- Freeradius-Users - lists.freeradius.org

again .. mac based auth + user/password for pppoe
by S Adrian 23 Feb '12

23 Feb '12

Hey again, I've searched the list for my old conversation here but couldn't find it .. still.. here it goes... I have rp-pppoe started in kernel mode ( the calling-station-id gets sent as I can see it ) You'll notice that even though I added in radcheck Calling-Station-Id to be 11:22:33:44:55:66, trying with radclient got me accepted ( even though I specified 11:22:33:44:55:77 ) The idea is that I want to also do a mac check ( if the Calling-Station-Id is present in sql ..) I don't want to bind the username/password combination to the mac address for all the users PPPoE ~ # cat dexter | radclient -x 127.0.0.1 auth r4d1usP4ssw0rd Sending Access-Request of id 61 to 127.0.0.1 port 1812 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "dexter" User-Password = "250896" Calling-Station-Id = "11:22:33:44:55:77" NAS-IP-Address = 127.0.0.1 NAS-Port = 242 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=61, length=50 Framed-Protocol = PPP Service-Type = Framed-User Framed-Compression = Van-Jacobson-TCP-IP Framed-MTU = 1500 Framed-IP-Address = 10.10.0.82 mysql> select * from radcheck WHERE `username` = 'dexter'; +------+----------+--------------------+----+-------------------+ | id | username | attribute | op | value | +------+----------+--------------------+----+-------------------+ | 2298 | dexter | Cleartext-Password | := | 250896 | | 2299 | dexter | Simultaneous-Use | := | 1 | | 2300 | dexter | Pool-Name | := | main | | 2301 | dexter | Calling-Station-Id | := | 11:22:33:44:55:66 | +------+----------+--------------------+----+-------------------+ 4 rows in set (0.01 sec) mysql> select * from radreply WHERE `username` = 'dexter'; +------+----------+--------------------+----+---------------------+ | id | username | attribute | op | value | +------+----------+--------------------+----+---------------------+ | 4461 | dexter | Framed-MTU | := | 1500 | | 4459 | dexter | Service-Type | := | Framed-User | | 4458 | dexter | Framed-Protocol | := | PPP | | 4460 | dexter | Framed-Compression | := | Van-Jacobsen-TCP-IP | +------+----------+--------------------+----+---------------------+ radiusd -X reports this: rad_recv: Access-Request packet from host 127.0.0.1 port 52468, id=61, length=89 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "dexter" User-Password = "250896" Calling-Station-Id = "11:22:33:44:55:77" NAS-IP-Address = 127.0.0.1 NAS-Port = 242 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20120222 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20120222 [auth_log] expand: %t -> Wed Feb 22 22:36:07 2012 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [sql] expand: %{User-Name} -> dexter [sql] sql_set_user escaped user --> 'dexter' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dexter' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dexter' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'dexter' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY id [sql] User found in group dynamic [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. +- entering group session {...} [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> dexter ++[radutmp] returns ok Login OK: [dexter/250896] (from client localhost port 242 cli 11:22:33:44:55:77) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/reply-detail-20120222 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/reply-detail-20120222 [reply_log] expand: %t -> Wed Feb 22 22:36:07 2012 ++[reply_log] returns ok [sql] expand: %{User-Name} -> dexter [sql] sql_set_user escaped user --> 'dexter' [sql] expand: %{User-Password} -> 250896 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'dexter', '250896', 'Access-Accept', '2012-02-22 22:36:07') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'dexter', '250896', 'Access-Accept', '2012-02-22 22:36:07') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> dexter [sql_log] expand: %{%{User-Name}:-DEFAULT} -> dexter [sql_log] sql_set_user escaped user --> 'dexter' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('dexter', '250896', 'Access-Accept', '2012-02-22 22:36:07'); [sql_log] expand: /var/log/radius/radacct/sql-relay -> /var/log/radius/radacct/sql-relay ++[sql_log] returns ok rlm_sql (sql): Reserving sql socket id: 0 [sqlippool] expand: %{User-Name} -> dexter [sqlippool] sql_set_user escaped user --> 'dexter' [sqlippool] expand: START TRANSACTION -> START TRANSACTION [sqlippool] expand: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}' -> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '127.0.0.1' [sqlippool] expand: SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE -> SELECT framedipaddress FROM radippool WHERE pool_name = 'main' AND expiry_time IS NULL ORDER BY RAND() LIMIT 1 FOR UPDATE [sqlippool] expand: UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 604800 SECOND WHERE framedipaddress = '10.10.0.82' AND expiry_time IS NULL -> UPDATE radippool SET nasipaddress = '127.0.0.1', pool_key = '242', callingstationid = '11:22:33:44:55:77', username = 'dexter', expiry_time = NOW() + INTERVAL 604800 SECOND WHERE framedipaddress = '10.10.0.82' AND expiry_time IS NULL [sqlippool] Allocated IP 10.10.0.82 [780fe5bc] [sqlippool] expand: COMMIT -> COMMIT rlm_sql (sql): Released sql socket id: 0 [sqlippool] expand: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> Allocated IP: 10.10.0.82 from main (did cli 11:22:33:44:55:77 port 242 user dexter) Allocated IP: 10.10.0.82 from main (did cli 11:22:33:44:55:77 port 242 user dexter) ++[sqlippool] returns ok Sending Access-Accept of id 61 to 127.0.0.1 port 52468 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Framed-IP-Address = 10.10.0.82 Finished request 3.

3 4

Intermediate root CA issue
by John Dunning 23 Feb '12

23 Feb '12

Greetings all, We're trying to get a GlobalSign issued wildcard CA to work on our radius server that is authenticating users via PEAP/MSCHAPv2 to Active Directory. We're good on Android devices and iOS devices. With Windows 7 (SP1) we're fine as long as we leave "validate server certificate" unchecked. As soon as we enable that check, authentication fails and we get the radius log entries listed below. I've pointed a web browser to an Apache server running the same certificate chain (server cert, intermediate GlobalSign cert, GlobalSign Root CA) and have verified that the cert does provide the Server Authentication (1.3.6.1.5.5.7.3.1) Extended Key usage. The cert listed in the "certificate_file" entry in /etc/freeradius/eap.conf contains, is the catted contents of the wildcart cert, the intermediate cert, and the root CA (which, in theory, since Windows 7 includes this shouldn't be needed?), all in one file. Any advice would be thoroughly appreciated. John Dunning FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/iodbc/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 10.47.249.248/32 { require_message_authenticator = no secret = "foobar21" shortname = "testap" } client 10.45.17.117 { require_message_authenticator = no secret = "foobar21" shortname = "test3560" } client 10.45.0.11 { require_message_authenticator = no secret = "foobar21" shortname = "4404" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" private_key_password = "obfuscated" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Instantiating module "ntlm_auth" from file /etc/freeradius/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=AD --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Loading virtual module rewrite_calling_station_id Module: Linked to module rlm_always Module: Instantiating module "noop" from file /etc/freeradius/modules/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Loading virtual module rewrite_called_station_id Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_iodbc" server = "DSN=WSC_freeRadius;UID=freeradius;PWD=kradadius" port = "" login = "freeradius" password = "kradadius" radius_db = "WSC_freeRadius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = %{Acct-Delay-Time:-0} WHERE AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" accounting_update_query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime = 0" accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" accounting_stop_query = "UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" accounting_stop_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY prio" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_iodbc (module rlm_sql_iodbc) loaded and linked rlm_sql (sql): Attempting to connect to freeradius@DSN=WSC_freeRadius;UID=freeradius;PWD=kradadius:/WSC_freeRadius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_iodbc #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_iodbc #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_iodbc #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_iodbc #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_iodbc #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.45.0.11 port 32768, id=159, length=238 User-Name = "AD\\jodunni1" Calling-Station-Id = "08-11-96-61-da-d0" Called-Station-Id = "00-17-95-81-b9-10:wsc-secure_test" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a2d000b0005db144f43eed3" NAS-IP-Address = 10.45.0.11 NAS-Identifier = "Fornax" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "30" EAP-Message = 0x020200100141445c6a6f64756e6e6931 Message-Authenticator = 0xb5b4e24acc77647b93eca313fef171fe # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 08119661dad0 ++++[request] returns ok +++- if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 0: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok ++- entering policy rewrite_called_station_id {...} +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 00179581b910 ++++[request] returns ok +++- if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 0: Preceding "if" was taken ++- policy rewrite_called_station_id returns ok ++? if (( Service-Type == 'Login-User') ) ?? Evaluating (Service-Type == 'Login-User') -> FALSE ++? if (( Service-Type == 'Login-User') ) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^08119661dad0$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> FALSE [sql] expand: %{User-Name} -> AD\jodunni1 [sql] sql_set_user escaped user --> 'AD\jodunni1' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'AD=5Cjodunni1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY prio -> SELECT groupname FROM radusergroup WHERE username = 'AD=5Cjodunni1' ORDER BY prio rlm_sql (sql): Released sql socket id: 4 [sql] User AD\jodunni1 not found ++[sql] returns notfound ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AD\jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 159 to 10.45.0.11 port 32768 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa5680b71a56b1263d1432556cadaa121 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.45.0.11 port 32768, id=160, length=345 User-Name = "AD\\jodunni1" Calling-Station-Id = "08-11-96-61-da-d0" Called-Station-Id = "00-17-95-81-b9-10:wsc-secure_test" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a2d000b0005db144f43eed3" NAS-IP-Address = 10.45.0.11 NAS-Identifier = "Fornax" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "30" EAP-Message = 0x0203006919800000005f160301005a0100005603014f43eed30b2da32e8c5597fc6b686246c2ef314665e7526ad480606fe8a4b04b000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 State = 0xa5680b71a56b1263d1432556cadaa121 Message-Authenticator = 0x49a7057011b3c0776b937388653842a8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 08119661dad0 ++++[request] returns ok +++- if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 1: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok ++- entering policy rewrite_called_station_id {...} +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 00179581b910 ++++[request] returns ok +++- if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 1: Preceding "if" was taken ++- policy rewrite_called_station_id returns ok ++? if (( Service-Type == 'Login-User') ) ?? Evaluating (Service-Type == 'Login-User') -> FALSE ++? if (( Service-Type == 'Login-User') ) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^08119661dad0$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> FALSE [sql] expand: %{User-Name} -> AD\jodunni1 [sql] sql_set_user escaped user --> 'AD\jodunni1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'AD=5Cjodunni1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY prio -> SELECT groupname FROM radusergroup WHERE username = 'AD=5Cjodunni1' ORDER BY prio rlm_sql (sql): Released sql socket id: 3 [sql] User AD\jodunni1 not found ++[sql] returns notfound ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AD\jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0d0b], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 160 to 10.45.0.11 port 32768 EAP-Message = 0x0104040019c000000d4f16030100310200002d03014f43eed3a1b9429bf03076bf8735536c6785654814754760f6f33dd471a206ab00002f000005ff010001001603010d0b0b000d07000d0400051730820513308203fba003020102020b01000000000130656630b0300d06092a864886f70d0101050500306a31233021060355040b131a4f7267616e697a6174696f6e2056616c69646174696f6e20434131133011060355040a130a476c6f62616c5369676e312e302c06035504031325476c6f62616c5369676e204f7267616e697a6174696f6e2056616c69646174696f6e204341301e170d3131303630363133353334395a170d313230363036 EAP-Message = 0x3133353334345a30818c310b30090603550406130255533111300f060355040813084e65627261736b61310e300c060355040713055761796e6531283026060355040b131f4e6574776f726b20616e6420546563686e6f6c6f6779205365727669636573311c301a060355040a13135761796e6520537461746520436f6c6c65676531123010060355040314092a2e7773632e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100b2678ea3bb00fdbd2fcac8d7640fd4f5e57cb9b848eda7c37db12b2d1d390a2a6339a251aa69750256369e6a7e1774de9cb5649b84d2ba06dff20ac4db7cbce6d8c0bdb8aaf9 EAP-Message = 0xd0c1c0e319b72b18abb973ebcc03e48324dab19d65ffc99c2632eb06d619c3b19d22be865e2eb91ad351b9b55c1a48aa1fc4a352faa339d4d649ca9afa0196c1451ed96c2ff479a637ba07fb4189b377c4482fc395177b21d1b39a3b66f8470a03c655430d0292364ead846130a261a23b9a23fd0d3dfed56f08a1721d6f711393ee75072415e0acd64ba0736094ff9a6c182c78825755b59147bb1247c22ff8e41ade12fe4b8dc714701fbda6e2494e151d04583278ee598ebb0203010001a382019530820191301f0603551d230418301680147d6d2aec66aba75136ab0269f1708fc4590b9a1f304906082b06010505070101043d303b303906082b EAP-Message = 0x06010505073002862d687474703a2f2f7365637572652e676c6f62616c7369676e2e6e65742f6361636572742f6f726776312e637274303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f4f7267616e697a6174696f6e56616c312e63726c301d0603551d0e04160414f12fb562b98e659b2581b4f0ad5ac0c73f81e6a430090603551d1304023000300e0603551d0f0101ff0404030205a030290603551d250422302006082b0601050507030106082b06010505070302060a2b0601040182370a0303304b0603551d2004443042304006092b06010401a03201143033303106082b0601 EAP-Message = 0x05050702011625687474703a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa5680b71a46c1263d1432556cadaa121 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.45.0.11 port 32768, id=161, length=246 User-Name = "AD\\jodunni1" Calling-Station-Id = "08-11-96-61-da-d0" Called-Station-Id = "00-17-95-81-b9-10:wsc-secure_test" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a2d000b0005db144f43eed3" NAS-IP-Address = 10.45.0.11 NAS-Identifier = "Fornax" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "30" EAP-Message = 0x020400061900 State = 0xa5680b71a46c1263d1432556cadaa121 Message-Authenticator = 0x2ee644ddb4aabfabbc8117f47430b405 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 08119661dad0 ++++[request] returns ok +++- if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 2: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok ++- entering policy rewrite_called_station_id {...} +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 00179581b910 ++++[request] returns ok +++- if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 2: Preceding "if" was taken ++- policy rewrite_called_station_id returns ok ++? if (( Service-Type == 'Login-User') ) ?? Evaluating (Service-Type == 'Login-User') -> FALSE ++? if (( Service-Type == 'Login-User') ) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^08119661dad0$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> FALSE [sql] expand: %{User-Name} -> AD\jodunni1 [sql] sql_set_user escaped user --> 'AD\jodunni1' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'AD=5Cjodunni1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY prio -> SELECT groupname FROM radusergroup WHERE username = 'AD=5Cjodunni1' ORDER BY prio rlm_sql (sql): Released sql socket id: 2 [sql] User AD\jodunni1 not found ++[sql] returns notfound ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AD\jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 161 to 10.45.0.11 port 32768 EAP-Message = 0x010503fc19402f2f7777772e676c6f62616c7369676e2e6e65742f7265706f7369746f72792f301106096086480186f84201010404030206c0301d0603551d110416301482092a2e7773632e65647582077773632e656475300d06092a864886f70d010105050003820101001405a4d0de834cbaeb1431dcf4c2397e965540c397563772a4ea671f061a66de3f3f49f61d8bb65cdbda782ebd113d43c5ff9dcb89366fde3cb8073bf6deb70c469e160e1d18c52022de9bd2683c37006d408bb42a78250a4375e715e2235e4f3cd5d0cbc30219fee1448dfce77c644aff0f7c8a029c82e1933e63f189da79c7093e50213dd9b2ea77567a3d6655ed2259 EAP-Message = 0x2f3055dba50c3788ee5de3f244fe6be85e321717cebfdd97ad735115a6975543c1fbe710f563cfd4669fdd430f85bccb78994db093eebbabda0c4843e13900371b809be0a4ee232147fcdf86e5e65f60d947649613279ea6d150a7af0a7e05cf4c300a5a4ea4e842e627ee1b586e59000379308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930 EAP-Message = 0x313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639 EAP-Message = 0x386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2 EAP-Message = 0xbe34c52832b57cfc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa5680b71a76d1263d1432556cadaa121 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.45.0.11 port 32768, id=162, length=246 User-Name = "AD\\jodunni1" Calling-Station-Id = "08-11-96-61-da-d0" Called-Station-Id = "00-17-95-81-b9-10:wsc-secure_test" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a2d000b0005db144f43eed3" NAS-IP-Address = 10.45.0.11 NAS-Identifier = "Fornax" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "30" EAP-Message = 0x020500061900 State = 0xa5680b71a76d1263d1432556cadaa121 Message-Authenticator = 0x788dce74b76dd324ac9a8fa30d6d8190 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 08119661dad0 ++++[request] returns ok +++- if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 3: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok ++- entering policy rewrite_called_station_id {...} +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 00179581b910 ++++[request] returns ok +++- if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 3: Preceding "if" was taken ++- policy rewrite_called_station_id returns ok ++? if (( Service-Type == 'Login-User') ) ?? Evaluating (Service-Type == 'Login-User') -> FALSE ++? if (( Service-Type == 'Login-User') ) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^08119661dad0$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> FALSE [sql] expand: %{User-Name} -> AD\jodunni1 [sql] sql_set_user escaped user --> 'AD\jodunni1' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'AD=5Cjodunni1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY prio -> SELECT groupname FROM radusergroup WHERE username = 'AD=5Cjodunni1' ORDER BY prio rlm_sql (sql): Released sql socket id: 1 [sql] User AD\jodunni1 not found ++[sql] returns notfound ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AD\jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 162 to 10.45.0.11 port 32768 EAP-Message = 0x010603fc19406c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e000046b308204673082034f EAP-Message = 0xa003020102020b0400000000011e44a5f52a300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3037303431313132303030305a170d3137303431313132303030305a306a31233021060355040b131a4f7267616e697a6174696f6e2056616c69646174696f6e20434131133011060355040a130a476c6f62616c5369676e312e302c06035504031325476c6f62616c5369676e204f7267616e697a6174696f6e2056616c69 EAP-Message = 0x646174696f6e20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a12fc4bcce8703e967c189c8e593fc7db4ad9ef6634e6ae89c2c7389a201f48f21f8fd259d58166d86f6ee4957757e75ea22117e3dfbc74241dcfcc50c9155807beb64331d9bf9ca38e9abc62543512540f4e47e18556aa98f103a401ed65783ef7f2f342f2dd2f653c2190db7edc981f5462cb423425e9d130375ecea6afc577cc936973b98dc1313ecec41fa5d34eab993e7101665cc9c92fdf5c59d3e4ab909fce45f1e695f4df4567244b11d2303c836f66588c8bf3916458e1e266c5116c52a0038c5a41369957dab013ba8c414b480da EAP-Message = 0xac1a4420d5fea9067b1427afe03021dd90f4a9d523192e1e03e6c1df9529e4c19443dd3e90aacb4bc9be8ad3390203010001a382011f3082011b300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020100301d0603551d0e041604147d6d2aec66aba75136ab0269f1708fc4590b9a1f304b0603551d2004443042304006092b06010401a03201143033303106082b060105050702011625687474703a2f2f7777772e676c6f62616c7369676e2e6e65742f7265706f7369746f72792f30330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742e63 EAP-Message = 0x726c301106096086 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa5680b71a66e1263d1432556cadaa121 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.45.0.11 port 32768, id=163, length=246 User-Name = "AD\\jodunni1" Calling-Station-Id = "08-11-96-61-da-d0" Called-Station-Id = "00-17-95-81-b9-10:wsc-secure_test" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a2d000b0005db144f43eed3" NAS-IP-Address = 10.45.0.11 NAS-Identifier = "Fornax" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "30" EAP-Message = 0x020600061900 State = 0xa5680b71a66e1263d1432556cadaa121 Message-Authenticator = 0x746f276a80fe31585fb07b9df80beba2 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 08119661dad0 ++++[request] returns ok +++- if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 4: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok ++- entering policy rewrite_called_station_id {...} +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 00179581b910 ++++[request] returns ok +++- if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 4: Preceding "if" was taken ++- policy rewrite_called_station_id returns ok ++? if (( Service-Type == 'Login-User') ) ?? Evaluating (Service-Type == 'Login-User') -> FALSE ++? if (( Service-Type == 'Login-User') ) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^08119661dad0$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> FALSE [sql] expand: %{User-Name} -> AD\jodunni1 [sql] sql_set_user escaped user --> 'AD\jodunni1' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'AD=5Cjodunni1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY prio -> SELECT groupname FROM radusergroup WHERE username = 'AD=5Cjodunni1' ORDER BY prio rlm_sql (sql): Released sql socket id: 0 [sql] User AD\jodunni1 not found ++[sql] returns notfound ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AD\jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 163 to 10.45.0.11 port 32768 EAP-Message = 0x010701731900480186f842010104040302020430200603551d2504193017060a2b0601040182370a030306096086480186f8420401301f0603551d23041830168014607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d010105050003820101007947fc15d74c79df0f7a9eced47c4b63c989b57b3f9912e89c8c9a492fe04e954aedc7bcbef1a2db8e931dba7154aa4bd989222487c504a8ac8252a052f8b8e14fa1276663214a39e7c7c54e5fb2d61d136d30e9ced7a21cbc290a733c5b2349fed6ffcab04ff5f26798c04711f8b748a69009d642beeab1b95342c39c20c9fba15bb5566d8781c860acc4b972270a8e1ea8b1 EAP-Message = 0x2ecd32a27857b09cf895bb438e8c31866e530dc61205ba416ea8353009181d0261fffdee35de6ac33bd04d4b4e50b256360c445dda1a652ae69856a963332e04e7aee8f48eb7b2da7dc0c8e2aea6282fe3c973bdfc074134b7aa6eeea7dbd1933ced90ec329288d9c8236c742116030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa5680b71a16f1263d1432556cadaa121 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.45.0.11 port 32768, id=164, length=578 User-Name = "AD\\jodunni1" Calling-Station-Id = "08-11-96-61-da-d0" Called-Station-Id = "00-17-95-81-b9-10:wsc-secure_test" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a2d000b0005db144f43eed3" NAS-IP-Address = 10.45.0.11 NAS-Identifier = "Fornax" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "30" EAP-Message = 0x02070150198000000146160301010610000102010011ab9f6bcd924d6b9828e058f0ff801f86ad521cddc59e414f0688aaa02a733d4743b33478d2fd6aeedb0e190e14e1b3d338797f5a04c80c78ef005d8b4a176277985ef846c63889d12646d126ad5e2edda9fce0d50d618239f391b6a1a7f67a06da54e7f13c435f812530e21be59cd65cfc2c83262361069022cd50bd3c7a4801cbfde4620345c1d23e1f69a56fb0d43a5d94f49f63ec77774c508733a0413d6a312a4f94bd28cd060bc632cf59ebd897622e9da8b948c5099d41be709496c9f2dd04467b709f9457a1b491009e37a992e08138484e80776784836851dd6152920fbe1bfab72955 EAP-Message = 0x08474f321d177cf7eb70b7cc6d199695af1856b2df62e8a21403010001011603010030ffddbd883a6754de22502094e0cd7587a0a132e8ff2e9ca87ae76f7bc0f11f0c927add560142bb90ea0b0602e3be151c State = 0xa5680b71a16f1263d1432556cadaa121 Message-Authenticator = 0x255f6fbda66b8e53f6fac757878b5019 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 08119661dad0 ++++[request] returns ok +++- if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 5: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok ++- entering policy rewrite_called_station_id {...} +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 00179581b910 ++++[request] returns ok +++- if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 5: Preceding "if" was taken ++- policy rewrite_called_station_id returns ok ++? if (( Service-Type == 'Login-User') ) ?? Evaluating (Service-Type == 'Login-User') -> FALSE ++? if (( Service-Type == 'Login-User') ) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^08119661dad0$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> FALSE [sql] expand: %{User-Name} -> AD\jodunni1 [sql] sql_set_user escaped user --> 'AD\jodunni1' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'AD=5Cjodunni1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY prio -> SELECT groupname FROM radusergroup WHERE username = 'AD=5Cjodunni1' ORDER BY prio rlm_sql (sql): Released sql socket id: 4 [sql] User AD\jodunni1 not found ++[sql] returns notfound ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AD\jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 164 to 10.45.0.11 port 32768 EAP-Message = 0x010800411900140301000101160301003029e86fe685a0b3b50b378796058c57c15efe6f3c93c3bf805d2cf7db4bff096600a7b59dc8a0499546ca833cf63d2243 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa5680b71a0601263d1432556cadaa121 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.45.0.11 port 32768, id=165, length=287 User-Name = "AD\\jodunni1" Calling-Station-Id = "08-11-96-61-da-d0" Called-Station-Id = "00-17-95-81-b9-10:wsc-secure_test" NAS-Port = 29 Cisco-AVPair = "audit-session-id=0a2d000b0005db144f43eed3" NAS-IP-Address = 10.45.0.11 NAS-Identifier = "Fornax" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "30" EAP-Message = 0x0208002f19800000002515030100200cf7768731bc0c90eb5f24afbe6df96c8bb29b4b5ab79777c42ae095bf2dc91b State = 0xa5680b71a0601263d1432556cadaa121 Message-Authenticator = 0x0899058d88a58b24d8e0e9b973784382 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 08119661dad0 ++++[request] returns ok +++- if (calling-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 6: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok ++- entering policy rewrite_called_station_id {...} +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) -> TRUE +++- entering if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 00179581b910 ++++[request] returns ok +++- if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i) returns ok +++ ... skipping else for request 6: Preceding "if" was taken ++- policy rewrite_called_station_id returns ok ++? if (( Service-Type == 'Login-User') ) ?? Evaluating (Service-Type == 'Login-User') -> FALSE ++? if (( Service-Type == 'Login-User') ) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) ?? Evaluating (Service-Type == 'Call-Check') -> FALSE expand: ^%{Calling-Station-ID}$ -> ^08119661dad0$ ?? Evaluating (User-Name =~ /^%{Calling-Station-ID}$/i) -> FALSE ++? if (( Service-Type == 'Call-Check') || (User-Name =~ /^%{Calling-Station-ID}$/i)) -> FALSE [sql] expand: %{User-Name} -> AD\jodunni1 [sql] sql_set_user escaped user --> 'AD\jodunni1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'AD=5Cjodunni1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY prio -> SELECT groupname FROM radusergroup WHERE username = 'AD=5Cjodunni1' ORDER BY prio rlm_sql (sql): Released sql socket id: 3 [sql] User AD\jodunni1 not found ++[sql] returns notfound ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "AD\jodunni1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 47 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 37 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied [peap] WARNING: No data inside of the tunnel. [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state ? [peap] FAILED processing PEAP: Tunneled data is invalid. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> AD\jodunni1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 165 to 10.45.0.11 port 32768 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 159 with timestamp +19 Cleaning up request 1 ID 160 with timestamp +19 Cleaning up request 2 ID 161 with timestamp +19 Cleaning up request 3 ID 162 with timestamp +19 Cleaning up request 4 ID 163 with timestamp +19 Cleaning up request 5 ID 164 with timestamp +19 Waking up in 1.0 seconds. Cleaning up request 6 ID 165 with timestamp +19 Ready to process requests.

3 2

Setting up FreeRADIUS
by ryuukuu 22 Feb '12

22 Feb '12

I seem to be having a hardtime setting up FreeRADIUS to work with my Astaro firewall. First, in radiusd.conf I have left most of the configurations the same only made a few small ones such as the port for: listen { type = auth ipaddr = * port = 1812 (instead of the default 0) } In clients.conf, I have added the following: client ASG { ipaddr = 192.168.***.*** secret = my secret } In /etc/raddb/users I added user Cleartext-Password password. In Astaro I created a network definition with "host," as the type, ANY interface, and the IP for my box running FreeRADIUS. I also created a packet filter rule as follows: Group: WiFi Position: 59 Source: srv_freeradius Service: RADIUS Destination: firewall In the wireless security setting of Astaro under Advance/Enterprise Authentication I added the following information: RADIUS: srv_freeradius (network defition I created) RADIUS Port: RADIUS (This was already in place there) RADIUS Secret: my secret Repeat Secret: repeated secret Now whenever I run radtest user password localhost 0 secret I get the Access-Accept packet but if I modify the command and run radtest user password ASG_IP 1812 secret I get "radclient: no response from server for ID 168 socket 3" I also tried running radtest user password FreeRADIUS_Server_IP 1812 secret and the output in /usr/sbin/radiusd -X is as follows: " Ignoring request to authentication address * port 1812 from unknown client 192.168.***.*** port 48063 Ready to process requests." -- View this message in context: http://freeradius.1045715.n5.nabble.com/Setting-up-FreeRADIUS-tp5506078p550… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRadius to authenticate DHCP Requests with Option82
by sachin.sharma＠wipro.com 22 Feb '12

22 Feb '12

Hello all, I am implementing Free Radius to authenticate DHCP Requests with Option82. I have configured DHCP Relay Agent, DHCP Snooping in CISCO Switch and DHCP Server. Now i have to configure RADIUS for option82. Please help me to configure RADIUS for DHCP option82. Also i am not clear who will authenticate to RADIUS, Switch,DHCP Relay Agent or DHCP Server. After reading docs i guess it's DHCP Server .... Br. Sachin Sharma Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

5 10

Possible bug in rlm_sqlcounter examples
by Tim White 22 Feb '12

22 Feb '12

Hi All. I am using the following SQL in sqlcounter for a MySQL database in the Grase Hotspot project, as part of daily/hourly/monthly counters. query = "SELECT SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" This is taken directly out of the examples that come with Freeradius, and is also in the Wiki. http://wiki.freeradius.org/Rlm_sqlcounter#Example+Setup Recently I was having problems where the first login for a day, wasn't being limited to it's daily limit. However, subsequent logins for they day were. So for example, if they had a 4 hour limit, and the first login went over 4 hours, it could keep going as Session-Limit was being returned by freeradius. However, all subsequent logins would return a valid Session-Limit (timeout?) or an access denied if they had gone over the daily limit. Some poking around showed that if there was no logins for that day, the above SQL will return NULL, which Freeradius complains about, something along the lines of there not being an integer in the results (I can't get the exact error message right now), and so the sqlcounter just passes through as noop. To solve the problem, I needed to use an IFNULL (or COALESCE) to return a 0 instead of NULL and then Freeradius sqlcounter returns the correct attributes. query = "SELECT COALESCE( SUM(acctsessiontime - \ GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) ) \ FROM radacct WHERE username = '%{%k}' AND \ UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" This happens on the arm architecture, and so may be architecture dependent. A quick test on x86 MySQL shows it also returns NULL, however I've not had the chance to test how Freeradius interprets the NULL, as 0 or NULL. I will get out an x86 test machine shortly and test what Freeradius is returning. $ apt-cache policy freeradius freeradius: Installed: 2.1.10+dfsg-2 Debian 6.0.3 Linux Kernel 2.6.32 armv5tel Has anyone else run into this problem? Tim

2 2

confused by logging targets for rlm_perl
by Olivier Bilodeau 22 Feb '12

22 Feb '12

Hi there! It's been a while.. François turned out to be our official freeradius-users correspondent lately ;) So, I'm changing some things in our rlm_perl module and tried to make a better use of the logging facilities provided by the freeradius core. http://wiki.freeradius.org/Rlm_perl#Logging refers to: 0 - Debug 1 - Auth 2 - Proxy 3 - Info 4 - Error However in practice my tests today revealed behavior that I would prefer be clarified by one of the gurus here. With file logging, auth = yes and sending messages with &radiusd::radlog() I found that: Debug, Info and Error goes to the radius.log file while Auth does not. I haven't tried Proxy or Acct (which is available according to src/main/log.c). I expected Debug not to go out in radius.log and Auth to do since I specified Auth to yes in radiusd.conf. With radius -X, as expected, I got everything. Am I missing something here? Is this a bug or a feature(tm)? Running freeradius 2.1.12. Thanks, -- Olivier Bilodeau obilodeau(a)inverse.ca :: +1.514.447.4918 *115 :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

2 1

2.1.12 segfault with ldap module
by Brian De Wolf 22 Feb '12

22 Feb '12

While setting up freeradius recently, we noticed that it would segfault on a restart after being used. The segfault line would be something like: kernel: radiusd[2608]: segfault at 7feb7471f480 ip 00007feb7471f480 sp 00007fff451ea168 error 14 in libfreeradius-eap-2.1.12.so[7feb74d2b000+9000] At first I thought this would be something in the eap module, but after building a debug build and running it in gdb I got this backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff3e0f480 in ?? () (gdb) bt #0 0x00007ffff3e0f480 in ?? () #1 0x00007ffff71d9dea in ?? () from /usr/lib64/libcrypto.so.1.0.0 #2 0x00007ffff755a12d in SSL_free () from /usr/lib64/libssl.so.1.0.0 #3 0x00007ffff548b1da in ?? () from /usr/lib64/libldap_r-2.4.so.2 #4 0x00007ffff524df59 in ber_sockbuf_remove_io () from /usr/lib64/liblber-2.4.so.2 #5 0x00007ffff524dfed in ber_int_sb_destroy () from /usr/lib64/liblber-2.4.so.2 #6 0x00007ffff524e06c in ber_sockbuf_free () from /usr/lib64/liblber-2.4.so.2 #7 0x00007ffff546fb2c in ldap_ld_free () from /usr/lib64/libldap_r-2.4.so.2 #8 0x00007ffff56a50c0 in ldap_detach (instance=<value optimized out>) at rlm_ldap.c:2588 #9 0x00000000004186ce in module_instance_free (data=<value optimized out>) at modules.c:380 #10 0x00007ffff7bcee4d in FreeWalker (tree=0x796a50, X=0x799670) at rbtree.c:63 #11 0x00007ffff7bcee8e in rbtree_free (tree=0x9b14c0) at rbtree.c:74 #12 0x0000000000419450 in detach_modules () at modules.c:428 #13 0x000000000041d13c in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:456 After seeing that it looks like it's actually the ldap module causing problems, I commented out all of my bits that use the ldap module and it doesn't segfault on shutdown. I also tried it with ldap but without TLS enabled and it shut down clean still. Has anyone seen this before? Any solutions? For the time being, I guess I'll run the ldap module without TLS enabled. Segfaults, even benign ones, seem to get everyone antsy...

2 2

Please update your configuration so that the "known good" clear text password is in Cleartext-Password, and not in User-Password
by Yannick Barbeaux 21 Feb '12

21 Feb '12

Hello, I know this question has been asked many times before yet I could not find a solution to my problem: On debian squeeze, I installed freeradius 2.1.10 and use mysql (5.1.49) for the authentication (I uncommented the line "sql" in the 'authorize' and 'accounting' sections of /etc/freeradius/sites-available/default ) When I test with the following command: root@my-machine:~# radtest sqltest testpwd localhost 1812 testing123 Sending Access-Request of id 116 to 127.0.0.1 port 1812 User-Name = "sqltest" User-Password = "testpwd" NAS-IP-Address = 10.50.1.3 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=116, length=20 it receives the authorization correctly. It works fine... Yet, on the debugging messages, I see the following (famous) message: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! I have read in the messages archive that I should "replace in your configuration (either user file or database) all occurrences of "User-Password" with "Cleartext-Password"." Yet in my DB, I have: mysql> select * from radcheck; +----+----------+-----------+----+---------+ | id | username | attribute | op | value | +----+----------+-----------+----+---------+ | 1 | sqltest | Password | == | testpwd | +----+----------+-----------+----+---------+ If I change the attribute to "Cleartext-Password" instead of "Password", the connection is rejected (ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user) I did grep "Cleartext" in /etc/freeradius/* but found nothing. Should I really worry about that warning and if yes, how can I get rid of that message? DEBUG INFO: ----------- Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 35731, id=116, length=59 User-Name = "sqltest" User-Password = "testpwd" NAS-IP-Address = 10.50.1.3 NAS-Port = 1812 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "sqltest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> sqltest [sql] sql_set_user escaped user --> 'sqltest' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sqltest' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sqltest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sqltest' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testpwd" [pap] Using clear text password "testpwd" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 116 to 127.0.0.1 port 35731 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 116 with timestamp +2 Ready to process requests --------------- I did read 'man rlm_pap' as suggested but could not find the solution. Here is an excerpt of my /etc/freeradius/sites-available/default : authorize { preprocess chap mschap digest suffix eap { ok = return } sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } Any help would be greatly appreciated. Yannick

2 1

Freeradius stopped to work
by dorje2007＠seznam.cz 20 Feb '12

20 Feb '12

Hi after more then year my freeradius 2.1.9 stopped to work in log I have a lot of the following info: ....Feb 20 13:11:55 radius radiusd[12006]: WARNING: Child is hung for request 35 in component accounting module radutmp. Feb 20 13:11:56 radius radiusd[12006]: WARNING: Child is hung for request 34 in component accounting module radutmp. Feb 20 13:11:56 radius radiusd[12006]: WARNING: Child is hung for request 51 in component accounting module radutmp. .... Feb 20 13:10:45 radius radiusd[12006]: WARNING: Unresponsive child for request 134, in module radutmp component accounting Feb 20 13:10:47 radius radiusd[12006]: WARNING: Unresponsive child for request 132, in module radutmp component accounting Feb 20 13:10:48 radius radiusd[12006]: WARNING: Unresponsive child for request 136, in module radutmp component accounting and so on When i restart the radius, it start to work, then after a few minutes goes down Any idieas ? thanks pet

5 11

Problem with freeradius
by slaserx 20 Feb '12

20 Feb '12

Hi i run freeradius version radiusd: FreeRADIUS Version 2.1.12, for host i386-portbld-freebsd9.0, built on Jan 19 2012 at 22:04:35 on my FreeBSD but i have problem with radclient and radzap i don`t can to disconnect the users... give me this error radclient: no response from server for ID 144 socket 3 i use radzap -u user 127.0.0.1 secret and have this answer for server [root@skynet /]# radzap -u office 127.0.0.1 pass radclient: no response from server for ID 122 socket 3 [root@skynet /]# Please help me -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problem-with-freeradius-tp5499520p5… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1