March 2018 - Freeradius-Users - lists.freeradius.org

samba 4.7 AD and freeradius ntlm_auth/winbind
by Kacper Wirski 27 Mar '18

27 Mar '18

Hello, I have freeradius 3.0.14 integrated with samba AD DC using ntlm_auth. As of samba 4.7 version, theere is now option to explicitly allow only mschapv2 and disable all other ntlmv1 via smb.conf option ntlm auth = mschpav2-and-ntlmv2-only I've done today some tests, and I have mixed results, and I'm not sure who the "culprit" is. So let's start with what works: on the AD i set ntlm auth = mschpav2-and-ntlmv2-only on the freeradius (with samba 4.6.2 as domain member) in mods-enabled/mschap using winbind method i have put according to the guide in wiki.freeradius.org/active-directory-direct-via-winbind winbind_username = "%{mschap:User-Name}" winbind_domain = "*WINDOWSDOMAIN*" With this setup it works as expected, that is freeradius is able to authenticate via eap-peap AD users, in samba audit_log i clearly see that it's explicitly mschpav2 being used instead of more general "ntlmv1". What boggles my mind is that when i change in mods-enabled/mschap from "winbind" method to traditional "ntlm auth = /path/to/ntlm_auth etc....." I'm getting access-rejects. In samba audit log i see that request is coming using ntlmv1, and with the above smb.conf ntlmv1 (en general) is blocked. As soon, as in smb.conf i change to "ntlm auth = yes" I have everything working, but at the obvious loss of security. I read in this mailing list (I think), that this winbind authentication method also in the end uses ntlm_auth, but there is clearly difference. So my question is: is this something on samba-side that makes actual difference between those two methods, or freeradius for whatever reason doesn't send "proper" mschap2 flag that will be recognized by the samba AD server? Also a follow up question: is it possible to set "winbind" method for password change in the same way it's used for authentication? Regards, Kacper

2 2

Empty (not ended) session - freeradius 3.0.16
by dg 26 Mar '18

26 Mar '18

Hello, I have strange problem. >From time to time I have session not ended (and without any user assigned to that session). So i have time when session starts but stop time is NULL. example below: SELECT radacct.RadAcctId, hotspots.name as hotspot, radacct.UserName, radacct.FramedIPAddress, radacct.AcctStartTime, radacct.AcctStopTime, radacct.AcctSessionTime, radacct.AcctInputOctets, radacct.AcctOutputOctets, radacct.AcctTerminateCause, radacct.NASIPAddress FROM radacct LEFT JOIN hotspots ON radacct.calledstationid = hotspots.mac WHERE FramedIPAddress='' ORDER BY radacctid asc LIMIT 0, 1000; results ... | 1438 | NULL | user1 | | 2018-02-27 10:31:04 | 2018-02-27 10:35:33 | 269 | 1414483 | 40634419 | Admin-Reset | 192.168.1.110 | | 1439 | NULL | user2 | | 2018-02-27 10:31:11 | 2018-02-27 10:36:07 | 296 | 1714244 | 27071082 | Port-Error | 192.168.1.106 | | 1445 | NULL | | | 2018-02-27 09:49:24 | NULL | 6215 | 89145682 | 1799384 | | 192.168.1.110 | | 1446 | NULL | | | 2018-02-27 09:49:46 | NULL | 6242 | 89124192 | 1803157 | | 192.168.1.110 | | 1447 | NULL | | | 1993-03-01 01:01:22 | NULL | 788783565 | 92045995 | 1920254 | | 192.168.1.110 | | 1448 | NULL | | | 1993-03-01 01:01:24 | NULL | 788783603 | 93859941 | 1975125 | | 192.168.1.110 | so you can see that AcctStopTime is sometimes NULL. Can someone help me ? why its happening ? i am using cisco switches best regards

2 2

Is it possible to change a session's or account's lifetime
by 张强 26 Mar '18

26 Mar '18

Hi, What I want to do is temporarily allowing a user's access for a short time, say 2 minutes, and if the user takes further authentication process, the user's access can be allowed without limit. I tried to use the Expiration attribute in radcheck, set the value to be 2 minutes later in the beginning, and set it to be 1 day later after the required authentication process is completed. But it seems the NAS only reads the initial value. It expires the user in 2 minutes and never reads the new value. So the question is how to limit and change the lifetime of a session or of an account? Thanks for your help.

2 1

Radius acctstarttime
by Oscar Jofre 24 Mar '18

24 Mar '18

Hi, I've noticed that the acctstarttime on radacct table have some values I don't understand. In fact I have some routers (I work with mikrotik and hotspot + freeradius) that are in Taiwan and others on Spain. I thought that acctstarttime was set according the date time from the system where is installed freeradius (centos + mariadb for me) But I've seen today some rows from today (according radacctid) with a different time stamp (1970-04-13): I had an incorrect date on the mikrotik from the example, just the same date that is on the database, so then I thought that the acctstartime comes from router clock. but the routers I have In Taiwan with Taiwan clock don't save on accstarttime the router clock, they still saving data according the system where I have installed freeradius. What do I miss ? Thanks, Oscar.

3 6

Different authorize files for virtual servers
by Jay Rouman 24 Mar '18

24 Mar '18

This should be easy. I'm sure I'm missing something obvious. I want to run two virtual servers bound to different ports with each one consulting a different "authorize" file. The "files" module seems bound to whatever is in mods-enabled/files, which I can obviously change but that changes it for both servers. Attempts to teach the files module a different path have failed with various errors. Is there an example of this somewhere? I could obviously run two completely separate instances of freeradius (3.0.16 on Slackware Linux) but that seems silly. -- Jay Rouman (jsr(a)edzone.net) Gratiot/Isabella RESD, Ithaca, MI

2 1

3GPP: multiple attributes, port from file based authentication to sql
by Wolfgang Zeitler 24 Mar '18

24 Mar '18

Hi there, I'm currently running freeradius to authenticate mobile devices on a 4G network. For authentication I have to check multiple attributes. The user - file is currently populated like that: user Cleartext-password := "password", 3GPP-IMSI == 262011234567, Called-Station-ID == "apn-name" User-Name = user, Service-Type = Framed, Framed-Protocol = GPRS-PDP-Context, Framed-IPv6-Prefix = 2001:DB8::/64, Framed-Interface-ID = 0:0:0:2, Reply-Message = "Welcome To Lab Network", Acct-Session-Id = 00000001, I'm currently wondering, how to port that into the radcheck and the radreply table. I understood, whith the default configuration, only one attribute will be checked, e.g. Cleartext-password Thank you for support Wolfgang

2 3

rlm_sql_null driver sometimes writes truncated lines
by Shawn Asmussen 23 Mar '18

23 Mar '18

I'm currently using the rlm_sql_null driver to write accounting updates to a flat file, which are then sent up to an external database using radsqlrelay. On a very small percentage of the records (Maybe once out of every million records or so), one of the lines gets truncated in the output file, causing it to be merged with the next record. Here is one such example. About halfway through the line, you can see where the first sql statement is only partially written, and then the next UPDATE starts all on the same line (AND AcctStopTime UPDATE radacct). radsqlrelay does not handle this gracefully. When it fails to execute the invalid SQL it just goes into an infinite loop, trying to execute that same SQL statement over and over. Given the infrequency that it happens, I'm not sure that it would feasible to get debug output from radiusd when it happens, although I'm open to suggestions on how to capture any useful info. Wondering if anybody has seen anything like before? I'm currently running the freeradius-3.0.13-6.el7.x86_64 rpm from the EPEL repo for CentOS 7. It doesn't happen often, but we're generating millions of accounting updates a day across hundreds of freeradius servers, so it has been popping up somewhere just about every day. UPDATE radacct SET FramedIPAddress = NULLIF('172.21.22.24', '')::inet, AcctSessionTime = 600, AcctInterval = (1520393120 - EXTRACT(EPOCH FROM (COALESCE(AcctUpdateTime, AcctStartTime)))), AcctUpdateTime = TO_TIMESTAMP(1520393120), AcctInputOctets = (('0'::bigint << 32) + '0'::bigint), AcctOutputOctets = (('0'::bigint << 32) + '0'::bigint) WHERE (AcctUniqueId = 'fb8de85671b07d2387ec982a42bb4ea4') AND AcctStopTime UPDATE radacct SET AcctStopTime = TO_TIMESTAMP(1520396146), AcctUpdateTime = TO_TIMESTAMP(1520396146), AcctSessionTime = COALESCE(10806, (1520396146 - EXTRACT(EPOCH FROM(AcctStartTime)))), AcctInputOctets = (('0'::bigint << 32) + '0'::bigint), AcctOutputOctets = (('0'::bigint << 32) + '0'::bigint), AcctTerminateCause = '', FramedIPAddress = NULLIF('172.21.22.61', '')::inet, ConnectInfo_stop = '' WHERE (AcctUniqueId = '1c43554feb67bd56087b0656fefdad17') AND AcctStopTime IS NULL; Shawn Asmussen

3 3

EAP-SIM Testing Fails
by François Vergès 23 Mar '18

23 Mar '18

Hello Everyone, I have setup freeradius in my lab environment to authenticate an Android cell phone using EAP-SIM and a SIM card. Performing a packet capture over the Wi-Fi, I was able to realize that the phone receive the EAP-SIM challenge request but doesn't reply with a EAP-SIM Challenge response. Instead, it replies with a EAP-SIM Client-Error (0). I can also see the RAND values in the EAP-SIM Challenge Request packet. I have used this script to generate the triplets (RAND, SRES and KC) using the Ki number of the SIM card: https://github.com/skelsec/COMP128/blob/master/COMP128.py I have provided, below, the output of the freeradius server when I try to connect. Do you have an idea of what could be wrong? Do you think it could be related to the triplets not being generated correctly? Thank you in advance! Here are the logs: (0) Received Access-Request Id 108 from 192.168.20.19:54927 to 192.168.20.17:1812 length 291 (0) User-Name = "1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org" (0) NAS-IP-Address = 192.168.20.19 (0) NAS-Port = 0 (0) NAS-Identifier = "192.168.20.19" (0) NAS-Port-Type = Wireless-802.11 (0) Calling-Station-Id = "c0eefb5acc11" (0) Called-Station-Id = "000b86ee0268" (0) Service-Type = Login-User (0) Framed-MTU = 1100 (0) EAP-Message = 0x02010038013139303137303030303030323032343040776c616e2e6d6e633037302e6d63633930312e336770706e6574776f726b2e6f7267 (0) Aruba-Essid-Name = "Test EAP-SIM" (0) Aruba-Location-Id = "00:0b:86:ee:02:68" (0) Aruba-AP-Group = "instant-EE:02:68" (0) Message-Authenticator = 0x7c7de18dffeab059ae54da7999356d53 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "wlan.mnc070.mcc901.3gppnetwork.org" for User-Name = "1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org" (0) suffix: No such realm "wlan.mnc070.mcc901.3gppnetwork.org" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 1 length 56 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 2 length 22 (0) eap: EAP session adding &reply:State = 0x1646e2171644e69d (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Sent Access-Challenge Id 108 from 192.168.20.17:1812 to 192.168.20.19:54927 length 0 (0) EAP-Message = 0x010200160410970ed9f6222d1151ea27852e700dfc83 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x1646e2171644e69d214aa497303ba7f5 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 109 from 192.168.20.19:54927 to 192.168.20.17:1812 length 259 (1) User-Name = "1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org" (1) NAS-IP-Address = 192.168.20.19 (1) NAS-Port = 0 (1) NAS-Identifier = "192.168.20.19" (1) NAS-Port-Type = Wireless-802.11 (1) Calling-Station-Id = "c0eefb5acc11" (1) Called-Station-Id = "000b86ee0268" (1) Service-Type = Login-User (1) Framed-MTU = 1100 (1) EAP-Message = 0x020200060312 (1) State = 0x1646e2171644e69d214aa497303ba7f5 (1) Aruba-Essid-Name = "Test EAP-SIM" (1) Aruba-Location-Id = "00:0b:86:ee:02:68" (1) Aruba-AP-Group = "instant-EE:02:68" (1) Message-Authenticator = 0x4b85a873255dd52687e055cdfde627c6 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "wlan.mnc070.mcc901.3gppnetwork.org" for User-Name = "1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org" (1) suffix: No such realm "wlan.mnc070.mcc901.3gppnetwork.org" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 2 length 6 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) files: users: Matched entry 1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org at line 96 (1) [files] = ok (1) if (User-Name =~ /^[0-9]+/) { (1) if (User-Name =~ /^[0-9]+/) -> TRUE (1) if (User-Name =~ /^[0-9]+/) { (1) update reply { (1) EXPAND %{control:EAP-Sim-Rand1} (1) --> 0x5e56fc4d1cb798dd53c4191e157472ac (1) &EAP-Sim-Rand1 := 0x5e56fc4d1cb798dd53c4191e157472ac (1) EXPAND %{control:EAP-Sim-Rand2} (1) --> 0x7711b7949ea67837276197a3bfc10561 (1) &EAP-Sim-Rand2 := 0x7711b7949ea67837276197a3bfc10561 (1) EXPAND %{control:EAP-Sim-Rand3} (1) --> 0xdb249cea25f603d22e193aa1ae792b20 (1) &EAP-Sim-Rand3 := 0xdb249cea25f603d22e193aa1ae792b20 (1) EXPAND %{control:EAP-Sim-SRES1} (1) --> 0x47c9aae3 (1) &EAP-Sim-SRES1 := 0x47c9aae3 (1) EXPAND %{control:EAP-Sim-SRES2} (1) --> 0x7112acb0 (1) &EAP-Sim-SRES2 := 0x7112acb0 (1) EXPAND %{control:EAP-Sim-SRES3} (1) --> 0x12d89ed9 (1) &EAP-Sim-SRES3 := 0x12d89ed9 (1) EXPAND %{control:EAP-Sim-KC1} (1) --> 0x44fb0ab88d208400 (1) &EAP-Sim-KC1 := 0x44fb0ab88d208400 (1) EXPAND %{control:EAP-Sim-KC2} (1) --> 0x9135bb2807184400 (1) &EAP-Sim-KC2 := 0x9135bb2807184400 (1) EXPAND %{control:EAP-Sim-KC3} (1) --> 0x783fa135bbb97000 (1) &EAP-Sim-KC3 := 0x783fa135bbb97000 (1) } # update reply = noop (1) } # if (User-Name =~ /^[0-9]+/) = noop (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x1646e2171644e69d (1) eap: Finished EAP session with state 0x1646e2171644e69d (1) eap: Previous EAP request found for state 0x1646e2171644e69d, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type SIM (18) (1) eap: Calling submodule eap_sim to process data (1) eap: Sending EAP Request (code 1) ID 90 length 20 (1) eap: EAP session adding &reply:State = 0x1646e217171cf09d (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Sent Access-Challenge Id 109 from 192.168.20.17:1812 to 192.168.20.19:54927 length 0 (1) EAP-Message = 0x015a0014120a00000f0200020001000011010100 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x1646e217171cf09d214aa497303ba7f5 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 110 from 192.168.20.19:54927 to 192.168.20.17:1812 length 341 (2) User-Name = "1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org" (2) NAS-IP-Address = 192.168.20.19 (2) NAS-Port = 0 (2) NAS-Identifier = "192.168.20.19" (2) NAS-Port-Type = Wireless-802.11 (2) Calling-Station-Id = "c0eefb5acc11" (2) Called-Station-Id = "000b86ee0268" (2) Service-Type = Login-User (2) Framed-MTU = 1100 (2) EAP-Message = 0x025a0058120a0000100100010705000043cdc6794d84b18456e0fe40aee0d7e20e0e00333139303137303030303030323032343040776c616e2e6d6e633037302e6d63633930312e336770706e6574776f726b2e6f726700 (2) State = 0x1646e217171cf09d214aa497303ba7f5 (2) Aruba-Essid-Name = "Test EAP-SIM" (2) Aruba-Location-Id = "00:0b:86:ee:02:68" (2) Aruba-AP-Group = "instant-EE:02:68" (2) Message-Authenticator = 0xa4a1ade2eae64052c6f0aa2ecc3ea908 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: Looking up realm "wlan.mnc070.mcc901.3gppnetwork.org" for User-Name = "1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org" (2) suffix: No such realm "wlan.mnc070.mcc901.3gppnetwork.org" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 90 length 88 (2) eap: No EAP Start, assuming it's an on-going EAP conversation (2) [eap] = updated (2) files: users: Matched entry 1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org at line 96 (2) [files] = ok (2) if (User-Name =~ /^[0-9]+/) { (2) if (User-Name =~ /^[0-9]+/) -> TRUE (2) if (User-Name =~ /^[0-9]+/) { (2) update reply { (2) EXPAND %{control:EAP-Sim-Rand1} (2) --> 0x5e56fc4d1cb798dd53c4191e157472ac (2) &EAP-Sim-Rand1 := 0x5e56fc4d1cb798dd53c4191e157472ac (2) EXPAND %{control:EAP-Sim-Rand2} (2) --> 0x7711b7949ea67837276197a3bfc10561 (2) &EAP-Sim-Rand2 := 0x7711b7949ea67837276197a3bfc10561 (2) EXPAND %{control:EAP-Sim-Rand3} (2) --> 0xdb249cea25f603d22e193aa1ae792b20 (2) &EAP-Sim-Rand3 := 0xdb249cea25f603d22e193aa1ae792b20 (2) EXPAND %{control:EAP-Sim-SRES1} (2) --> 0x47c9aae3 (2) &EAP-Sim-SRES1 := 0x47c9aae3 (2) EXPAND %{control:EAP-Sim-SRES2} (2) --> 0x7112acb0 (2) &EAP-Sim-SRES2 := 0x7112acb0 (2) EXPAND %{control:EAP-Sim-SRES3} (2) --> 0x12d89ed9 (2) &EAP-Sim-SRES3 := 0x12d89ed9 (2) EXPAND %{control:EAP-Sim-KC1} (2) --> 0x44fb0ab88d208400 (2) &EAP-Sim-KC1 := 0x44fb0ab88d208400 (2) EXPAND %{control:EAP-Sim-KC2} (2) --> 0x9135bb2807184400 (2) &EAP-Sim-KC2 := 0x9135bb2807184400 (2) EXPAND %{control:EAP-Sim-KC3} (2) --> 0x783fa135bbb97000 (2) &EAP-Sim-KC3 := 0x783fa135bbb97000 (2) } # update reply = noop (2) } # if (User-Name =~ /^[0-9]+/) = noop (2) [expiration] = noop (2) [logintime] = noop (2) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (2) pap: WARNING: Authentication will fail unless a "known good" password is available (2) [pap] = noop (2) } # authorize = updated (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x1646e217171cf09d (2) eap: Finished EAP session with state 0x1646e217171cf09d (2) eap: Previous EAP request found for state 0x1646e217171cf09d, released from the list (2) eap: Peer sent packet with method EAP SIM (18) (2) eap: Calling submodule eap_sim to process data (2) eap_sim: EAP-SIM decoded packet (2) eap_sim: User-Name = " 1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org" (2) eap_sim: NAS-IP-Address = 192.168.20.19 (2) eap_sim: NAS-Port = 0 (2) eap_sim: NAS-Identifier = "192.168.20.19" (2) eap_sim: NAS-Port-Type = Wireless-802.11 (2) eap_sim: Calling-Station-Id = "c0eefb5acc11" (2) eap_sim: Called-Station-Id = "000b86ee0268" (2) eap_sim: Service-Type = Login-User (2) eap_sim: Framed-MTU = 1100 (2) eap_sim: EAP-Message = 0x025a0058120a0000100100010705000043cdc6794d84b18456e0fe40aee0d7e20e0e00333139303137303030303030323032343040776c616e2e6d6e633037302e6d63633930312e336770706e6574776f726b2e6f726700 (2) eap_sim: State = 0x1646e217171cf09d214aa497303ba7f5 (2) eap_sim: Aruba-Essid-Name = "Test EAP-SIM" (2) eap_sim: Aruba-Location-Id = "00:0b:86:ee:02:68" (2) eap_sim: Aruba-AP-Group = "instant-EE:02:68" (2) eap_sim: Message-Authenticator = 0xa4a1ade2eae64052c6f0aa2ecc3ea908 (2) eap_sim: Event-Timestamp = "Mar 22 2018 20:34:34 UTC" (2) eap_sim: EAP-Type = SIM (2) eap_sim: EAP-Sim-Subtype = Start (2) eap_sim: EAP-Sim-SELECTED_VERSION = 0x0001 (2) eap_sim: EAP-Sim-NONCE_MT = 0x000043cdc6794d84b18456e0fe40aee0d7e2 (2) eap_sim: EAP-Sim-IDENTITY = 0x00333139303137303030303030323032343040776c616e2e6d6e633037302e6d63633930312e336770706e6574776f726b2e6f726700 (2) eap: Sending EAP Request (code 1) ID 91 length 80 (2) eap: EAP session adding &reply:State = 0x1646e217141df09d (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Sent Access-Challenge Id 110 from 192.168.20.17:1812 to 192.168.20.19:54927 length 0 (2) EAP-Message = 0x015b0050120b0000010d00005e56fc4d1cb798dd53c4191e157472ac7711b7949ea67837276197a3bfc10561db249cea25f603d22e193aa1ae792b200b050000e2a774c8fd253915e0e4dfe1d832709e (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x1646e217141df09d214aa497303ba7f5 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 111 from 192.168.20.19:54927 to 192.168.20.17:1812 length 265 (3) User-Name = "1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org" (3) NAS-IP-Address = 192.168.20.19 (3) NAS-Port = 0 (3) NAS-Identifier = "192.168.20.19" (3) NAS-Port-Type = Wireless-802.11 (3) Calling-Station-Id = "c0eefb5acc11" (3) Called-Station-Id = "000b86ee0268" (3) Service-Type = Login-User (3) Framed-MTU = 1100 (3) EAP-Message = 0x025b000c120e000016010000 (3) State = 0x1646e217141df09d214aa497303ba7f5 (3) Aruba-Essid-Name = "Test EAP-SIM" (3) Aruba-Location-Id = "00:0b:86:ee:02:68" (3) Aruba-AP-Group = "instant-EE:02:68" (3) Message-Authenticator = 0xf23c8af6d4ad1d8640f4ad602564c6bb (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: Looking up realm "wlan.mnc070.mcc901.3gppnetwork.org" for User-Name = "1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org" (3) suffix: No such realm "wlan.mnc070.mcc901.3gppnetwork.org" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 91 length 12 (3) eap: No EAP Start, assuming it's an on-going EAP conversation (3) [eap] = updated (3) files: users: Matched entry 1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org at line 96 (3) [files] = ok (3) if (User-Name =~ /^[0-9]+/) { (3) if (User-Name =~ /^[0-9]+/) -> TRUE (3) if (User-Name =~ /^[0-9]+/) { (3) update reply { (3) EXPAND %{control:EAP-Sim-Rand1} (3) --> 0x5e56fc4d1cb798dd53c4191e157472ac (3) &EAP-Sim-Rand1 := 0x5e56fc4d1cb798dd53c4191e157472ac (3) EXPAND %{control:EAP-Sim-Rand2} (3) --> 0x7711b7949ea67837276197a3bfc10561 (3) &EAP-Sim-Rand2 := 0x7711b7949ea67837276197a3bfc10561 (3) EXPAND %{control:EAP-Sim-Rand3} (3) --> 0xdb249cea25f603d22e193aa1ae792b20 (3) &EAP-Sim-Rand3 := 0xdb249cea25f603d22e193aa1ae792b20 (3) EXPAND %{control:EAP-Sim-SRES1} (3) --> 0x47c9aae3 (3) &EAP-Sim-SRES1 := 0x47c9aae3 (3) EXPAND %{control:EAP-Sim-SRES2} (3) --> 0x7112acb0 (3) &EAP-Sim-SRES2 := 0x7112acb0 (3) EXPAND %{control:EAP-Sim-SRES3} (3) --> 0x12d89ed9 (3) &EAP-Sim-SRES3 := 0x12d89ed9 (3) EXPAND %{control:EAP-Sim-KC1} (3) --> 0x44fb0ab88d208400 (3) &EAP-Sim-KC1 := 0x44fb0ab88d208400 (3) EXPAND %{control:EAP-Sim-KC2} (3) --> 0x9135bb2807184400 (3) &EAP-Sim-KC2 := 0x9135bb2807184400 (3) EXPAND %{control:EAP-Sim-KC3} (3) --> 0x783fa135bbb97000 (3) &EAP-Sim-KC3 := 0x783fa135bbb97000 (3) } # update reply = noop (3) } # if (User-Name =~ /^[0-9]+/) = noop (3) [expiration] = noop (3) [logintime] = noop (3) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (3) pap: WARNING: Authentication will fail unless a "known good" password is available (3) [pap] = noop (3) } # authorize = updated (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x1646e217141df09d (3) eap: Finished EAP session with state 0x1646e217141df09d (3) eap: Previous EAP request found for state 0x1646e217141df09d, released from the list (3) eap: Peer sent packet with method EAP SIM (18) (3) eap: Calling submodule eap_sim to process data (3) eap: ERROR: Failed continuing EAP SIM (18) session. EAP sub-module failed (3) eap: Sending EAP Failure (code 4) ID 91 length 4 (3) eap: Failed in EAP select (3) [eap] = invalid (3) } # authenticate = invalid (3) Failed to authenticate the user (3) Using Post-Auth-Type Reject (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Post-Auth-Type REJECT { (3) attr_filter.access_reject: EXPAND %{User-Name} (3) attr_filter.access_reject: --> 1901700000020240(a)wlan.mnc070.mcc901.3gppnetwork.org (3) attr_filter.access_reject: Matched entry DEFAULT at line 11 (3) [attr_filter.access_reject] = updated (3) [eap] = noop (3) policy remove_reply_message_if_eap { (3) if (&reply:EAP-Message && &reply:Reply-Message) { (3) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (3) else { (3) [noop] = noop (3) } # else = noop (3) } # policy remove_reply_message_if_eap = noop (3) } # Post-Auth-Type REJECT = updated (3) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (3) Sending delayed response (3) Sent Access-Reject Id 111 from 192.168.20.17:1812 to 192.168.20.19:54927 length 44 (3) EAP-Message = 0x045b0004 (3) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. (0) Cleaning up request packet ID 108 with timestamp +14 (1) Cleaning up request packet ID 109 with timestamp +14 (2) Cleaning up request packet ID 110 with timestamp +14 Waking up in 0.2 seconds. (3) Cleaning up request packet ID 111 with timestamp +14 Ready to process requests -- François

4 5

RLM_Rest Error
by Christian Becerra 22 Mar '18

22 Mar '18

Good Morning ! We are working on using the RLM_Rest to query a Web Server. When I run radiusd -X we receive the following error. /etc/raddb/mods-enabled/rest[1]: Failed to link to module 'rlm_rest': /usr/lib64/freeradius/rlm_rest.so: cannot open shared object file: No such file or directory Not sure if I am missing a package or if I have to compile something to create the RLM_REST.SO File. I definitely do not have the file in the directory shown below. What is the process to create this file? Thank You Chris Contents of the directory: /usr/lib64/freeradius/ libfreeradius-dhcp.so rlm_chap.so rlm_eap_leap.so rlm_exec.so rlm_pam.so rlm_sqlippool.so libfreeradius-eap.so rlm_counter.so rlm_eap_md5.so rlm_expiration.so rlm_pap.so rlm_sql_mysql.so libfreeradius-radius.so rlm_cram.so rlm_eap_mschapv2.so rlm_expr.so rlm_passwd.so rlm_sql_null.so libfreeradius-server.so rlm_date.so rlm_eap_peap.so rlm_files.so rlm_preprocess.so rlm_sql.so proto_dhcp.so rlm_detail.so rlm_eap_pwd.so rlm_ippool.so rlm_radutmp.so rlm_unix.so proto_vmps.so rlm_dhcp.so rlm_eap_sim.so rlm_ldap.so rlm_realm.so rlm_unpack.so rlm_always.so rlm_digest.so rlm_eap.so rlm_linelog.so rlm_replicate.so rlm_utf8.so rlm_attr_filter.so rlm_dynamic_clients.so rlm_eap_tls.so rlm_logintime.so rlm_soh.so rlm_wimax.so rlm_cache_rbtree.so rlm_eap_fast.so rlm_eap_tnc.so rlm_mschap.so rlm_sometimes.so rlm_yubikey.so rlm_cache.so rlm_eap_gtc.so rlm_eap_ttls.so rlm_otp.so rlm_sqlcounter.so

2 4

Redis IP Source
by Bassem Mettichi 22 Mar '18

22 Mar '18

Hello, please could any one tell me why redis reject connection coming from unkown IP source, for example if my freerdaius server started on eth1 and my redis server is listening on eth2 ( other range) when i try to connect to redis from my freerdaius server, the connection can't established because the IP source is on other range the destination IP address. is there any possibilit to start freerdius on a specific interface. Thanks in advance

2 1