February 2020 - Freeradius-Users - lists.freeradius.org

rlm_cache xlat
by Станислав Семенов 27 Feb '20

27 Feb '20

Hi Why not working next config? Thanks. cache cache_ldap { driver = "rlm_cache_rbtree" key = "%{User-Name}" ttl = 300 add_stats = no update { &reply:Cisco-AVPair := &reply:Cisco-AVPair &control:Tmp-String-0 := &control:Tmp-String-0 } } post-auth { cache_ldap update reply { Tmp-String-1 = "%{cache_ldap:control:Tmp-String-0}" } detail_reply } (0) # Executing section post-auth from file /usr/local/radius/etc/raddb/radiusd.conf (0) post-auth { (0) cache_ldap: EXPAND %{User-Name} (0) cache_ldap: --> E350 (0) cache_ldap: No cache entry found for "E350" (0) cache_ldap: Creating new cache entry (0) cache_ldap: &reply:Cisco-AVPair := &reply:Cisco-AVPair -> 'h323-ivr-in=ani:4822360460' (0) cache_ldap: &control:Tmp-String-0 := &control:Tmp-String-0 -> 'h323-ivr-in=ani:4822360460' (0) cache_ldap: Committed entry, TTL 300 seconds (0) [cache_ldap] = updated (0) update reply { (0) No cache entry found for "control:Tmp-String-0" (0) EXPAND %{cache_ldap:control:Tmp-String-0} (0) --> (0) Tmp-String-1 = (0) } # update reply = noop

3 4

Simultaneous-Use problems
by Marco Miglietta 27 Feb '20

27 Feb '20

Hi, can I receive a little help ? I use authentication with users in maria-db. Where I have to make settings in order to allow a unique login ? Attribute Simultaneous-Use as check ? Thank you. Marco.

1 0

Problem with backslash
by Martin Grůza 27 Feb '20

27 Feb '20

Hello, I have got problem with backslash when I set it to attribute and expand it to string, there are double backslash, but I want only one backslash. Thank you.

2 3

iOS and OSX issues
by Alan DeKok 26 Feb '20

26 Feb '20

If people are having issues with iOS and OSX getting online, you should check out Apples new guidelines: https://support.apple.com/en-ca/HT210176 Even if your certificates meet those criteria, they *might* still be rejected. If so, you should do some tests with the "example.com" certificates that the server builds in raddb/certs. Use a test machine (not the production RADIUS server!) and figure out if the certificates are accepted by iOS. If so, then you may have to get new production certificates which more closely match the test ones. iOS and OSX are "black boxes", and do NOT give useful information as to why they rejected the certificate. If they did, it would be a simple matter to fix the offending field. Instead, Apple punishes everyone for their own laziness. :( Alan DeKok.

2 4

Radius AD authentication issue
by Franck Rakotonindrainy 24 Feb '20

24 Feb '20

Hello the list, I have an issue in my radius authentication and I am unable to understand the cause of the issue, If anybody could point me to some tips for debugging ("same" config works on two other servers) here is part of the debug log : (253) Thu Feb 20 17:21:38 2020: Debug: Received Access-Request Id 170 from 10.211.120.171:49563 to 10.211.120.158:1812 length 514 (253) Thu Feb 20 17:21:38 2020: Debug: Framed-MTU = 1480 (253) Thu Feb 20 17:21:38 2020: Debug: NAS-IP-Address = 192.168.xxx.yyy (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Identifier = "SWAA-FV001234" (253) Thu Feb 20 17:21:38 2020: Debug: User-Name = "host/FV004665.kabi.ads.fresenius.com" (253) Thu Feb 20 17:21:38 2020: Debug: Service-Type = Framed-User (253) Thu Feb 20 17:21:38 2020: Debug: Framed-Protocol = PPP (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port = 40 (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port-Type = Ethernet (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port-Id = "40" (253) Thu Feb 20 17:21:38 2020: Debug: Called-Station-Id = "04-09-73-cc-dd-ee" (253) Thu Feb 20 17:21:38 2020: Debug: Calling-Station-Id = "10-65-30-aa-bb-cc" (253) Thu Feb 20 17:21:38 2020: Debug: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Type:0 = VLAN (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Medium-Type:0 = IEEE-802 (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Private-Group-Id:0 = "1136" (253) Thu Feb 20 17:21:38 2020: Debug: State = 0xfa22c4baff2add06e61b85de3ed7b62c (253) Thu Feb 20 17:21:38 2020: Debug: EAP-Message = 0x020800481900170303003d000000000000000123354593f8cee502592de9ad1a0b7d82103e59ac4049d7de806c086b98762c715fd0d287de74eb9828d7e4c143b6a8b09ddbeafcc5 (253) Thu Feb 20 17:21:38 2020: Debug: Message-Authenticator = 0xe58b264bf83043caafe7f2b4682ac5d7 (253) Thu Feb 20 17:21:38 2020: Debug: MS-RAS-Vendor = 11 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b28 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b2e (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b30 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b3d (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b18 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b19 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0138 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x013a (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0140 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0141 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0151 (253) Thu Feb 20 17:21:38 2020: Debug: PacketFence-KeyBalanced = "df58829ae3956b8619f745de7ed1580b" (253) Thu Feb 20 17:21:38 2020: Debug: Proxy-State = 0x313237 (253) Thu Feb 20 17:21:38 2020: Debug: Restoring &session-state (253) Thu Feb 20 17:21:38 2020: Debug: &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (253) Thu Feb 20 17:21:38 2020: Debug: &session-state:TLS-Session-Version = "TLS 1.2" (253) Thu Feb 20 17:21:38 2020: Debug: # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence (253) Thu Feb 20 17:21:38 2020: Debug: authorize { (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{Packet-Src-IP-Address} (253) Thu Feb 20 17:21:38 2020: Debug: --> 10.211.120.171 (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{Packet-Dst-IP-Address} (253) Thu Feb 20 17:21:38 2020: Debug: --> 10.211.120.158 (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %l (253) Thu Feb 20 17:21:38 2020: Debug: --> 1582215698 (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-realm-if-machine { (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) { (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) { (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{2} (253) Thu Feb 20 17:21:38 2020: Debug: --> kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-realm-if-machine = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-balanced-key-policy { (253) Thu Feb 20 17:21:38 2020: Debug: if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i)) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{md5:%{2}%{1}} (253) Thu Feb 20 17:21:38 2020: Debug: --> 785ef37fa229298f465f6b3eee6eeb38 (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{md5:%{2}%{1}} (253) Thu Feb 20 17:21:38 2020: Debug: --> 785ef37fa229298f465f6b3eee6eeb38 (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i)) = noop (253) Thu Feb 20 17:21:38 2020: Debug: ... skipping else: Preceding "if" was taken (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-balanced-key-policy = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-tenant-id { (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0"){ (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{%{control:PacketFence-Tenant-Id}:-0} (253) Thu Feb 20 17:21:38 2020: Debug: --> 0 (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: update control { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{User-Name} (253) Thu Feb 20 17:21:38 2020: Debug: --> host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: SQL-User-Name set to 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: Executing select query: SELECT IFNULL((SELECT tenant_id FROM radius_nas WHERE nasname = '192.168.xxx.yyy'), 0) (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{sql: SELECT IFNULL((SELECT tenant_id FROM radius_nas WHERE nasname = '%{NAS-IP-Address}'), 0)} (253) Thu Feb 20 17:21:38 2020: Debug: --> 1 (253) Thu Feb 20 17:21:38 2020: Debug: } # update control = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") = noop (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) { (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-tenant-id = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy rewrite_calling_station_id { (253) Thu Feb 20 17:21:38 2020: Debug: if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: update request { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}} (253) Thu Feb 20 17:21:38 2020: Debug: --> 10:65:30:aa:bb:cc (253) Thu Feb 20 17:21:38 2020: Debug: } # update request = noop (253) Thu Feb 20 17:21:38 2020: Debug: [updated] = updated (253) Thu Feb 20 17:21:38 2020: Debug: } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (253) Thu Feb 20 17:21:38 2020: Debug: ... skipping else: Preceding "if" was taken (253) Thu Feb 20 17:21:38 2020: Debug: } # policy rewrite_calling_station_id = updated (253) Thu Feb 20 17:21:38 2020: Debug: policy rewrite_called_station_id { (253) Thu Feb 20 17:21:38 2020: Debug: if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: update request { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}} (253) Thu Feb 20 17:21:38 2020: Debug: --> 04:09:73:cc:dd:ee (253) Thu Feb 20 17:21:38 2020: Debug: } # update request = noop (253) Thu Feb 20 17:21:38 2020: Debug: if ("%{8}") { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{8} (253) Thu Feb 20 17:21:38 2020: Debug: --> (253) Thu Feb 20 17:21:38 2020: Debug: if ("%{8}") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) { (253) Thu Feb 20 17:21:38 2020: Debug: elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: elsif (Aruba-Essid-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: elsif (Aruba-Essid-Name) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) { (253) Thu Feb 20 17:21:38 2020: Debug: elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: [updated] = updated (253) Thu Feb 20 17:21:38 2020: Debug: } # if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) = updated (253) Thu Feb 20 17:21:38 2020: Debug: ... skipping else: Preceding "if" was taken (253) Thu Feb 20 17:21:38 2020: Debug: } # policy rewrite_called_station_id = updated (253) Thu Feb 20 17:21:38 2020: Debug: policy filter_username { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ / /) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ / /) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /@[^@]*@/ ) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /@[^@]*@/ ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.\./ ) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.\./ ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (253) Thu Feb 20 17:21:38 2020: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.$/) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.$/) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /(a)\./) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /(a)\./) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # if (&User-Name) = updated (253) Thu Feb 20 17:21:38 2020: Debug: } # policy filter_username = updated (253) Thu Feb 20 17:21:38 2020: Debug: policy filter_password { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Password && (&User-Password != "%{string:User-Password}")) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy filter_password = updated (253) Thu Feb 20 17:21:38 2020: Debug: [preprocess] = ok (253) Thu Feb 20 17:21:38 2020: Debug: suffix: Request already has destination realm set. Ignoring (253) Thu Feb 20 17:21:38 2020: Debug: [suffix] = noop (253) Thu Feb 20 17:21:38 2020: Debug: ntdomain: Request already has destination realm set. Ignoring (253) Thu Feb 20 17:21:38 2020: Debug: [ntdomain] = noop (253) Thu Feb 20 17:21:38 2020: Debug: eap: Peer sent EAP Response (code 2) ID 8 length 72 (253) Thu Feb 20 17:21:38 2020: Debug: eap: Continuing tunnel setup (253) Thu Feb 20 17:21:38 2020: Debug: [eap] = ok (253) Thu Feb 20 17:21:38 2020: Debug: } # authorize = ok (253) Thu Feb 20 17:21:38 2020: Debug: Found Auth-Type = eap (253) Thu Feb 20 17:21:38 2020: Debug: # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence (253) Thu Feb 20 17:21:38 2020: Debug: authenticate { (253) Thu Feb 20 17:21:38 2020: Debug: eap: Expiring EAP session with state 0xfa22c4baff2add06 (253) Thu Feb 20 17:21:38 2020: Debug: eap: Finished EAP session with state 0xfa22c4baff2add06 (253) Thu Feb 20 17:21:38 2020: Debug: eap: Previous EAP request found for state 0xfa22c4baff2add06, released from the list (253) Thu Feb 20 17:21:38 2020: Debug: eap: Peer sent packet with method EAP PEAP (25) (253) Thu Feb 20 17:21:38 2020: Debug: eap: Calling submodule eap_peap to process data (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Continuing EAP-TLS (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: [eaptls verify] = ok (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Done initial handshake (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: [eaptls process] = ok (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Session established. Decoding tunneled attributes (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: PEAP state WAITING FOR INNER IDENTITY (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Identity - host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Got inner identity 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Setting default EAP type for tunneled EAP session (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Got tunneled request (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: EAP-Message = 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Setting User-Name to host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Sending tunneled request to packetfence-tunnel (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: EAP-Message = 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: User-Name = "host/FV004665.kabi.ads.fresenius.com" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Framed-MTU = 1480 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-IP-Address = 192.168.xxx.yyy (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-Identifier = "SWAA-FV001234" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Service-Type = Framed-User (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Framed-Protocol = PPP (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-Port = 40 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-Port-Type = Ethernet (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-Port-Id = "40" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Calling-Station-Id := "10:65:30:aa:bb:cc" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Tunnel-Type:0 = VLAN (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Tunnel-Medium-Type:0 = IEEE-802 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Tunnel-Private-Group-Id:0 = "1136" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: MS-RAS-Vendor = 11 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b28 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b2e (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b30 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b3d (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b18 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b19 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x0138 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x013a (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x0140 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x0141 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x0151 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: PacketFence-KeyBalanced := "785ef37fa229298f465f6b3eee6eeb38" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: PacketFence-Radius-Ip := "10.211.120.158" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Called-Station-Id := "04:09:73:cc:dd:ee" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Event-Timestamp = "févr. 20 2020 17:21:38 CET" (253) Thu Feb 20 17:21:38 2020: Debug: Virtual server packetfence-tunnel received request (253) Thu Feb 20 17:21:38 2020: Debug: EAP-Message = 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d (253) Thu Feb 20 17:21:38 2020: Debug: FreeRADIUS-Proxied-To = 127.0.0.1 (253) Thu Feb 20 17:21:38 2020: Debug: User-Name = "host/FV004665.kabi.ads.fresenius.com" (253) Thu Feb 20 17:21:38 2020: Debug: Framed-MTU = 1480 (253) Thu Feb 20 17:21:38 2020: Debug: NAS-IP-Address = 192.168.xxx.yyy (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Identifier = "SWAA-FV001234" (253) Thu Feb 20 17:21:38 2020: Debug: Service-Type = Framed-User (253) Thu Feb 20 17:21:38 2020: Debug: Framed-Protocol = PPP (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port = 40 (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port-Type = Ethernet (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port-Id = "40" (253) Thu Feb 20 17:21:38 2020: Debug: Calling-Station-Id := "10:65:30:aa:bb:cc" (253) Thu Feb 20 17:21:38 2020: Debug: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Type:0 = VLAN (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Medium-Type:0 = IEEE-802 (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Private-Group-Id:0 = "1136" (253) Thu Feb 20 17:21:38 2020: Debug: MS-RAS-Vendor = 11 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b28 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b2e (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b30 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b3d (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b18 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b19 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0138 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x013a (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0140 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0141 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0151 (253) Thu Feb 20 17:21:38 2020: Debug: PacketFence-KeyBalanced := "785ef37fa229298f465f6b3eee6eeb38" (253) Thu Feb 20 17:21:38 2020: Debug: PacketFence-Radius-Ip := "10.211.120.158" (253) Thu Feb 20 17:21:38 2020: Debug: Called-Station-Id := "04:09:73:cc:dd:ee" (253) Thu Feb 20 17:21:38 2020: Debug: Event-Timestamp = "févr. 20 2020 17:21:38 CET" (253) Thu Feb 20 17:21:38 2020: WARNING: Outer and inner identities are the same. User privacy is compromised. (253) Thu Feb 20 17:21:38 2020: Debug: server packetfence-tunnel { (253) Thu Feb 20 17:21:38 2020: Debug: # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel (253) Thu Feb 20 17:21:38 2020: Debug: authorize { (253) Thu Feb 20 17:21:38 2020: Debug: if ( outer.EAP-Type == TTLS) { (253) Thu Feb 20 17:21:38 2020: Debug: if ( outer.EAP-Type == TTLS) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-realm-if-machine { (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) { (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) { (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{2} (253) Thu Feb 20 17:21:38 2020: Debug: --> kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-realm-if-machine = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-tenant-id { (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0"){ (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{%{control:PacketFence-Tenant-Id}:-0} (253) Thu Feb 20 17:21:38 2020: Debug: --> 0 (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: update control { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{User-Name} (253) Thu Feb 20 17:21:38 2020: Debug: --> host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: SQL-User-Name set to 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: Executing select query: SELECT IFNULL((SELECT tenant_id FROM radius_nas WHERE nasname = '192.168.xxx.yyy'), 0) (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{sql: SELECT IFNULL((SELECT tenant_id FROM radius_nas WHERE nasname = '%{NAS-IP-Address}'), 0)} (253) Thu Feb 20 17:21:38 2020: Debug: --> 1 (253) Thu Feb 20 17:21:38 2020: Debug: } # update control = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") = noop (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) { (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-tenant-id = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy filter_username { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ / /) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ / /) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /@[^@]*@/ ) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /@[^@]*@/ ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.\./ ) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.\./ ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (253) Thu Feb 20 17:21:38 2020: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.$/) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.$/) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /(a)\./) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /(a)\./) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # if (&User-Name) = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # policy filter_username = noop (253) Thu Feb 20 17:21:38 2020: Debug: [mschap] = noop (253) Thu Feb 20 17:21:38 2020: Debug: suffix: Request already has destination realm set. Ignoring (253) Thu Feb 20 17:21:38 2020: Debug: [suffix] = noop (253) Thu Feb 20 17:21:38 2020: Debug: ntdomain: Request already has destination realm set. Ignoring (253) Thu Feb 20 17:21:38 2020: Debug: [ntdomain] = noop (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '192.168.xxx.yyy' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '40' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Framed-MTU'} = &request:Framed-MTU -> '1480' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Called-Station-Id'} = &request:Called-Station-Id -> '04:09:73:cc:dd:ee' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '10:65:30:aa:bb:cc' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'SWAA-FV001234' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Tunnel-Type'} = &request:Tunnel-Type -> 'VLAN' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Tunnel-Medium-Type'} = &request:Tunnel-Medium-Type -> 'IEEE-802' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Tunnel-Private-Group-Id'} = &request:Tunnel-Private-Group-Id -> '1136' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'févr. 20 2020 17:21:38 CET' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Connect-Info'} = &request:Connect-Info -> 'CONNECT Ethernet 100Mbps Full duplex' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'EAP-Message'} = &request:EAP-Message -> '0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> '40' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'FreeRADIUS-Proxied-To'} = &request:FreeRADIUS-Proxied-To -> '127.0.0.1' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[0] = &request:HP-Capability-Advert -> '0x011a0000000b28' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[1] = &request:HP-Capability-Advert -> '0x011a0000000b2e' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[2] = &request:HP-Capability-Advert -> '0x011a0000000b30' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[3] = &request:HP-Capability-Advert -> '0x011a0000000b3d' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[4] = &request:HP-Capability-Advert -> '0x011a0000000b18' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[5] = &request:HP-Capability-Advert -> '0x011a0000000b19' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[6] = &request:HP-Capability-Advert -> '0x0138' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[7] = &request:HP-Capability-Advert -> '0x013a' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[8] = &request:HP-Capability-Advert -> '0x0140' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[9] = &request:HP-Capability-Advert -> '0x0141' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[10] = &request:HP-Capability-Advert -> '0x0151' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'MS-RAS-Vendor'} = &request:MS-RAS-Vendor -> '11' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Realm'} = &request:Realm -> 'kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'SQL-User-Name'} = &request:SQL-User-Name -> 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'PacketFence-KeyBalanced'} = &request:PacketFence-KeyBalanced -> '785ef37fa229298f465f6b3eee6eeb38' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'PacketFence-Radius-Ip'} = &request:PacketFence-Radius-Ip -> '10.211.120.158' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_CHECK{'EAP-Type'} = &control:EAP-Type -> 'MSCHAPv2' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_CHECK{'PacketFence-Tenant-Id'} = &control:PacketFence-Tenant-Id -> '1' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_CONFIG{'EAP-Type'} = &control:EAP-Type -> 'MSCHAPv2' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_CONFIG{'PacketFence-Tenant-Id'} = &control:PacketFence-Tenant-Id -> '1' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: perl_embed:: module = /usr/local/pf/raddb/mods-config/perl/packetfence-multi-domain.pm , func = authorize exit status= hash- or arrayref expected (not a simple scalar, use allow_nonref to allow this) at /usr/local/pf/lib/pfconfig/cached.pm line 182. (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '40' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Tunnel-Medium-Type:0 = $RAD_REQUEST{'Tunnel-Medium-Type:0'} -> 'IEEE-802' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '192.168.xxx.yyy' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Connect-Info = $RAD_REQUEST{'Connect-Info'} -> 'CONNECT Ethernet 100Mbps Full duplex' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Framed-MTU = $RAD_REQUEST{'Framed-MTU'} -> '1480' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '10:65:30:aa:bb:cc' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Tunnel-Private-Group-Id:0 = $RAD_REQUEST{'Tunnel-Private-Group-Id:0'} -> '1136' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:PacketFence-KeyBalanced = $RAD_REQUEST{'PacketFence-KeyBalanced'} -> '785ef37fa229298f465f6b3eee6eeb38' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Realm = $RAD_REQUEST{'Realm'} -> 'kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:SQL-User-Name = $RAD_REQUEST{'SQL-User-Name'} -> 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> '40' (253) Thu Feb 20 17:21:38 2020: ERROR: packetfence-multi-domain: Failed to create pair - failed to parse time string "févr. 20 2020 17:21:38 CET" (253) Thu Feb 20 17:21:38 2020: ERROR: packetfence-multi-domain: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'févr. 20 2020 17:21:38 CET' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Called-Station-Id = $RAD_REQUEST{'Called-Station-Id'} -> '04:09:73:cc:dd:ee' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:PacketFence-Radius-Ip = $RAD_REQUEST{'PacketFence-Radius-Ip'} -> '10.211.120.158' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'SWAA-FV001234' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:MS-RAS-Vendor = $RAD_REQUEST{'MS-RAS-Vendor'} -> '11' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Tunnel-Type:0 = $RAD_REQUEST{'Tunnel-Type:0'} -> 'VLAN' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:FreeRADIUS-Proxied-To = $RAD_REQUEST{'FreeRADIUS-Proxied-To'} -> '127.0.0.1' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} -> '0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b28' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b2e' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b30' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b3d' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b18' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b19' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x0138' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x013a' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x0140' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x0141' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x0151' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &control:EAP-Type = $RAD_CHECK{'EAP-Type'} -> 'MSCHAPv2' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &control:PacketFence-Tenant-Id = $RAD_CHECK{'PacketFence-Tenant-Id'} -> '1' (253) Thu Feb 20 17:21:38 2020: Debug: [packetfence-multi-domain] = fail (253) Thu Feb 20 17:21:38 2020: Debug: } # authorize = fail (253) Thu Feb 20 17:21:38 2020: Debug: Using Post-Auth-Type Reject (253) Thu Feb 20 17:21:38 2020: Debug: # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel (253) Thu Feb 20 17:21:38 2020: Debug: Post-Auth-Type REJECT { (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-tenant-id { (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0"){ (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{%{control:PacketFence-Tenant-Id}:-0} (253) Thu Feb 20 17:21:38 2020: Debug: --> 1 (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) { (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-tenant-id = noop (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-audit-log-reject { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name && (&User-Name == "dummy")) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name && (&User-Name == "dummy")) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: else { (253) Thu Feb 20 17:21:38 2020: Debug: policy request-timing { (253) Thu Feb 20 17:21:38 2020: Debug: if ("%{%{control:PacketFence-Request-Time}:-0}" != 0) { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{%{control:PacketFence-Request-Time}:-0} (253) Thu Feb 20 17:21:38 2020: Debug: --> 0 (253) Thu Feb 20 17:21:38 2020: Debug: if ("%{%{control:PacketFence-Request-Time}:-0}" != 0) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy request-timing = noop (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: EXPAND type.reject.query (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: --> type.reject.query (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: Using query template 'query' (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: EXPAND %{User-Name} (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: --> host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: SQL-User-Name set to 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: EXPAND INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time, tenant_id, radius_ip) VALUES ( '%{request:Calling-Station-Id}', '%{request:Framed-IP-Address}', '%{%{control:PacketFence-Computer-Name}:-N/A}', '%{request:User-Name}', '%{request:Stripped-User-Name}', '%{request:Realm}', 'Radius-Access-Request', '%{%{control:PacketFence-Switch-Id}:-N/A}', '%{%{control:PacketFence-Switch-Mac}:-N/A}', '%{%{control:PacketFence-Switch-Ip-Address}:-N/A}', '%{Packet-Src-IP-Address}', '%{request:Called-Station-Id}', '%{request:Calling-Station-Id}', '%{request:NAS-Port-Type}', '%{request:Called-Station-SSID}', '%{request:NAS-Port-Id}', '%{%{control:PacketFence-IfIndex}:-N/A}', '%{request:NAS-Port}', '%{%{control:PacketFence-Connection-Type}:-N/A}', '%{request:NAS-IP-Address}', '%{request:NAS-Identifier}', 'Reject', '%{request:Module-Failure-Message}', '%{control:Auth-Type}', '%{request:EAP-Type}', '%{%{control:PacketFence-Role}:-N/A}', '%{%{control:PacketFence-Status}:-N/A}', '%{%{control:PacketFence-Profile}:-N/A}', '%{%{control:PacketFence-Source}:-N/A}', '%{%{control:PacketFence-AutoReg}:-0}', '%{%{control:PacketFence-IsPhone}:-0}', '%{request:PacketFence-Domain}', '', '%{pairs:&request:[*]}','%{pairs:&reply:[*]}', '%{%{control:PacketFence-Request-Time}:-N/A}', '%{control:PacketFence-Tenant-Id}', '%{request:PacketFence-Radius-Ip}') (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: --> INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time, tenant_id, radius_ip) VALUES ( '10:65:30:aa:bb:cc', '', 'N/A', 'host/FV004665.kabi.ads.fresenius.com', '', 'kabi.ads.fresenius.com', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '10.211.120.171', '04:09:73:cc:dd:ee', '10:65:30:aa:bb:cc', 'Ethernet', '', '40', 'N/A', '40', 'N/A', '192.168.xxx.yyy', 'SWAA-FV001234', 'Reject', '', '', '', 'N/A', 'N/A', 'N/A', 'N/A', '0', '0', '', '', 'NAS-Port =3D 40=2C Tunnel-Medium-Type:0 =3D IEEE-802=2C NAS-IP-Address =3D 192.168.xxx.yyy=2C Connect-Info =3D =22CONNECT Ethernet 100Mbps Full duplex=22=2C Framed-MTU =3D 1480=2C Calling-Station-Id =3D =2210:65:30:aa:bb:cc=22=2C NAS-Port-Type =3D Ethernet=2C Tunnel-Private-Group-Id:0 =3D =221136=22=2C PacketFence-KeyBalanced =3D =22785ef37fa229298f465f6b3eee6eeb38=22=2C Realm =3D =22kabi.ads.fresenius.com=22=2C User-Name =3D =22host/FV004665.kabi.ads.fresenius.com=22=2C Framed-Protocol =3D PPP=2C NAS-Port-Id =3D =2240=22=2C Event-Timestamp =3D =22janv. 1 1970 01:00:00 CET=22=2C Called-Station-Id =3D =2204:09:73:cc:dd:ee=22=2C PacketFence-Radius-Ip =3D =2210.211.120.158=22=2C NAS-Identifier =3D =22SWAA-FV001234=22=2C MS-RAS-Vendor =3D 11=2C Tunnel-Type:0 =3D VLAN=2C FreeRADIUS-Proxied-To =3D 127.0.0.1=2C EAP-Message =3D 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d=2C HP-Capability-Advert =3D 0x011a0000000b28=2C HP-Capability-Advert =3D 0x011a0000000b2e=2C HP-Capability-Advert =3D 0x011a0000000b30=2C HP-Capability-Advert =3D 0x011a0000000b3d=2C HP-Capability-Advert =3D 0x011a0000000b18=2C HP-Capability-Advert =3D 0x011a0000000b19=2C HP-Capability-Advert =3D 0x0138=2C HP-Capability-Advert =3D 0x013a=2C HP-Capability-Advert =3D 0x0140=2C HP-Capability-Advert =3D 0x0141=2C HP-Capability-Advert =3D 0x0151=2C Service-Type =3D Framed-User=2C User-Password =3D =22=2A=2A=2A=2A=2A=2A=22=2C SQL-User-Name =3D =22host/FV004665.kabi.ads.fresenius.com=22','', 'N/A', '1', '10.211.120.158') (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: Executing query: INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time, tenant_id, radius_ip) VALUES ( '10:65:30:aa:bb:cc', '', 'N/A', 'host/FV004665.kabi.ads.fresenius.com', '', 'kabi.ads.fresenius.com', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '10.211.120.171', '04:09:73:cc:dd:ee', '10:65:30:aa:bb:cc', 'Ethernet', '', '40', 'N/A', '40', 'N/A', '192.168.xxx.yyy', 'SWAA-FV001234', 'Reject', '', '', '', 'N/A', 'N/A', 'N/A', 'N/A', '0', '0', '', '', 'NAS-Port =3D 40=2C Tunnel-Medium-Type:0 =3D IEEE-802=2C NAS-IP-Address =3D 192.168.xxx.yyy=2C Connect-Info =3D =22CONNECT Ethernet 100Mbps Full duplex=22=2C Framed-MTU =3D 1480=2C Calling-Station-Id =3D =2210:65:30:aa:bb:cc=22=2C NAS-Port-Type =3D Ethernet=2C Tunnel-Private-Group-Id:0 =3D =221136=22=2C PacketFence-KeyBalanced =3D =22785ef37fa229298f465f6b3eee6eeb38=22=2C Realm =3D =22kabi.ads.fresenius.com=22=2C User-Name =3D =22host/FV004665.kabi.ads.fresenius.com=22=2C Framed-Protocol =3D PPP=2C NAS-Port-Id =3D =2240=22=2C Event-Timestamp =3D =22janv. 1 1970 01:00:00 CET=22=2C Called-Station-Id =3D =2204:09:73:cc:dd:ee=22=2C PacketFence-Radius-Ip =3D =2210.211.120.158=22=2C NAS-Identifier =3D =22SWAA-FV001234=22=2C MS-RAS-Vendor =3D 11=2C Tunnel-Type:0 =3D VLAN=2C FreeRADIUS-Proxied-To =3D 127.0.0.1=2C EAP-Message =3D 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d=2C HP-Capability-Advert =3D 0x011a0000000b28=2C HP-Capability-Advert =3D 0x011a0000000b2e=2C HP-Capability-Advert =3D 0x011a0000000b30=2C HP-Capability-Advert =3D 0x011a0000000b3d=2C HP-Capability-Advert =3D 0x011a0000000b18=2C HP-Capability-Advert =3D 0x011a0000000b19=2C HP-Capability-Advert =3D 0x0138=2C HP-Capability-Advert =3D 0x013a=2C HP-Capability-Advert =3D 0x0140=2C HP-Capability-Advert =3D 0x0141=2C HP-Capability-Advert =3D 0x0151=2C Service-Type =3D Framed-User=2C User-Password =3D =22=2A=2A=2A=2A=2A=2A=22=2C SQL-User-Name =3D =22host/FV004665.kabi.ads.fresenius.com=22','', 'N/A', '1', '10.211.120.158') (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: SQL query returned: success (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: 1 record(s) updated (253) Thu Feb 20 17:21:38 2020: Debug: [sql_reject] = ok (253) Thu Feb 20 17:21:38 2020: Debug: } # else = ok (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-audit-log-reject = ok (253) Thu Feb 20 17:21:38 2020: Debug: attr_filter.access_reject: EXPAND %{User-Name} (253) Thu Feb 20 17:21:38 2020: Debug: attr_filter.access_reject: --> host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: attr_filter.access_reject: Matched entry DEFAULT at line 11 (253) Thu Feb 20 17:21:38 2020: Debug: [attr_filter.access_reject] = updated (253) Thu Feb 20 17:21:38 2020: Debug: update outer.session-state { (253) Thu Feb 20 17:21:38 2020: Debug: No attributes updated for RHS &request:Module-Failure-Message (253) Thu Feb 20 17:21:38 2020: Debug: } # update outer.session-state = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # Post-Auth-Type REJECT = updated (253) Thu Feb 20 17:21:38 2020: Debug: } # server packetfence-tunnel (253) Thu Feb 20 17:21:38 2020: Debug: Virtual server sending reply (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Got tunneled reply code 3 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Tunneled authentication was rejected (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: FAILURE (253) Thu Feb 20 17:21:38 2020: Debug: eap: Sending EAP Request (code 1) ID 9 length 46 (253) Thu Feb 20 17:21:38 2020: Debug: eap: EAP session adding &reply:State = 0xfa22c4bafc2bdd06 (253) Thu Feb 20 17:21:38 2020: Debug: [eap] = handled (253) Thu Feb 20 17:21:38 2020: Debug: } # authenticate = handled (253) Thu Feb 20 17:21:38 2020: Debug: Using Post-Auth-Type Challenge (253) Thu Feb 20 17:21:38 2020: Debug: Post-Auth-Type sub-section not found. Ignoring. (253) Thu Feb 20 17:21:38 2020: Debug: # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence (253) Thu Feb 20 17:21:38 2020: Debug: session-state: Saving cached attributes (253) Thu Feb 20 17:21:38 2020: Debug: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (253) Thu Feb 20 17:21:38 2020: Debug: TLS-Session-Version = "TLS 1.2" (253) Thu Feb 20 17:21:38 2020: Debug: Sent Access-Challenge Id 170 from 10.211.120.158:1812 to 10.211.120.171:49563 length 0 (253) Thu Feb 20 17:21:38 2020: Debug: EAP-Message = 0x0109002e190017030300234e17d2e7d99c021227e423d81418fe42c210ab655c8f76b79125105cc4f39aa16ae0fd (253) Thu Feb 20 17:21:38 2020: Debug: Message-Authenticator = 0x00000000000000000000000000000000 (253) Thu Feb 20 17:21:38 2020: Debug: State = 0xfa22c4bafc2bdd06e61b85de3ed7b62c (253) Thu Feb 20 17:21:38 2020: Debug: Proxy-State = 0x313237 (253) Thu Feb 20 17:21:38 2020: Debug: Finished request Thank you Franck R

2 2

OpenDirectory Authentication fails with eap but works with pap
by Ashley Drees 24 Feb '20

24 Feb '20

I have recently had to migrate my FreeRADIUS from one sick OpenDirectory server to a "fresh" one. FreeRadius was hard crashing whenever it got an eap authentication request on the "sick" server, on the newly promoted server it runs without crashing. the config checks out with XC and running as X works as expected. when I use (from a remote machine) radtest -x -t pap radiustest 2020Password 192.168.9.23 0 testing123 I get Received Access-Accept Id 139 from 192.168.9.23:1812 to 0.0.0.0:0 length 20 from the debug:- suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "radiustest", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) [files] = noop (3) opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. (3) opendirectory: The host 192.168.9.9 does not have an access group. (3) opendirectory: no access control groups, all users allowed (3) opendirectory: Setting Auth-Type = opendirectory (3) [opendirectory] = ok (3) [expiration] = noop (3) [logintime] = noop Not doing PAP as Auth-Type is already set. (3) [pap] = noop (3) } # authorize = ok so with pap it seems to talk to OD nicely.. however... if i try and authenticate with the same id trying to auth for WiFI (unifi access points) i get a fail and the offending stanza in the debug is (11) eap_mschapv2: authenticate { (11) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (11) mschap: No NT-Password configured. Trying OpenDirectory Authentication (11) mschap: OD username_string = radiustest, OD shortUserName= (length = 0) (11) mschap: Stepbuf server challenge : 7972ffffffca6a52ffffffeb695bffffff87fffffffd46ffffffa4ffffffef18ffffffc9ffffffa0 (11) mschap: Stepbuf peer challenge : 37ffffffa043ffffffcdffffffe62503fffffffeffffffdf6f5cffffffd849ffffffb4ffffff8dffffffd2 (11) mschap: Stepbuf p24 : ffffffcdffffffc2ffffffd727472866ffffffd0fffffffe2fffffffa8263e5bffffffc150ffffff997fffffff90ffffffbbffffffb13dffffffeeffffff86 (11) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError I am a bit stuck with this, I am unsure why pap it works and it fails with eap. I did not fill this post with random logs, but if you have any ideas I can capture logs/configs etc as needed. Thanks in advance. I did have this working on the previous OD master, but a security update seemed to stop it working hence my migration efforts, I have followed the same "migration" document from Apple, but to be honest, after several days messing around I am just about ready to run up a VM and put FreeNAS into an Ubuntu box (if only I could be sure it would get its auth from OD) Ash -- -- ****Conciliation Resources | ****www.c-r.org <http://www.c-r.org/> **********Burghley Yard, 106 Burghley Road, London NW5 1AL UK *Why does inclusion matter for peace? Download our Accord <https://www.c-r.org/accord/inclusion-peace-processes> and explore our infographic <https://www.c-r.org/news-and-views/news/infographic-inclusion-why-does-it-m…> to find out.* Sign up <http://www.c-r.org/newsletter/subscribe> to our e-newsletter. See our latest updates on Twitter @CRbuildpeace <https://twitter.com/crbuildpeace> and _Facebook <https://www.facebook.com/ConciliationResources>*.*_ ***Charity registered in England and Wales (1055436). Company limited by guarantee registered in England and Wales (03196482) *** -- ***** **********This email is intended only for the named addressee(s) and may contain confidential and/or privileged material. If you have received this email in error, please notify Conciliation Resources immediately by emailing cr(a)c-r.org <mailto:cr@c-r.org> and delete the message. * * * *** ** ******* * *

2 1

Freeradius and unexpected TLS version ->Access-Reject
by iilinasi 24 Feb '20

24 Feb '20

Hello everyone! I have a weird issue with freeradius 3.0.16. I try to implement an auth exchange with the RADIUS, requesting EAP-TLS. At this moment I only need to get to the phase when server responds with Access-Challenge with server certificate (so, 2 packets from NAD and 2 from the server). To generate NAD-side packets I use python3 with scapy. Freeradius was set up to use EAP-TLS for test user auth. First access-request from the NAD side is responded with Access-Challenge from the server. So far so good. But when I send the second packet, I receive an Access-Reject. Suprisingly, the server reports I'm using unsupported TLS version ?0304?. Why "surprizingly"? Well, because I use earlier TLS version, and it is well visible even in server debugs (if you check "eap message" part, where is "0301"). I also checked in Wireshark (captured both on the server machine and "NAD" machine) - the packet is correctly dissected by latest wireshark and has TLS1.1 inside. Caching is disabled. OpenSSL is already at the newest version (1.1.1-1ubuntu2.1~18.04.5). I tried to rebuild my VM from scratch (so again, installed Ubuntu 18, freeradius 3.0.16, etc) - but the issue persists. Here is the debug: Ready to process requests (0) Received Access-Request Id 200 from 192.168.0.14:53256 to 192.168.0.59:1812 length 67 (0) Service-Type = Framed-User (0) User-Name = "test" (0) Framed-MTU = 1500 (0) EAP-Message = 0x020500090174657374 (0) Message-Authenticator = 0xefe697c97fd0118935d39e9a25d6baff (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]@/ ) { (0) if (&User-Name =~ /@[^@]@/ ) -> FALSE (0) if (&User-Name =~ /../ ) { (0) if (&User-Name =~ /../ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) -> FALSE (0) if (&User-Name =~ /.$/) { (0) if (&User-Name =~ /.$/) -> FALSE (0) if (&User-Name =~ /@./) { (0) if (&User-Name =~ /@./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Feb 14 15:03:01 2020 (0) [auth_log] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "test", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 5 length 9 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_tls to process data (0) eap_tls: Initiating new EAP-TLS session (0) eap_tls: Setting verify mode to require certificate from client (0) eap_tls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 6 length 6 (0) eap: EAP session adding &reply:State = 0xe879495de87f44cf (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 200 from 192.168.0.59:1812 to 192.168.0.14:53256 length 0 (0) EAP-Message = 0x010600060d20 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xe879495de87f44cfa950f055cfc4b84d (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 201 from 192.168.0.14:53256 to 192.168.0.59:1812 length 163 (1) Service-Type = Framed-User (1) User-Name = "test" (1) Framed-MTU = 1500 (1) EAP-Message = 0x020600570d800000004d16030100480100004403015e43c51b0000000000000000000000000000000000000000000000000000000000001600040005000a0009006400620003000600130012006301000005ff01000100 (1) State = 0xe879495de87f44cfa950f055cfc4b84d (1) Message-Authenticator = 0x70eca9c059289b575655c08683064d67 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]@/ ) { (1) if (&User-Name =~ /@[^@]@/ ) -> FALSE (1) if (&User-Name =~ /../ ) { (1) if (&User-Name =~ /../ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) -> FALSE (1) if (&User-Name =~ /.$/) { (1) if (&User-Name =~ /.$/) -> FALSE (1) if (&User-Name =~ /@./) { (1) if (&User-Name =~ /@./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (1) auth_log: --> /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (1) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (1) auth_log: EXPAND %t (1) auth_log: --> Fri Feb 14 15:03:01 2020 (1) [auth_log] = ok (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 6 length 87 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xe879495de87f44cf (1) eap: Finished EAP session with state 0xe879495de87f44cf (1) eap: Previous EAP request found for state 0xe879495de87f44cf, released from the list (1) eap: Peer sent packet with method EAP TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: Continuing EAP-TLS (1) eap_tls: Peer indicated complete TLS record size will be 77 bytes (1) eap_tls: Got complete TLS record (77 bytes) (1) eap_tls: [eaptls verify] = length included (1) eap_tls: (other): before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: <<< recv UNKNOWN TLS VERSION ?0304? [length 0048] (1) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal handshake_failure (1) eap_tls: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error (1) eap_tls: ERROR: Failed in FUNCTION (SSL_read): error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (1) eap_tls: ERROR: System call (I/O) error (-1) (1) eap_tls: ERROR: TLS receive handshake failed during operation (1) eap_tls: ERROR: [eaptls process] = fail (1) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (1) eap: Sending EAP Failure (code 4) ID 6 length 4 (1) eap: Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject What could be wrong here? Where should I debug further? Thanks a ton in advance for any hints! Cheers, Iron

3 6

Username case insensitivity
by Luveh Keraph 23 Feb '20

23 Feb '20

> On Feb 21, 2020, at 5:48 PM, Luveh Keraph <1.41421 at gmail.com> wrote: >> >> I would like for my FreeRADIUS 3.0.20 server to match user names to be >> authenticated in a case-insensitive way. > You want it to match *all* names in a case insensitive way? All user names that the FreeRADIUS receives for authentication. The password should remain case-sensitive. >> To that effect, I changed the >> contents of /etc/raddb/mods-enabled/sradutmp as follows: >> >> radutmp sradutmp { >> filename = ${logdir}/sradutmp >> case_sensitive = "no" > > No... that changes the case insensitivity of the *radutmp* module. The comments in the module > make this clear. OK, thanks. >> When I launch the FreeRADIUS server with -sfXx in the resulting traces I >> can see that the module above has been loaded, and that the case_sensitive >> attribute is indeed set to "no". However, the FreeRADIUS server remains >> user name case-sensitive. What am I misunderstanding here? > > You're seeing the server run modules which *aren't* radump, and which *don't* take any > "case_sensitive" parameter. I'm not sure why editing the "radutmp" module would make the > "files" or "pap" module be case insensitive. OK. > In FreeRADIUS, user name lookups are generally done via databases. If you want the lookups > to be case insensitive, then change the database queries > > So... which database are you using to look up user names / passwords? I am just using the basic capabilities provided by FreeRADIUS - entries in /etc/raddb/users. The user name and password information is retrieved from that file. I tried adding a policy for this in /etc/raddb/policy.d, but I couldn't get that to work either.

2 2

Create New Session Based On Accounting Update
by One Zero Art 23 Feb '20

23 Feb '20

Hi, I am trying to create a new session and insert it into radacct table based on an accounting request from NAS. When NAS sends Interim Update I want to check if that user already in radacct table and null or not null. If not null then create a new session and make that user online in freeradius. I am not sure if it's possible or even the right thing to do. Want to do that because sometimes user online in NAS but offline in freeradius. Thank you

2 3

User name case insensitivity
by Luveh Keraph 21 Feb '20

21 Feb '20

I would like for my FreeRADIUS 3.0.20 server to match user names to be authenticated in a case-insensitive way. To that effect, I changed the contents of /etc/raddb/mods-enabled/sradutmp as follows: radutmp sradutmp { filename = ${logdir}/sradutmp case_sensitive = "no" permissions = 0644 caller_id = "no" } When I launch the FreeRADIUS server with -sfXx in the resulting traces I can see that the module above has been loaded, and that the case_sensitive attribute is indeed set to "no". However, the FreeRADIUS server remains user name case-sensitive. What am I misunderstanding here?

3 2