocess preprocess { huntgroups = "/var/packages/RadiusServer/target/etc/raddb/huntgroups" hints = "/var/packages/RadiusServer/target/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /var/packages/RadiusServer/target/etc/raddb/huntgroups reading pairlist file /var/packages/RadiusServer/target/etc/raddb/hints Module: Linked to module rlm_files Module: Instantiating module "files" from file /var/packages/RadiusServer/target/etc/raddb/modules/files files { usersfile = "/var/packages/RadiusServer/target/etc/raddb/users" acctusersfile = "/var/packages/RadiusServer/target/etc/raddb/acct_users" preproxy_usersfile = "/var/packages/RadiusServer/ta rget/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /var/packages/RadiusServer/target/etc/raddb/users reading pairlist file /usr/local/synoradius/rad_users reading pairlist file /var/packages/RadiusServer/target/etc/raddb/acct_users reading pairlist file /var/packages/RadiusServer/tar get/etc/raddb/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /var/packages/RadiusServer/target/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /var/packages/RadiusServer/target/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /var/packages/RadiusServer/target/etc/raddb/modules/detail detail { detailfile = "/var/packages/RadiusServer/target//var/log/radius/radacct/% {%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /var/packages/RadiusServer/target/etc/raddb/modules/unix unix { radwtmp = "/var/packages/RadiusServer/target//var/log/radius/radwtmp" } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /var/packages/RadiusServer/target/etc/raddb/modules/radutmp radutmp { filename = "/var/packages/RadiusServer/target//var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /var/packages/RadiusServer/target/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/var/packages/RadiusServer/target/etc/raddb/attrs.accountin g_response" key = "%{User-Name}" relaxed = no } reading pairlist file /var/packages/RadiusServer/tar get/etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /var/packages/RadiusServer/target/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/var/packages/RadiusServer/target/etc/raddb/attrs.access_re ject" key = "%{User-Name}" relaxed = no } reading pairlist file /var/packages/RadiusServer/tar get/etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /usr/local/synoradius/rad_site_inn_local modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /var/packages/RadiusServer/tar get/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /var/packages/RadiusServer/target/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /var/packages/RadiusServer/target/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes allow_retry = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_passwd Module: Instantiating module "smbpasswd" from file /var/packages/RadiusServer/target/etc/raddb/modules/smbpasswd passwd smbpasswd { filename = "/etc/samba/private/smbpasswd" format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" delimiter = ":" ignorenislike = no ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 1812 } listen { type = "auth" ipaddr = 192.168.2.3 port = 1812 } listen { type = "control" listen { socket = "/var/packages/RadiusServer/target//var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address 127.0.0.1 port 1812 Listening on authentication address 192.168.2.3 port 1812 Listening on command file /var/packages/RadiusServer/tar get//var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.170 port 6103, id=2, length=145 User-Name = "xxxx" NAS-IP-Address = 192.168.2.170 NAS-Identifier = "Intelligent Switch" NAS-Port = 1 Service-Type = Framed-User Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Framed-MTU = 1300 NAS-Port-Type = Ethernet EAP-Message = 0x02ab000a017377616d69 Message-Authenticator = 0xc991c984fab9c5cf0161004eea7f75d2 # Executing section authorize from file /usr/local/synoradius/rad_site _def_local +group authorize { ++[preprocess] = ok [eap] EAP packet type response id 171 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry xxxx at line 4 ++[files] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +group authenticate { [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 2 to 192.168.2.170 port 6103 EAP-Message = 0x01ac001f1a01ac001a10e9e1c078ad05caca313100efcdba9780737761 6d69 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x973167ca979d7d7672b64682fa1c6552 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.170 port 6103, id=4, length=139 User-Name = "xxxx" NAS-IP-Address = 192.168.2.170 NAS-Port = 1 Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Framed-MTU = 1300 Service-Type = Framed-User NAS-Port-Type = Ethernet State = 0x973167ca979d7d7672b64682fa1c6552 EAP-Message = 0x02ac00060304 Message-Authenticator = 0x7ea32f868e5b2e8165614aaac0ed8338 # Executing section authorize from file /usr/local/synoradius/rad_site _def_local +group authorize { ++[preprocess] = ok [eap] EAP packet type response id 172 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry xxxx at line 4 ++[files] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/md5 [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 4 to 192.168.2.170 port 6103 EAP-Message = 0x01ad00160410fb47bcf981e68c462d0dc9670e427f8c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x973167ca969c637672b64682fa1c6552 Finished request 1. Going to the next request Waking up in 4.0 seconds. rad_recv: Access-Request packet from host 192.168.2.170 port 6103, id=6, length=155 User-Name = "xxxx" NAS-IP-Address = 192.168.2.170 NAS-Port = 1 Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Framed-MTU = 1300 Service-Type = Framed-User NAS-Port-Type = Ethernet State = 0x973167ca969c637672b64682fa1c6552 EAP-Message = 0x02ad00160410f0f526bf8df80c013258a2952d03d8f0 Message-Authenticator = 0xb82937c382730e9d6582f7a456f13eb3 # Executing section authorize from file /usr/local/synoradius/rad_site _def_local +group authorize { ++[preprocess] = ok [eap] EAP packet type response id 173 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry xxxx at line 4 ++[files] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +group authenticate { [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] = reject +} # group authenticate = reject Failed to authenticate the user. Login incorrect: [xxxx] (from client xxxx port 1 cli xx-xx-xx-xx-xx-xx) Using Post-Auth-Type Reject # Executing group from file /usr/local/synoradius/rad_site_def_local +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> xxxx attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 6 to 192.168.2.170 port 6103 EAP-Message = 0x04ad0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 2.0 seconds. Cleaning up request 0 ID 2 with timestamp +32 Waking up in 0.9 seconds. Cleaning up request 1 ID 4 with timestamp +33 Waking up in 1.9 seconds. Cleaning up request 2 ID 6 with timestamp +34 Ready to process requests.

3 4

two factor authentication mschapv2 and eat-tls
by stefan nowak 11 Sep '16

11 Sep '16

Hello, Is it possible to setup two factor authentication with use mschav2 and eap-tls? My concept is: first step is use eap-tls to check if user have valid certificate if yes then next should appear prompt with user and password(mschapv2) where check data from Active Directory server. User should get access only in case when all two steps will success . Is it possible to do with freeradius 3.x?

4 3