April 2017 - Freeradius-Users - lists.freeradius.org

Active Directory and Calling-Station-Id
by Ethariel 13 Jun '17

13 Jun '17

Hello, I'm running Freeradius : freeradius: FreeRADIUS Version 2.2.8, for host x86_64-pc-linux-gnu, built on Apr 5 2016 at 13:40:43 I've configurated Active Directory integration, and it's working fine for authentication. Local users in users file are also ok. In the local users file I can specify a calling station id like : customer Cleartext-Password := "password",Calling-Station-Id == "AA-AA-AA-AA-AA-AA" How can I use a local file (or sql table) to link a user authenticated in Active Directory with one or several calling-station-id ? If possible I'd really prefer not to use the ActiveDirectory to store the Mac addresses. The goal is to limit each login to a few devices (I know it's possible to mask mac address, this is not the point here). I've tried to insert in the users file : customer2 Calling-Station-Id := "BB-BB-BB-BB-BB-BB" but with correct password customer2 is always authenticated using the BB-....-BB mac adress or not. Thks a lot for any help, Ethariel

2 4

another crash on 3.0.x
by Stefan Winter 19 May '17

19 May '17

Hi, with that newest 3.0.x from today, I just got a crash (after some 15 min of normal operation, so nothing about stale EAP sessions this time). The directory in question exists (/var/log/radius/tlscache-eduroam-users/) but possibly there's simply no stored session if it's a fresh auth. I (again) don't have an easy way to get a full backtrace as this is happening on a live system, but maybe the below gives a hint already. Greetings, Stefan Winter Tue Mar 28 09:56:08 2017 : Info: rlm_sql (sql-null-acct-erx): Opening additional connection (3), 1 of 97 pending slots used Tue Mar 28 09:56:11 2017 : Info: (12277) eap_peap: This means you need to read the PREVIOUS messages in the debug output Tue Mar 28 09:56:11 2017 : Info: (12277) eap_peap: to find out the reason why the user was rejected Tue Mar 28 09:56:11 2017 : Info: (12277) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you Tue Mar 28 09:56:11 2017 : Info: (12277) eap_peap: what went wrong, and how to fix the problem Tue Mar 28 09:56:11 2017 : Error: Couldn't open /var/log/radius/tlscache-eduroam-users/acd33e166c8284cf667a3990565aac2efa85f6ea8c0f813fba87448829b947e5.vps for reading: No such file or directory CAUGHT SIGNAL: Segmentation fault Backtrace of last 29 frames: /usr/local/freeradius/3.0.x-20170328/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f9a7c155461] /lib64/libpthread.so.0(+0xf370)[0x7f9a7aa27370] /lib64/libssl.so.10(+0x47c92)[0x7f9a7b929c92] /lib64/libssl.so.10(SSL_CTX_add_session+0xe7)[0x7f9a7b92aaf7] /lib64/libssl.so.10(ssl_get_prev_session+0x40c)[0x7f9a7b92afcc] /lib64/libssl.so.10(ssl3_get_client_hello+0x227)[0x7f9a7b8ffbd7] /lib64/libssl.so.10(ssl3_accept+0x95d)[0x7f9a7b90481d] /lib64/libssl.so.10(ssl23_accept+0x1c8)[0x7f9a7b912508] /lib64/libssl.so.10(ssl23_read+0x32)[0x7f9a7b9136a2] /usr/local/freeradius/current/sbin/radiusd(tls_handshake_recv+0x110)[0x45058c] /usr/local/freeradius/3.0.x-20170328/lib/libfreeradius-eap.so(+0x6c51)[0x7f9a7bf40c51] /usr/local/freeradius/3.0.x-20170328/lib/libfreeradius-eap.so(eaptls_process+0x3aa)[0x7f9a7bf410b2] /usr/local/freeradius/3.0.x-20170328/lib/rlm_eap_peap.so(+0x1f9c)[0x7f9a75c80f9c] /usr/local/freeradius/3.0.x-20170328/lib/rlm_eap.so(+0x40f5)[0x7f9a76ab70f5] /usr/local/freeradius/3.0.x-20170328/lib/rlm_eap.so(eap_method_select+0x431)[0x7f9a76ab7add] /usr/local/freeradius/3.0.x-20170328/lib/rlm_eap.so(+0x2d01)[0x7f9a76ab5d01] /usr/local/freeradius/current/sbin/radiusd[0x428d3c] /usr/local/freeradius/current/sbin/radiusd[0x4293e9] /usr/local/freeradius/current/sbin/radiusd[0x428efd] /usr/local/freeradius/current/sbin/radiusd[0x429e1d] /usr/local/freeradius/current/sbin/radiusd(modcall+0xa2)[0x42ab62] /usr/local/freeradius/current/sbin/radiusd(indexed_modcall+0x363)[0x426374] /usr/local/freeradius/current/sbin/radiusd(process_authenticate+0x22)[0x428639] /usr/local/freeradius/current/sbin/radiusd[0x40f7ed] /usr/local/freeradius/current/sbin/radiusd(rad_authenticate+0x51e)[0x410118] /usr/local/freeradius/current/sbin/radiusd[0x43d74c] /usr/local/freeradius/current/sbin/radiusd[0x439382] /lib64/libpthread.so.0(+0x7dc5)[0x7f9a7aa1fdc5] /lib64/libc.so.6(clone+0x6d)[0x7f9a7a51773d] Calling: gdb -silent -x /usr/local/freeradius/config/raddb/panic.gdb /usr/local/freeradius/current/sbin/radiusd 18297 2>&1 | tee /var/log/radius/gdb-radiusd-18297.log Tue Mar 28 09:56:14 2017 : Info: Need 1 more connections to reach 5 spares Tue Mar 28 09:56:14 2017 : Info: rlm_sql (sql-null-acct-erx): Opening additional connection (4), 1 of 96 pending slots used Panic action exited with 0 _EXIT(0) CALLED src/lib/debug.c[743] Tue Mar 28 10:15:49 2017 : Error: Cannot update core dump limit: Operation not permitted Tue Mar 28 10:15:49 2017 : Info: Core dumps are enabled Tue Mar 28 10:15:49 2017 : Info: Debugger not attached -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 4

linelog best practice
by cedric delaunay 17 May '17

17 May '17

Hello all, I'm trying to log accounting and requests into our elasticsearch/graylog logserver. I use home made linelog modules to rewrite logs into json format. modules are called in authorize, accounting, post-auth, Post-Auth-Type REJECT, preproxy and post-proxy sections here is an exemple of my module : linelog linelog_postauth { format = "%t linelog_postauth \%Packet-Type non reconnu for %{User-Name} (%{Packet-Type})" filename = ${logdir}/linelog_json permissions = 0600 reference = "messages.%{%{reply:Packet-Type}:-format}" messages { Access-Reject = "{\"Datetime\":\"%t\",\"Module_Name\":\"linelog_postauth\",\"Packet-Type\":\"%{reply:Packet-Type}\",\"User-Name\":\"%{User-Name}\",\"Realm\":\"%{Realm}\",\"NAS-IP-Address\":\"%{NAS-IP-Address}\",\"NAS-Port\":\"%{NAS-Port}\",\"Service-Type\":\"%{Service-Type}\",\"Framed-MTU\":\"%{Framed-MTU}\",\"State\":\"%{State}\",\"Class\":\"%{Class}\",\"Vendor-Specific\":\"%{Vendor-Specific}\",\"Session-Timeout\":\"%{Session-Timeout}\",\"Idle-Timeout\":\"%{Idle-Timeout}\",\"Termination-Action\":\"%{Termination-Action}\",\"Called-Station-Id\":\"%{Called-Station-Id}\",\"Calling-Station-Id\":\"%{Calling-Station-Id}\",\"NAS-Identifier\":\"%{NAS-Identifier}\",\"Proxy-State\":\"%{Proxy-State}\",\"Login-LAT-Service\":\"%{Login-LAT-Service}\",\"Login-LAT-Node\":\"%{Login-LAT-Node}\",\"Login-LAT-Group\":\"%{Login-LAT-Group}\",\"Framed-AppleTalk-Link\":\"%{Framed-AppleTalk-Link}\",\"Framed-AppleTalk-Network\":\"%{Framed-AppleTalk-Network}\",\"Framed-AppleTalk-Zone\":\"%{Framed-AppleTalk-Zone}\",\"CHAP-Challenge\":\"%{CHAP-Challenge}\",\"NAS-Port-Type\":\"%{NAS-Port-Type}\",\"Port-Limit\":\"%{Port-Limit}\",\"Login-LAT-Port\":\"%{Login-LAT-Port}\"}" Access-Challenge = "{\"Datetime\":\"%t\",\"Module_Name\":\"linelog_postauth\",\"Packet-Type\":\"%{reply:Packet-Type}\",\"User-Name\":\"%{User-Name}\",\"Realm\":\"%{Realm}\",\"NAS-IP-Address\":\"%{NAS-IP-Address}\",\"NAS-Port\":\"%{NAS-Port}\",\"Service-Type\":\"%{Service-Type}\",\"Framed-Protocol\":\"%{Framed-Protocol}\",\"Framed-IP-Address\":\"%{Framed-IP-Address}\",\"Framed-IP-Netmask\":\"%{Framed-IP-Netmask}\",\"Framed-Routing\":\"%{Framed-Routing}\",\"Filter-Id\":\"%{Filter-Id}\",\"Framed-MTU\":\"%{Framed-MTU}\",\"Framed-Compression\":\"%{Framed-Compression}\",\"Login-IP-Host\":\"%{Login-IP-Host}\",\"Login-Service\":\"%{Login-Service}\",\"Login-TCP-Port\":\"%{Login-TCP-Port}\",\"Reply-Message\":\"%{Reply-Message}\",\"Callback-Number\":\"%{Callback-Number}\",\"Callback-Id\":\"%{Callback-Id}\",\"Framed-Route\":\"%{Framed-Route}\",\"Framed-IPX-Network\":\"%{Framed-IPX-Network}\",\"State\":\"%{State}\",\"Class\":\"%{Class}\",\"Vendor-Specific\":\"%{Vendor-Specific}\",\"Session-Timeout\":\"%{Session-Timeout}\",\"Idle-Timeout\":\"%{Idle-Timeout}\",\"Termination-Action\":\"%{Termination-Action}\",\"Called-Station-Id\":\"%{Called-Station-Id}\",\"Calling-Station-Id\":\"%{Calling-Station-Id}\",\"NAS-Identifier\":\"%{NAS-Identifier}\",\"Proxy-State\":\"%{Proxy-State}\",\"Login-LAT-Service\":\"%{Login-LAT-Service}\",\"Login-LAT-Node\":\"%{Login-LAT-Node}\",\"Login-LAT-Group\":\"%{Login-LAT-Group}\",\"Framed-AppleTalk-Link\":\"%{Framed-AppleTalk-Link}\",\"Framed-AppleTalk-Network\":\"%{Framed-AppleTalk-Network}\",\"Framed-AppleTalk-Zone\":\"%{Framed-AppleTalk-Zone}\",\"CHAP-Challenge\":\"%{CHAP-Challenge}\",\"NAS-Port-Type\":\"%{NAS-Port-Type}\",\"Port-Limit\":\"%{Port-Limit}\",\"Login-LAT-Port\":\"%{Login-LAT-Port}\"}" Access-Accept = "{\"Datetime\":\"%t\",\"Module_Name\":\"linelog_postauth\",\"Packet-Type\":\"%{reply:Packet-Type}\",\"User-Name\":\"%{User-Name}\",\"Realm\":\"%{Realm}\",\"NAS-IP-Address\":\"%{NAS-IP-Address}\",\"NAS-Port\":\"%{NAS-Port}\",\"Service-Type\":\"%{Service-Type}\",\"Framed-MTU\":\"%{Framed-MTU}\",\"Login-IP-Host\":\"%{Login-IP-Host}\",\"Login-Service\":\"%{Login-Service}\",\"Login-TCP-Port\":\"%{Login-TCP-Port}\",\"Reply-Message\":\"%{Reply-Message}\",\"Callback-Number\":\"%{Callback-Number}\",\"Callback-Id\":\"%{Callback-Id}\",\"Framed-Route\":\"%{Framed-Route}\",\"Framed-IPX-Network\":\"%{Framed-IPX-Network}\",\"State\":\"%{State}\",\"Class\":\"%{Class}\",\"Vendor-Specific\":\"%{Vendor-Specific}\",\"Session-Timeout\":\"%{Session-Timeout}\",\"Idle-Timeout\":\"%{Idle-Timeout}\",\"Termination-Action\":\"%{Termination-Action}\",\"Called-Station-Id\":\"%{Called-Station-Id}\",\"Calling-Station-Id\":\"%{Calling-Station-Id}\",\"NAS-Identifier\":\"%{NAS-Identifier}\",\"Proxy-State\":\"%{Proxy-State}\",\"Login-LAT-Service\":\"%{Login-LAT-Service}\",\"Login-LAT-Node\":\"%{Login-LAT-Node}\",\"Login-LAT-Group\":\"%{Login-LAT-Group}\",\"Framed-AppleTalk-Link\":\"%{Framed-AppleTalk-Link}\",\"Framed-AppleTalk-Network\":\"%{Framed-AppleTalk-Network}\",\"Framed-AppleTalk-Zone\":\"%{Framed-AppleTalk-Zone}\",\"CHAP-Challenge\":\"%{CHAP-Challenge}\",\"NAS-Port-Type\":\"%{NAS-Port-Type}\",\"Port-Limit\":\"%{Port-Limit}\",\"Login-LAT-Port\":\"%{Login-LAT-Port}\",\"VLAN\":\"%{Tunnel-Private-Group-ID:0}\"}" } } the goal is to keep info about login attempts and failure and why. when we run radius in debug mode we can see failure reason as next example : ..... (17) authenticate { (17) eap : Expiring EAP session with state 0x2ee654852ee14efb (17) eap : Finished EAP session with state 0x2ee654852ee14efb (17) eap : Previous EAP request found for state 0x2ee654852ee14efb, released from the list (17) eap : Peer sent method MSCHAPv2 (26) (17) eap : EAP MSCHAPv2 (26) (17) eap : Calling eap_mschapv2 to process EAP data (17) eap_mschapv2 : # Executing group from file /etc/raddb//sites-enabled/eduroam-inner-tunnel (17) eap_mschapv2 : Auth-Type MS-CHAP { (17) mschap : Found LM-Password (17) WARNING: mschap : No Cleartext-Password configured. Cannot create LM-Password (17) mschap : Found NT-Password (17) WARNING: mschap : No Cleartext-Password configured. Cannot create NT-Password (17) mschap : Creating challenge hash with username: cdelauna(a)univ-rennes1.fr (17) mschap : Client is using MS-CHAPv2 (17) ERROR: mschap : MS-CHAP2-Response is incorrect (17) [mschap] = reject (17) } # Auth-Type MS-CHAP = reject (17) eap : Freeing handler (17) [eap] = reject (17) } # authenticate = reject ..... I can't find reject reason (mscahp result, ...) in access-reject variables. I had a look into mailist's archives without success ;( Do anybody can help me to find the best way doing this ? Thanks a lot -- Cédric Delaunay Direction des Systèmes d'Informations Equipe Réseau & Telephonie 263, Avenue du Général Leclerc Tel: 02 23 23 71 59 CS 74205 - 35042 Rennes Cedex Pour toute demande utiliser l'aide et assistance via l'ENT à l'adresse http://ent.univ-rennes1.fr

7 19

TLS Variables not set
by Luke Pascoe 09 May '17

09 May '17

Hi, I'm having trouble getting some basic TLS checks working for a Wifi EAP-TLS connection. Centos7, freeradius 3.0.4 Basically I'm messing around with the built-in check-eap-tls virtual server, as a pre-requisite to some more complex matching I want to do, but it's not working as it would seem it should. My client connects using a valid cert, I see TLS "stuff" in the logs like this: (5) Auth-Type eap { (5) eap : Expiring EAP session with state 0x9e6f4ada9ae847d4 (5) eap : Finished EAP session with state 0x9e6f4ada9ae847d4 (5) eap : Previous EAP request found for state 0x9e6f4ada9ae847d4, released from the list (5) eap : Peer sent method TLS (13) (5) eap : EAP TLS (13) (5) eap : Calling eap_tls to process EAP data (5) eap_tls : Authenticate (5) eap_tls : processing EAP-TLS (5) eap_tls : eaptls_verify returned 7 (5) eap_tls : Done initial handshake (5) eap_tls : <<< TLS 1.0 Handshake [length 04c4], Certificate (5) eap_tls : chain-depth=1, (5) eap_tls : error=0 (5) eap_tls : --> User-Name = lpascoe (5) eap_tls : --> BUF-Name = NZHothouse CA (5) eap_tls : --> subject = /C=NZ/ST=AKL/L=Auckland/O=NZHothouse/CN=NZHothouse CA/emailAddress= admin(a)nzhothouse.co.nz (5) eap_tls : --> issuer = /C=NZ/ST=AKL/L=Auckland/O=NZHothouse/CN=NZHothouse CA/emailAddress= admin(a)nzhothouse.co.nz (5) eap_tls : --> verify return:1 (5) eap_tls : chain-depth=0, (5) eap_tls : error=0 (5) eap_tls : --> User-Name = lpascoe (5) eap_tls : --> BUF-Name = lpascoe (5) eap_tls : --> subject = /C=NZ/ST=AKL/L=Auckland/O=NZHothouse/CN=lpascoe/emailAddress= admin(a)nzhothouse.co.nz (5) eap_tls : --> issuer = /C=NZ/ST=AKL/L=Auckland/O=NZHothouse/CN=NZHothouse CA/emailAddress= admin(a)nzhothouse.co.nz (5) eap_tls : --> verify return:1 (5) eap_tls : TLS_accept: SSLv3 read client certificate A (5) eap_tls : <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (5) eap_tls : TLS_accept: SSLv3 read client key exchange A (5) eap_tls : <<< TLS 1.0 Handshake [length 0106], CertificateVerify (5) eap_tls : TLS_accept: SSLv3 read certificate verify A (5) eap_tls : <<< TLS 1.0 ChangeCipherSpec [length 0001] (5) eap_tls : <<< TLS 1.0 Handshake [length 0010], Finished (5) eap_tls : TLS_accept: SSLv3 read finished A (5) eap_tls : >>> TLS 1.0 ChangeCipherSpec [length 0001] (5) eap_tls : TLS_accept: SSLv3 write change cipher spec A (5) eap_tls : >>> TLS 1.0 Handshake [length 0010], Finished (5) eap_tls : TLS_accept: SSLv3 write finished A (5) eap_tls : TLS_accept: SSLv3 flush data (5) eap_tls : (other): SSL negotiation finished successfully SSL Connection Established (5) eap_tls : eaptls_process returned 13 So I'm pretty certail that part is working correctly. However when we get to the check-eap-tls part, the variables it expects to match against aren't populated: (6) # Executing section authorize from file /etc/raddb/sites-enabled/check-eap-tls (6) authorize { (6) update config { (6) Auth-Type := Accept (6) } # update config = noop (6) if ("%{TLS-Client-Cert-Common-Name}" == "client.example.com") (6) EXPAND %{TLS-Client-Cert-Common-Name} (6) --> (6) if ("%{TLS-Client-Cert-Common-Name}" == "client.example.com") -> FALSE (6) else else { (6) update config { (6) Auth-Type := Reject (6) } # update config = noop (6) update reply { (6) Reply-Message := 'Your certificate is not valid.' (6) } # update reply = noop (6) } # else else = noop As you can see the expansion for %{TLS-Client-Cert-Common-Name} is an empty string. This is the variable I want to match against in future. Any suggestions around what I need to enable to get these TLS variables populated would be greatly appreciated. Thanks. Luke Pascoe *E* luke(a)osnz.co.nz * P* +64 (9) 296 2961 * M* +64 (27) 426 6649 * W* www.osnz.co.nz 24 Wellington St Papakura Auckland, 2110 New Zealand

3 3

pam_radius_auth delay
by Steve Phillips 07 May '17

07 May '17

Hi There, I've just setup pam_radius_auth and it is working, however there seems to be a weird 20 second delay for no apparent reason between getting the password from the prompt and sending the authentication request to the RADIUS server. The version of pam_radius_auth is 1.4.0 obtained from the CentOS 7 EPEL repository I have entries for the RADIUS server in /etc/hosts but have tried both a hostname and an IP address in /etc/pam_radius.conf and the effect is the same. My sshd pam entries are set as follows -- begin snippet -- auth [success=ignore default=1] pam_succeed_if.so debug user ingroup radius auth required pam_radius_auth.so debug conf=/etc/pam_radius.conf auth required pam_sepermit.so auth substack password-auth auth include postlogin -- end -- The logs are as follows -- begin logs -- Apr 28 16:09:40 bastion sshd[9197]: pam_radius_auth: Got user name stevetest Apr 28 16:09:40 bastion sshd[9197]: pam_radius_auth: ignore last_pass, force_prompt set Apr 28 16:10:00 bastion sshd[9197]: pam_radius_auth: Sending RADIUS request code 1 Apr 28 16:10:00 bastion sshd[9197]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 0x7f05695fa1c0. Apr 28 16:10:00 bastion sshd[9197]: pam_radius_auth: Got RADIUS response code 2 Apr 28 16:10:00 bastion sshd[9197]: pam_radius_auth: authentication succeeded -- end logs -- and the server entry is (less the lines starting with a #) # cat /etc/pam_radius.conf | egrep -v ^# auth1 somesecret 3 172.28.208.169:1812 somesecret 3 (If I comment auth1 out the effect is identical - a 20 second delay) The 20 seconds sounds like a timeout of some sort but I'm at a bit of a loss what this would be. Just wondering if anyone else has come across this? OS: CentOS 7.3.1611, minimal installation, patched to whatever the latest patch cluster was as of a week ago. Any ideas would be appreciated, Cheers, -- Steve.

4 7

bad radtest results with eap/peap mschap
by Michel Villeneuve 04 May '17

04 May '17

Hi, I use freeradius-3.0.12 on centos 7.3 with an openldap 2.4 and a samba attribute EAP / PEAP authentication MSCHAPV2. I want to authentificate and authorize users according to their attribute on the LDAP. I created an attribute LDAP-Desc mapped with the field eduPersonPrimaryAffilation on my LDAP. I want to put user on specific VLAN if they are students, employee .... or outer people. For that I use in the inner-tunnel the capabilities to return AVP like Tunnel-Private-Group-Id with the good value . It's work very well, for internal and also for external people. I tested also the realm value in the default server and I put also the good Tunnel-Private-Group-Id depending the value of realm. It's work with device like smartphone, pc ... and also with the command. eapol_test -c afile -p1812 -smysecret -r1 Everything seems good but not when I use radtest command I can't authentificate internal or external people with the test command radtest [root@freeradius-3-a test]# radtest 'teststudent' 'a1z2e3r4*' localhost 1812 mysecret Sent Access-Request Id 154 from 0.0.0.0:54585 to 127.0.0.1:1812 length 81 User-Name = "teststudent" User-Password = "a1z2e3r4*" NAS-IP-Address = 195.83.247.135 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "a1z2e3r4*" Received Access-Reject Id 154 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject nor radtest -t mschap 'teststudent' 'a1z2e3r4*' 127.0.0.1:18120 1 mysecret I got ot@freeradius-3-a test]# radtest -t mschap 'teststudent' 'secret' 127.0.0.1:18120 1 mysecret Sent Access-Request Id 129 from 0.0.0.0:34088 to 127.0.0.1:18120 length 137 User-Name = "teststudent" MS-CHAP-Password = "a1z2e3r4*" NAS-IP-Address = 195.83.247.135 NAS-Port = 1 Message-Authenticator = 0x00 Cleartext-Password = "secret" MS-CHAP-Challenge = 0x3a7dd0c59a922170 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000ae872e407e206d5579b1515fbf4e92f594e5c5e66739c6e7 Received Access-Reject Id 129 from 127.0.0.1:18120 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject Perhaps the problem comes from /etc/raddb/mods-enabled/mschap files and I tried differents values with no good results. mschap { with_ntdomain_hack = no #authtype = MS-CHAP allow_retry = yes use_mppe=yes require_encryption = yes require_strong = yes ..... I am not sure about the good values needing for this section. I would like to have an advice before using this configuration in production environment. here a debug with a Successful results Thanks in advance for you help PS: sorry for my english I hope it's comprehensible. -- Michel Villeneuve Tel 02 98 01 71 61

2 2

Reply-Radius
by Ejaz 04 May '17

04 May '17

Hello, when the user gets authenticated, the Radius will send some confirmation to router about that particular user? How can I check this As per my programmer(CRM application data packet service) any user gets authenticated its values should populate Home Agent router which is not happening. We use Cisco 7206 Mobile Wireless Home Agent. Any clue to see Reply response from the radius server Thanks, Mohammed Ejaz Asst. Operation Director of Systems. Cyberia SAUDI ARABIA P.O.Box: 301079, Riyadh 11372 Phone: (+966) 11 464 7114 Ext. 140 Mobile: (+966) 562311787 Fax: (+966) 11 465 4735 Website: http://www.cyberia.net.sa

3 3

Help for buy a real Cert (not self-signed)
by Spider s 04 May '17

04 May '17

Hello, I have got a few questions about radius and buy an original Certificate. Firsts thank you for the help here, but I can’t find an option for search on all post, is this possible ?? only find this: For example only can find post from this mount http://lists.freeradius.org/pipermail/freeradius-users/2017-January/thread.… Is for don’t disturb with my questions is are answered, sorry. And now my questions, first I have got running my freeradius installation 3.10 on ubuntu) with AD Auth, but with limitations, because I need install my self-signed cert on all device for connect to wifi. I don’t want this (I don’t want install the certs), and I need buy a real cert for a real CA, I know ,but I never buy one for this. (I never buy a certfor radius, web or similar) I need buy a real cert, where I can buy ?? recommendations webs?? And witch type ?? I see a lot of certs, and I don’t know the certification specification.( a lot of prices and options) Please a direct links if possible to correct cert. I never buy an original cert and I don’t know process. When I receive the certificates is like certs on the folder?? Need change data??? How can use this certs on my radius install?? Are 3, 5, 20 files ???? where i can find info about this ?? (On docs i reffer) Need a domain for this ?? can i use the cert from a Web (typical ssl cert that is used for web?? I see a lot of info on internet for use self-signed cert, but I can’t find info on documentations or on my Ubuntu install when use real certs. (Is very possible I don’t find) Thank you for your time when you read me, and sorry if a newbie questions. Thank you in advanced, i dont want confuse with this and spend money with this.

6 15

EAP TLS against multiple certificates?
by David Hartburn 03 May '17

03 May '17

Hi, Is it possible to check EAP-TLS against multiple certificate chains, or bundle two chains together into the same pem file? We have a potential problem where all our certificate auth laptops have been using SHA1 for quite some time. Recently we upgraded our certificate authority to SHA256, so any laptops that request a new cert will get a SHA256. If I put a SHA256 root chain certificate in the EAP-TLS config then a SHA256 client can authenticate, but naturally SHA1 can not. If I leave the SHA1 root chain on the server, then the newer SHA256 clients can not authenticate. I am worried that one day I will come in to find half the clients have renewed to a SHA256 and can no longer auth. Is there anything I can do to allow both certificate types to authenticate during this transition period? In terms of config, in mods-enabled/eap, I have tls-config loanlaptops { private_key_file = ${confdir}/certs/loan_laptop_server.pem certificate_file = ${confdir}/certs/loan_laptop_server.pem ca_file = ${confdir}/certs/unikentrootCAchain.pem ...... } tls { # Point to the Loan Laptops TLS configuration tls = loanlaptops virtual_server = check-eap-tls } Yours Dave Hartburn

2 5

Error when changing inner auth
by LUCA 01 May '17

01 May '17

Hi, I'm using the Version 2. I've successfully changed the default eap type. Now I'm trying to change the inner auth because I need pap as default. I've tried to change the inner auth for ttls but then this happens: ttls { default_eap_type = "pap" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } rlm_eap_ttls: Unknown EAP type pap rlm_eap: Failed to initialize type ttls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. I've tried to change the inner auth for peap as well, but same problem as before: peap { default_eap_type = "pap" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } rlm_eap_peap: Unknown EAP type pap rlm_eap: Failed to initialize type peap /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Why it doesn't recognize pap? Thank you. Luca

3 2