August 2018 - Freeradius-Users - lists.freeradius.org

Renew the session at midnight 12 o clock
by Imdad Hasan 19 Aug '18

19 Aug '18

Respected All, How can i kill old accounting sessions and generate new sessions without disconnect the users at every midnight 12 o clock. Warm Regard's Imdadali Kadiwala

2 1

Python Module Threading Issue
by Gary Gwin 18 Aug '18

18 Aug '18

I've attached radius.log, a simple example Python program, and the mods-enabled configs for two instances: mods-enabled/python1 mods-enabled/python2 that when invoked from the authorization sections of: sites-enabled/default sites-enabled/inner-tunnel result in a freeradius server crash. This only happens for threaded tests, for example: ./radperf -s -p 10 -D stats.out -f test-small.csv 127.0.0.1 auth testing123 The crash does not occur if the test client doesn't thread requests or if I run 'freeradius -X' with console output. Depending upon the execution, I see these fatal errors: Fatal Python error: GC object already tracked Fatal Python error: PyEval_SaveThread: NULL tstate Thoughts? Thanks, Gary

3 6

3GPP user location info
by taymour samir 18 Aug '18

18 Aug '18

Hi In the user location info I get 16 bit and decoded it , but I have also a 26 bit entry can someone send a simple way to decode it to get all the location info Regards Sent from my iPhone

1 0

Re: Re: Dynamic Vlan Assignment Active Directory with winbind
by Kevin Virk 16 Aug '18

16 Aug '18

Thank you for the help! From: Freeradius-Users <freeradius-users-bounces+kevin.virk=faithlife.com(a)lists.freeradius.org> on behalf of freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Sent: Thursday, August 16, 2018 3:00 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 160, Issue 27 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Dynamic Vlan Assignment Active Directory with winbind EAP-TLS 802.1x (Matthew Newton) 2. Re: I need to disconnect users (Brian Julin) 3. Apache with mod_auth_radius starts X requests (Carsten Schulze) ---------------------------------------------------------------------- Message: 1 Date: Wed, 15 Aug 2018 18:37:29 +0100 From: Matthew Newton <mcn(a)freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Dynamic Vlan Assignment Active Directory with winbind EAP-TLS 802.1x Message-ID: <1534354649.5024.21.camel(a)freeradius.org> Content-Type: text/plain; charset="UTF-8" On Wed, 2018-08-15 at 17:28 +0000, Kevin Virk wrote: > I came across this thread in my search for answers > http://freeradius.1045715.n5.nabble.com/FreeRadius-3-0-11-and- > Winbind-td5743424.html and it is stating that winbind is not the > preferred method for dynamic vlan assignment. This thread is about > two years old so I was hoping if anyone could answer if this was > still the case. It's still the same. > I am using FreeRADIUS Version 2.2.8. As this was what was downloaded > using the deb package on Ubuntu 16.04. 2.2.8 is obsolete. You should upgrade to 3.0.17. Or at least 2.2.10 (which is still obsolete). > The setup I am hoping to achieve is EAP-TLS 802.1x that can > dynamically assign vlans to users based off active directory > information and has the ability to revoke certs and check active > directory for disabled accounts and not allow them to auth. Is this > possible? Yes. As you want EAP-TLS you don't need winbind. Still use LDAP to get data about the user from AD. -- Matthew ------------------------------ Message: 2 Date: Wed, 15 Aug 2018 17:43:35 +0000 From: Brian Julin <BJulin(a)clarku.edu> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: I need to disconnect users Message-ID: <BN7PR03MB376278619C1874D45813909CB43F0(a)BN7PR03MB3762.namprd03.prod.outlook.com> Content-Type: text/plain; charset="iso-8859-1" Alan DeKok <aland(a)deployingradius.com> > No, that's wrong, sorry. You were right both times... :-) I have to do the former because we use a NAS client wildcard, and you can't originate-coa to a dynamically created NAS last time I checked. Works fine, even at a medium volume of users. ------------------------------ Message: 3 Date: Thu, 16 Aug 2018 07:38:29 +0200 From: Carsten Schulze <carsten.schulze(a)leuphana.de> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Apache with mod_auth_radius starts X requests Message-ID: <5d8a22ab-bf78-d2aa-1366-1af30135c7a0(a)leuphana.de> Content-Type: text/plain; charset="utf-8"; Format="flowed" Hi, I'm using Debian9 with Apache + radius_mod_auth to authenticate some user while accessing a directory on that server. But that didn't work. I can see Radius Access-Request and Access-Accepts via tcpdump, the probleme is, that the request never ends. I interrupted the request with an Apache restart after 3Minutes and 1500 Radius-Request (still running). 07:10:14.010157 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept .... 07:13:27.547061 IP 10.19.56.57.1026 > Radius-IP.1812: RADIUS, Access-Request (1), id: 0xc2 length: 80 07:13:27.674561 IP Radius-IP.1812 > 10.19.56.57.1026: RADIUS, Access-Accept (2), id: 0xc2 length: 20 3000 packets captured Any Idea about that? I used that guid for configuration: https://github.com/FreeRADIUS/mod_auth_radius P.S: I can't turn on the debug option, the server wouldn't start. Regards Carsten

1 0

Getting Reject response from Server for MAC Auth
by Victor Credidio 16 Aug '18

16 Aug '18

Hello masters! I'm trying to use a freeradius server 3 (running on CentOS7) with my ruckus AP (model R610). I followed this wiki article, specifically this two topics below to configure it properly: https://wiki.freeradius.org/guide/mac-auth#plain-mac-auth https://wiki.freeradius.org/guide/mac-auth#additional-modifications_mac-aut… I'm trying to log to my WLAN with my phone. It's MAC is already in the "authorized_macs" file (/etc/raddb/authorized_macs), and the server is receiving it's requests. I can see my phone's MAC Address, my AP MAC Address, the AP SSID, and some other stuff. Problem is, I still get rejected. For more than three days I've been trying to make it work like that, but still no progress, so I thought it was better to consult the experts. Here's the output of the radiusd -X command. I put the line numbers so it would be easier to locate or reference something. The first "reject" I get is on line 72: 1 (0) Received Access-Request Id 47 from 10.85.0.222:40680 to 10.85.2.46:1812 length 197 2 (0) User-Name = "70-4d-7b-53-cb-38" 3 (0) User-Password = "70-4d-7b-53-cb-38" 4 (0) Calling-Station-Id = "70-4D-7B-53-CB-38" 5 (0) NAS-IP-Address = 10.85.0.222 6 (0) Called-Station-Id = "90-3A-72-65-47-AC:PMJG-AD-ACC" 7 (0) Service-Type = Framed-User 8 (0) NAS-Port-Type = Wireless-802.11 9 (0) NAS-Identifier = "90-3A-72-65-47-AC" 10 (0) Ruckus-SSID = "PMJG-AD-ACC" 11 (0) Message-Authenticator = 0x5d564ee23f2090acd3bc2002e4b8a23b 12 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default 13 (0) authorize { 14 (0) policy filter_username { 15 (0) if (&User-Name) { 16 (0) if (&User-Name) -> TRUE 17 (0) if (&User-Name) { 18 (0) if (&User-Name =~ / /) { 19 (0) if (&User-Name =~ / /) -> FALSE 20 (0) if (&User-Name =~ /@[^@]*@/ ) { 21 (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE 22 (0) if (&User-Name =~ /\.\./ ) { 23 (0) if (&User-Name =~ /\.\./ ) -> FALSE 24 (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { 25 (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE 26 (0) if (&User-Name =~ /\.$/) { 27 (0) if (&User-Name =~ /\.$/) -> FALSE 28 (0) if (&User-Name =~ /(a)\./) { 29 (0) if (&User-Name =~ /(a)\./) -> FALSE 30 (0) } # if (&User-Name) = notfound 31 (0) } # policy filter_username = notfound 32 (0) policy rewrite_called_station_id { 33 (0) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { 34 (0) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) -> TRUE 35 (0) if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) { 36 (0) update request { 37 (0) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} 38 (0) --> 90-3A-72-65-47-AC 39 (0) &Called-Station-Id := 90-3A-72-65-47-AC 40 (0) } # update request = noop 41 (0) if ("%{8}") { 42 (0) EXPAND %{8} 43 (0) --> PMJG-AD-ACC 44 (0) if ("%{8}") -> TRUE 45 (0) if ("%{8}") { 46 (0) update request { 47 (0) EXPAND %{8} 48 (0) --> PMJG-AD-ACC 49 (0) &Called-Station-SSID := PMJG-AD-ACC 50 (0) } # update request = noop 51 (0) } # if ("%{8}") = noop 52 (0) [updated] = updated 53 (0) } # if (&Called-Station-Id && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})([^0-9a-f](.+))?$/i)) = updated 54 (0) ... skipping else: Preceding "if" was taken 55 (0) } # policy rewrite_called_station_id = updated 56 (0) policy rewrite_calling_station_id { 57 (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { 58 (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE 59 (0) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { 60 (0) update request { 61 (0) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} 62 (0) --> 70-4D-7B-53-CB-38 63 (0) &Calling-Station-Id := 70-4D-7B-53-CB-38 64 (0) } # update request = noop 65 (0) [updated] = updated 66 (0) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated 67 (0) ... skipping else: Preceding "if" was taken 68 (0) } # policy rewrite_calling_station_id = updated 69 (0) if (!ok) { 70 (0) if (!ok) -> TRUE 71 (0) if (!ok) { 72 (0) [reject] = reject 73 (0) } # if (!ok) = reject 74 (0) } # authorize = reject 75 (0) Using Post-Auth-Type Reject 76 (0) # Executing group from file /etc/raddb/sites-enabled/default 77 (0) Post-Auth-Type REJECT { 78 (0) attr_filter.access_reject: EXPAND %{User-Name} 79 (0) attr_filter.access_reject: --> 70-4d-7b-53-cb-38 80 (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 81 (0) [attr_filter.access_reject] = updated 82 (0) [eap] = noop 83 (0) policy remove_reply_message_if_eap { 84 (0) if (&reply:EAP-Message && &reply:Reply-Message) { 85 (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE 86 (0) else { 87 (0) [noop] = noop 88 (0) } # else = noop 89 (0) } # policy remove_reply_message_if_eap = noop 90 (0) } # Post-Auth-Type REJECT = updated 91 (0) Delaying response for 1.000000 seconds 92 Waking up in 0.3 seconds. 93 Waking up in 0.6 seconds. 94 (0) Sending delayed response 95 (0) Sent Access-Reject Id 47 from 10.85.2.46:1812 to 10.85.0.222:40680 length 20 96 Waking up in 3.9 seconds. 97 (0) Cleaning up request packet ID 47 with timestamp +11 Greetings, -- Victor B. C.

2 2

Re: Freeradius-Users Digest, Vol 160, Issue 18
by Arun NP 16 Aug '18

16 Aug '18

Hi , I tried doing the wget method in the link which you gave . But I am not able to see the "archive" directory in that path. I am using the github account (cisco specific) Please let me know how I can get the access for that file Thanks, Arun On Mon, Aug 13, 2018 at 3:30 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. "Suite B TLS cipher suite" support (elmerhe) > 2. RE: Freeradius-Users Digest, Vol 160, Issue 16 > (WAGHORN, Jason (NHS BORDERS)) > 3. Re: Filtering out Proxy-State in COA to fix broken Cisco NAS > (Fraser McGlinn) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 13 Aug 2018 14:13:47 +0800 > From: "elmerhe" <elmerhe(a)aliyun.com> > To: "freeRADIUS" <freeradius-users(a)lists.freeradius.org> > Subject: "Suite B TLS cipher suite" support > Message-ID: <8dc3d6ec-70d8-40a4-a678-b30ec918500e.elmerhe(a)aliyun.com> > Content-Type: text/plain; charset="UTF-8" > > > Hi Freeradius experts, > > I want to know if freeRADIUS supports "Suite B TLS cipher suite" which is > required by WPA3-enterprise. If yes, any specific configuration is needed? > > Thanks, > John. > > ------------------------------ > > Message: 2 > Date: Mon, 13 Aug 2018 07:21:44 +0000 > From: "WAGHORN, Jason (NHS BORDERS)" <j.waghorn1(a)nhs.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius-Users Digest, Vol 160, Issue 16 > Message-ID: <4ed9474f7f044be5b3e178da3b3bb936(a)NH-SLPEX176.AD1.NHS.NET> > Content-Type: text/plain; charset="utf-8" > > >From: Freeradius-Users [mailto:freeradius-users-bounces+j.waghorn1= > nhs.net(a)lists.freeradius.org] On Behalf Of Arun NP > > >Hi , > >I am doing a yum install & it is supposed to bring the latest version rt > ? > >. Please let me know how I can get the version which you are using > (3.0.17) > >. I am using centos 7 does the version which you mentioned exist for the > >same ? please inform me > > http://networkradius.com/freeradius-packages/ or compile it yourself > using the instructions in the Wiki > https://wiki.freeradius.org/building/RHEL%20and%20Centos > > Jason Waghorn > Senior Infrastructure Engineer > > NHS Borders | IT Services | Huntlyburn Terrace | Borders General Hospital > | Melrose | TD6 9BS > > N direct: 01896 827 760 | ext: 27760 | email:j.waghorn1@nhs.net |@ > mobile: 0747 100 5116 > > > > > ******************************************************************************************************************** > > This message may contain confidential information. If you are not the > intended recipient please inform the > sender that you have received the message in error before deleting it. > Please do not disclose, copy or distribute information in this e-mail or > take any action in relation to its contents. To do so is strictly > prohibited and may be unlawful. Thank you for your co-operation. > > NHSmail is the secure email and directory service available for all NHS > staff in England and Scotland. NHSmail is approved for exchanging patient > data and other sensitive information with NHSmail and other accredited > email services. > > For more information and to find out how you can switch, > https://portal.nhs.net/help/joiningnhsmail > > > > > ------------------------------ > > Message: 3 > Date: Mon, 13 Aug 2018 17:56:26 +1000 > From: Fraser McGlinn <fraser(a)frizianz.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Filtering out Proxy-State in COA to fix broken Cisco NAS > Message-ID: <2660278386ca44f737aaed0528fae149(a)frizianz.com> > Content-Type: text/plain; charset=UTF-8; format=flowed > > Thanks Alan, that helps a lot. Great info in that draft RFC. > > On 2018-08-10 22:12, Alan DeKok wrote: > > On Aug 8, 2018, at 9:19 PM, Fraser McGlinn <fraser(a)frizianz.com> wrote: > >> > >> Trying to get COA proxying working with a Cisco NAS. Unfortunately > >> they have a broken implementation where if Proxy-State is in the > >> request it drops it. > > > > That's based on a naive reading of RFC 5176. Happily, my new draft > > clarifies this. It should be an RFC this year: > > > > https://tools.ietf.org/html/draft-ietf-radext-coa-proxy-03 > > > >> I dug and found this old thread > >> > http://lists.freeradius.org/pipermail/freeradius-users/2012-April/060456.ht… > >> implying that we can filter out Proxy-State in attr_filter, however > >> i've had some issues getting this working. Although this was relevant > >> to freeradius 2x, i'm running 3.0.16. > >> > >> Any other ways to achieve this? Hoping someone can point me in the > >> right direction. > > > > You can delete the Proxy-State attribute in the "pre-proxy" section: > > > > pre-proxy { > > ... > > update proxy-request { > > Proxy-State !* ANY > > } > > ... > > } > > > > Hope that helps. > > > > Alan DeKok. > > > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 160, Issue 18 > ************************************************* >

1 0

I need to disconnect users
by Ariel García Reyes 15 Aug '18

15 Aug '18

I need to disconnect users that in 1 month already have consumed 1gbyte of data. The NAS sends me the traffic of the network every 5 minutes. The question is: how to do that when I get the data that the user has already consumed the traffic that was assigned, the freeradius disconnect the user ?. I am using the RadiusDesk implementation, I have configured plans and they work, but the consumption check is when the user is going to log in only. -- ________________________________________________ Lic. Ariel García Reyes. GNU/Linux Registered User #357058

3 3

Dynamic Vlan Assignment Active Directory with winbind EAP-TLS 802.1x
by Kevin Virk 15 Aug '18

15 Aug '18

Hello All, I came across this thread in my search for answers http://freeradius.1045715.n5.nabble.com/FreeRadius-3-0-11-and-Winbind-td574… and it is stating that winbind is not the preferred method for dynamic vlan assignment. This thread is about two years old so I was hoping if anyone could answer if this was still the case. I am using FreeRADIUS Version 2.2.8. As this was what was downloaded using the deb package on Ubuntu 16.04. The setup I am hoping to achieve is EAP-TLS 802.1x that can dynamically assign vlans to users based off active directory information and has the ability to revoke certs and check active directory for disabled accounts and not allow them to auth. Is this possible? From: Freeradius-Users <freeradius-users-bounces+kevin.virk=faithlife.com(a)lists.freeradius.org> on behalf of freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Sent: Wednesday, August 15, 2018 5:50 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 160, Issue 25 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Fw: Wifi Captive portal (hiran bhagvan) ---------------------------------------------------------------------- Message: 1 Date: Wed, 15 Aug 2018 12:50:49 +0000 (UTC) From: hiran bhagvan <hiranuk(a)yahoo.co.uk> To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Subject: Fw: Wifi Captive portal Message-ID: <1810636114.11120944.1534337450274(a)mail.yahoo.com> Content-Type: text/plain; charset="utf-8" Image by FlamingText.com ----- Forwarded message ----- From: hiran bhagvan <hiranuk(a)yahoo.co.uk>To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org>Sent: Wednesday, 15 August 2018, 13:43:54 BSTSubject: Fw: Wifi Captive portal Image by FlamingText.com ----- Forwarded message ----- From: hiran bhagvan <hiranuk(a)yahoo.co.uk>To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org>Sent: Wednesday, 15 August 2018, 12:24:19 BSTSubject: Wifi Captive portal Hi I would like to use free radius but im not sure if it will support what i will need it to do. i need it to authenticate guest wi-fi uses that connect to a Draytek router. The Draytek router has a captive portal conifg and can have a external radius server carrying out the authentication so i was thinking of using "Free radius" for this. The Draytek routers will be in different locations around the country and the free radius server will be a central server that all the Draytek's talk to I have attached screenshots of the Draytek config page can you tell me if i would be about to use "Free radius" to authenticate users by MAC addresses of their devices? Thanks in advance Hiran Image by FlamingText.com

2 1

Duplicate RADIUS accounting, same everything except radacctid
by Michael Ducharme 15 Aug '18

15 Aug '18

2 2

Reject for unknown TLS version
by Norman Elton 15 Aug '18

15 Aug '18

Deploying EAP-TLS, I've got the CA and certificate configured on the server, and the client-side certificate on the client. But I'm getting a "Unknown TLS version [length 0002]" message. Debug output below. Following a previous thread (http://freeradius.1045715.n5.nabble.com/ttls-lt-lt-lt-Unknown-TLS-version-l…) I've confirmed that FreeRADIUS is built on a version of OpenSSL that support TLS 1.2. In wireshark, I see the Server Hello advertising support for TLS 1.2. I'm also seeing an exchange of four access-request / access-challenge before the reject is finally sent. Is there anything else that could be causing this message? Is the "[length 0002]" referring to only have two bytes to parse? Is some of the transaction getting lost someplace? To be fair, we have FreeRADIUS deployed on RHEL6, using the RedHat-supplied packages. So far, we've been happy with the stability this provides, but realize that FreeRADIUS 2.2.6 is way outdated. My suspicion is this is due to a misconfiguration somewhere on my end, but will test a newer version of FreeRADIUS. Thanks Norman ======== rad_recv: Access-Request packet from host 10.100.136.139 port 58966, id=85, length=256 User-Name = "wnelto(a)wm.edu" NAS-Identifier = "AP-Jones14Hallway" Called-Station-Id = "C4-13-E2-03-28-A7:eduroam-tls" AH-Vlan-Id = 0 AH-UserProfile-Id = 1100 Acct-Multi-Session-Id = "696D03370B67F9C2" Service-Type = Framed-User NAS-Port = 0 Calling-Station-Id = "78-4F-43-51-71-D2" Connect-Info = "11ac" Acct-Session-Id = "8C5E9DF056A740DB" WLAN-Pairwise-Cipher = 1027076 WLAN-Group-Cipher = 1027076 WLAN-AKM-Suite = 1027073 NAS-IP-Address = 10.100.136.139 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x02c7001201776e656c746f40776d2e656475 Message-Authenticator = 0x89c60964c1782091312827729adc6284 server srv-aerohive-aps-eap-tls { # Executing section authorize from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group authorize { ++[preprocess] = ok [strip_username_prefix] expand: ^campus\\\ -> ^campus\\ strip_username_prefix: Does not match: User-Name = wnelto(a)wm.edu ++[strip_username_prefix] = ok ++[mschap] = noop [log_aerohive_inbound] expand: AERO [IN %{request:Packet-Src-IP-Address}] %{request:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> AERO [IN 10.100.136.139] Access-Request: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu ++[log_aerohive_inbound] = ok [eap-aerohive-tls] EAP packet type response id 199 length 18 [eap-aerohive-tls] No EAP Start, assuming it's an on-going EAP conversation ++[eap-aerohive-tls] = updated +} # group authorize = updated Found Auth-Type = eap-aerohive-tls # Executing group from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group eap-aerohive-tls { [eap-aerohive-tls] EAP Identity [eap-aerohive-tls] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap-aerohive-tls] = handled ++? if (handled) ? Evaluating (handled) -> TRUE ++? if (handled) -> TRUE ++if (handled) { [log_aerohive_outbound] expand: AERO [OUT %{reply:Packet-Dst-IP-Address}] %{reply:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> %{reply:Tunnel-Private-Group-ID} -> AERO [OUT 10.100.136.139] Access-Challenge: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu -> +++[log_aerohive_outbound] = ok +++[handled] = handled ++} # if (handled) = handled +} # group eap-aerohive-tls = handled } # server srv-aerohive-aps-eap-tls Sending Access-Challenge of id 85 to 10.100.136.139 port 58966 EAP-Message = 0x01c800060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6fc2d7b96f0ada3950baa64de4198c71 Finished request 19. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.100.136.139 port 58966, id=86, length=417 User-Name = "wnelto(a)wm.edu" NAS-Identifier = "AP-Jones14Hallway" Called-Station-Id = "C4-13-E2-03-28-A7:eduroam-tls" AH-Vlan-Id = 0 AH-UserProfile-Id = 1100 Acct-Multi-Session-Id = "696D03370B67F9C2" Service-Type = Framed-User NAS-Port = 0 Calling-Station-Id = "78-4F-43-51-71-D2" Connect-Info = "11ac" Acct-Session-Id = "8C5E9DF056A740DB" WLAN-Pairwise-Cipher = 1027076 WLAN-Group-Cipher = 1027076 WLAN-AKM-Suite = 1027073 NAS-IP-Address = 10.100.136.139 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x02c800a10d800000009716030100920100008e03035b72d919bf25e5e1c2428293f421b0ca996556c5fa8b19f9897c7a1a5c994c0a00002c00ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000a01000039000a00080006001700180019000b00020100000d00120010040102010501060104030203050306030005000501000000000012000000170000 State = 0x6fc2d7b96f0ada3950baa64de4198c71 Message-Authenticator = 0xdd283334b485d03b1a1227da4db85c86 server srv-aerohive-aps-eap-tls { # Executing section authorize from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group authorize { ++[preprocess] = ok [strip_username_prefix] expand: ^campus\\\ -> ^campus\\ strip_username_prefix: Does not match: User-Name = wnelto(a)wm.edu ++[strip_username_prefix] = ok ++[mschap] = noop [log_aerohive_inbound] expand: AERO [IN %{request:Packet-Src-IP-Address}] %{request:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> AERO [IN 10.100.136.139] Access-Request: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu ++[log_aerohive_inbound] = ok [eap-aerohive-tls] EAP packet type response id 200 length 161 [eap-aerohive-tls] No EAP Start, assuming it's an on-going EAP conversation ++[eap-aerohive-tls] = updated +} # group authorize = updated Found Auth-Type = eap-aerohive-tls # Executing group from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group eap-aerohive-tls { [eap-aerohive-tls] Request found, released from the list [eap-aerohive-tls] EAP/tls [eap-aerohive-tls] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 151 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< Unknown TLS version [length 0092] [tls] TLS_accept: SSLv3 read client hello A [tls] >>> Unknown TLS version [length 0039] [tls] TLS_accept: SSLv3 write server hello A [tls] >>> Unknown TLS version [length 0667] [tls] TLS_accept: SSLv3 write certificate A [tls] >>> Unknown TLS version [length 014d] [tls] TLS_accept: SSLv3 write key exchange A [tls] >>> Unknown TLS version [length 00f4] [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap-aerohive-tls] = handled ++? if (handled) ? Evaluating (handled) -> TRUE ++? if (handled) -> TRUE ++if (handled) { [log_aerohive_outbound] expand: AERO [OUT %{reply:Packet-Dst-IP-Address}] %{reply:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> %{reply:Tunnel-Private-Group-ID} -> AERO [OUT 10.100.136.139] Access-Challenge: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu -> +++[log_aerohive_outbound] = ok +++[handled] = handled ++} # if (handled) = handled +} # group eap-aerohive-tls = handled } # server srv-aerohive-aps-eap-tls Sending Access-Challenge of id 86 to 10.100.136.139 port 58966 EAP-Message = 0x01c904000dc0000008f516030300390200003503035b72d9197e597f8bc8a618afe30f89ecffd92dff97fc8acae895d7ac1498d4c200c03000000dff01000100000b00040300010216030306670b00066300066000065d3082065930820541a00302010202107e23e2f2c72fa07f91b662af2727e01b300d06092a864886f70d01010b05003076310b3009060355040613025553310b3009060355040813024d493112301006035504071309416e6e204172626f7231123010060355040a1309496e7465726e6574323111300f060355040b1308496e436f6d6d6f6e311f301d06035504031316496e436f6d6d6f6e2052534120536572766572204341 EAP-Message = 0x301e170d3136303230393030303030305a170d3139303230383233353935395a3081b5310b3009060355040613025553311330110603550411130a32333138372d38373935310b3009060355040813025641311530130603550407130c57696c6c69616d7362757267311c301a06035504091313426c6f772048616c6c2c20526f6f6d2031353031283026060355040a131f54686520436f6c6c656765206f662057696c6c69616d20616e64204d617279310b3009060355040b13024954311830160603550403130f776972656c6573732e776d2e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100b81b7f2a EAP-Message = 0x5457ad3bd6fd8fe5a4ad8f00278203819792ce336920bc498078a01a67cd1f3209ab29aa6408360079fdf24c8dc55a0b0dcfb7fb2ac2388707e95bb0addce869229dd675e2a22674b8106acc105752dbf8bb22492d4c435ccf2a5c9092dc906dc896fe7f2c139cbaefa8017fbeb1fd07054d6aa2781f2ae43682f211cba7c336f20c5fe5919e89a68ebcd4f7994ad497abb1ca5a2c70d876e1fb5678c190484afefbe8ca5ecb59bcc2ab81c2dac39b5f1b469d6b72117cabec5bd0c4ef3da8ca20ea1f7d6ed6e7dec9da78abd2489b9d054593ca8eff7d0f8f40fd4b6ddd40f760f0b9b229a3ad57116734dcc9144d0020cf9355ad909e1e0a3db5dd02 EAP-Message = 0x03010001a38202a13082029d301f0603551d230418301680141e05a3778f6c96e25b874ba6b486ac71000ce738301d0603551d0e04160414e221c3b8b5a1ed4f545c740be804648cdc845c34300e0603551d0f0101ff0404030205a0300c0603551d130101ff04023000301d0603551d250416301406082b0601050507030106082b0601050507030230670603551d200460305e3052060c2b06010401ae2301040301013042304006082b06010505070201163468747470733a2f2f7777772e696e636f6d6d6f6e2e6f72672f636572742f7265706f7369746f72792f6370735f73736c2e7064663008060667810c01020230440603551d1f043d303b EAP-Message = 0x3039a037a035863368747470 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6fc2d7b96e0bda3950baa64de4198c71 Finished request 20. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.100.136.139 port 58966, id=87, length=262 User-Name = "wnelto(a)wm.edu" NAS-Identifier = "AP-Jones14Hallway" Called-Station-Id = "C4-13-E2-03-28-A7:eduroam-tls" AH-Vlan-Id = 0 AH-UserProfile-Id = 1100 Acct-Multi-Session-Id = "696D03370B67F9C2" Service-Type = Framed-User NAS-Port = 0 Calling-Station-Id = "78-4F-43-51-71-D2" Connect-Info = "11ac" Acct-Session-Id = "8C5E9DF056A740DB" WLAN-Pairwise-Cipher = 1027076 WLAN-Group-Cipher = 1027076 WLAN-AKM-Suite = 1027073 NAS-IP-Address = 10.100.136.139 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x02c900060d00 State = 0x6fc2d7b96e0bda3950baa64de4198c71 Message-Authenticator = 0x66c9255b45835d0d2d54398dc804a0b6 server srv-aerohive-aps-eap-tls { # Executing section authorize from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group authorize { ++[preprocess] = ok [strip_username_prefix] expand: ^campus\\\ -> ^campus\\ strip_username_prefix: Does not match: User-Name = wnelto(a)wm.edu ++[strip_username_prefix] = ok ++[mschap] = noop [log_aerohive_inbound] expand: AERO [IN %{request:Packet-Src-IP-Address}] %{request:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> AERO [IN 10.100.136.139] Access-Request: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu ++[log_aerohive_inbound] = ok [eap-aerohive-tls] EAP packet type response id 201 length 6 [eap-aerohive-tls] No EAP Start, assuming it's an on-going EAP conversation ++[eap-aerohive-tls] = updated +} # group authorize = updated Found Auth-Type = eap-aerohive-tls # Executing group from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group eap-aerohive-tls { [eap-aerohive-tls] Request found, released from the list [eap-aerohive-tls] EAP/tls [eap-aerohive-tls] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap-aerohive-tls] = handled ++? if (handled) ? Evaluating (handled) -> TRUE ++? if (handled) -> TRUE ++if (handled) { [log_aerohive_outbound] expand: AERO [OUT %{reply:Packet-Dst-IP-Address}] %{reply:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> %{reply:Tunnel-Private-Group-ID} -> AERO [OUT 10.100.136.139] Access-Challenge: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu -> +++[log_aerohive_outbound] = ok +++[handled] = handled ++} # if (handled) = handled +} # group eap-aerohive-tls = handled } # server srv-aerohive-aps-eap-tls Sending Access-Challenge of id 87 to 10.100.136.139 port 58966 EAP-Message = 0x01ca04000dc0000008f53a2f2f63726c2e696e636f6d6d6f6e2d7273612e6f72672f496e436f6d6d6f6e52534153657276657243412e63726c307506082b0601050507010104693067303e06082b060105050730028632687474703a2f2f6372742e7573657274727573742e636f6d2f496e436f6d6d6f6e52534153657276657243415f322e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d3081f70603551d110481ef3081ec820f776972656c6573732e776d2e656475821761757468312e7361666574792e6e65742e776d2e656475821761757468322e7361666574792e6e65742e776d EAP-Message = 0x2e656475821761757468332e7361666574792e6e65742e776d2e656475821761757468342e7361666574792e6e65742e776d2e6564758219617574686465762e7361666574792e6e65742e776d2e6564758215726164697573312e63616d7075732e776d2e6564758215726164697573322e63616d7075732e776d2e6564758215726164697573332e63616d7075732e776d2e6564758215726164697573342e63616d7075732e776d2e656475300d06092a864886f70d01010b050003820101008a0e6906805755e7771d4007da7cc49081e60831f0170be61b71a9919ffe692638c427069ca1bcc3479d6e76ba03de3cf11934df860be80cf452885b EAP-Message = 0x40c6cd525a6871b33f0fcbcdcf526c5142868b8bc6a60dd745682e84a1caea9ffc3b50e447586d75a06530a4ac2cd44a6e5ad2044e157f4cf83cd603f8b5126f1cd90ebc61483d0a7b6d77d12630e610a7d4afc462cacb7a932f15989bb8a28bf01e2619420d37ce3e9dc4bcf269c2b7966ef9a326af879e0a11b981fc4202999fd3fd0ef1fc6f1201a091e8d895029616ae92eb6fb43615721f270fb7cbaeda1f619684960b55aa016eaaae364be336d7bf0e0c6943734924d5f218ab033185c8dc253a160303014d0c0001490300174104a43ff793877aa3cbe8938ad243c61ba19f3d9f8716e6fabff6279898c7181cdbb2402ec0c27715ed0a0ae3 EAP-Message = 0x592362b8138e143a1617a3f2c98af985ab7fa9f3b904010100b64e0ddac89de21dae049cb7c20d90cb5bc6674450eb8aaba7987a919cdb401cfada8f96fee3f8dd629b67955b60cc4aa1efe7b91a50917d51ac7b056e7ca76aac2ba42f26dfb86df1e6a8ab2de6017a08210b6e9f51c7b07bca6ab9df8b675e88dbb027e13be5fe52acbe48eb3072ff34c762ad66c02217aec74e2dca794b1bc27ed461268466e77135c90628f91bbda6c3a3043097a2d3391f02dbcfb730ef5009acac1352bfb0a8184ce2f0da3b179669c50e9277728a694ff236eed58a1b25e2cf9c2b26be443799c5c25391ef859a33dcae27d83b034e4d597c642835cbb7d8c924 EAP-Message = 0x61afcf995dfc00d54f975473 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6fc2d7b96d08da3950baa64de4198c71 Finished request 21. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.100.136.139 port 58966, id=88, length=262 User-Name = "wnelto(a)wm.edu" NAS-Identifier = "AP-Jones14Hallway" Called-Station-Id = "C4-13-E2-03-28-A7:eduroam-tls" AH-Vlan-Id = 0 AH-UserProfile-Id = 1100 Acct-Multi-Session-Id = "696D03370B67F9C2" Service-Type = Framed-User NAS-Port = 0 Calling-Station-Id = "78-4F-43-51-71-D2" Connect-Info = "11ac" Acct-Session-Id = "8C5E9DF056A740DB" WLAN-Pairwise-Cipher = 1027076 WLAN-Group-Cipher = 1027076 WLAN-AKM-Suite = 1027073 NAS-IP-Address = 10.100.136.139 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x02ca00060d00 State = 0x6fc2d7b96d08da3950baa64de4198c71 Message-Authenticator = 0x4853ab54dca98d2730b55492154a5900 server srv-aerohive-aps-eap-tls { # Executing section authorize from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group authorize { ++[preprocess] = ok [strip_username_prefix] expand: ^campus\\\ -> ^campus\\ strip_username_prefix: Does not match: User-Name = wnelto(a)wm.edu ++[strip_username_prefix] = ok ++[mschap] = noop [log_aerohive_inbound] expand: AERO [IN %{request:Packet-Src-IP-Address}] %{request:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> AERO [IN 10.100.136.139] Access-Request: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu ++[log_aerohive_inbound] = ok [eap-aerohive-tls] EAP packet type response id 202 length 6 [eap-aerohive-tls] No EAP Start, assuming it's an on-going EAP conversation ++[eap-aerohive-tls] = updated +} # group authorize = updated Found Auth-Type = eap-aerohive-tls # Executing group from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group eap-aerohive-tls { [eap-aerohive-tls] Request found, released from the list [eap-aerohive-tls] EAP/tls [eap-aerohive-tls] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap-aerohive-tls] = handled ++? if (handled) ? Evaluating (handled) -> TRUE ++? if (handled) -> TRUE ++if (handled) { [log_aerohive_outbound] expand: AERO [OUT %{reply:Packet-Dst-IP-Address}] %{reply:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> %{reply:Tunnel-Private-Group-ID} -> AERO [OUT 10.100.136.139] Access-Challenge: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu -> +++[log_aerohive_outbound] = ok +++[handled] = handled ++} # if (handled) = handled +} # group eap-aerohive-tls = handled } # server srv-aerohive-aps-eap-tls Sending Access-Challenge of id 88 to 10.100.136.139 port 58966 EAP-Message = 0x01cb01130d80000008f5f4cbf66cc3d63f418c16b335bf8fc5e216030300f40d0000ec03010240001e06010602060305010502050304010402040303010302030302010202020300c6005d305b31243022060355040a0c1b436f6c6c656765206f662057696c6c69616d20616e64204d6172793133303106035504030c2a436f6c6c656765206f662057696c6c69616d20616e64204d6172792044657669636520526f6f742043410065306331243022060355040a0c1b436f6c6c656765206f662057696c6c69616d20616e64204d617279313b303906035504030c32436f6c6c656765206f662057696c6c69616d20616e64204d6172792044657669 EAP-Message = 0x636520496e7465726d6564696174652043410e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6fc2d7b96c09da3950baa64de4198c71 Finished request 22. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.100.136.139 port 58966, id=89, length=273 User-Name = "wnelto(a)wm.edu" NAS-Identifier = "AP-Jones14Hallway" Called-Station-Id = "C4-13-E2-03-28-A7:eduroam-tls" AH-Vlan-Id = 0 AH-UserProfile-Id = 1100 Acct-Multi-Session-Id = "696D03370B67F9C2" Service-Type = Framed-User NAS-Port = 0 Calling-Station-Id = "78-4F-43-51-71-D2" Connect-Info = "11ac" Acct-Session-Id = "8C5E9DF056A740DB" WLAN-Pairwise-Cipher = 1027076 WLAN-Group-Cipher = 1027076 WLAN-AKM-Suite = 1027073 NAS-IP-Address = 10.100.136.139 NAS-Port-Type = Wireless-802.11 Framed-MTU = 1500 EAP-Message = 0x02cb00110d800000000715030300020100 State = 0x6fc2d7b96c09da3950baa64de4198c71 Message-Authenticator = 0x574a16f4a82bcdf900c20574210fde90 server srv-aerohive-aps-eap-tls { # Executing section authorize from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group authorize { ++[preprocess] = ok [strip_username_prefix] expand: ^campus\\\ -> ^campus\\ strip_username_prefix: Does not match: User-Name = wnelto(a)wm.edu ++[strip_username_prefix] = ok ++[mschap] = noop [log_aerohive_inbound] expand: AERO [IN %{request:Packet-Src-IP-Address}] %{request:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> AERO [IN 10.100.136.139] Access-Request: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu ++[log_aerohive_inbound] = ok [eap-aerohive-tls] EAP packet type response id 203 length 17 [eap-aerohive-tls] No EAP Start, assuming it's an on-going EAP conversation ++[eap-aerohive-tls] = updated +} # group authorize = updated Found Auth-Type = eap-aerohive-tls # Executing group from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group eap-aerohive-tls { [eap-aerohive-tls] Request found, released from the list [eap-aerohive-tls] EAP/tls [eap-aerohive-tls] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 7 [tls] Length Included [tls] eaptls_verify returned 11 [tls] <<< Unknown TLS version [length 0002] TLS Alert read:warning:close notify TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap-aerohive-tls] Handler failed in EAP/tls [eap-aerohive-tls] Failed in EAP select ++[eap-aerohive-tls] = invalid +} # group eap-aerohive-tls = invalid Failed to authenticate the user. } # server srv-aerohive-aps-eap-tls Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/auth-server/sites/aerohive-aps-eap-tls +group REJECT { [log_aerohive_outbound] expand: AERO [OUT %{reply:Packet-Dst-IP-Address}] %{reply:Packet-Type}: %{request:Calling-Station-Id} %{request:Called-Station-Id} %{request:User-Name} -> %{reply:Tunnel-Private-Group-ID} -> AERO [OUT 10.100.136.139] Access-Reject: 78-4F-43-51-71-D2 C4-13-E2-03-28-A7:eduroam-tls wnelto(a)wm.edu -> ++[log_aerohive_outbound] = ok +} # group REJECT = ok Delaying reject of request 23 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 23 Sending Access-Reject of id 89 to 10.100.136.139 port 58966 EAP-Message = 0x04cb0004 Message-Authenticator = 0x00000000000000000000000000000000

2 3