- Freeradius-Users - lists.freeradius.org

Proxy Radius - Deny user based on username preproxy
by Nathan M 30 Dec '11

30 Dec '11

To any freeradius guru, I operate a proxy radius server which proxies requests downstream. A few particular usernames are repeating far more frequently than they should and I have no way to eliminate this upstream. I do need to authenticate the users though and not deny them. The goal would be to authenticate them at the proxy level so it does not send the request downstream at all. Ideally an entry something to the tune of: userx Cleartext-Password := "xxx" Session-Timeout = 604800, Idle-Timeout = 604800, Acct-Interim-Interval = 4084, Fall-Through = No I've reviewed and done dozens of attempts using the preproxy_users, and users file (by trying with files above and below the suffix line in authorize{}); however, none of my attempts have been successful. The lines match when viewing debug; however, by entering anything other than Auth-Type := Reject within the users file, the authentication proceeds on it's merry way to the proxy process downstream. Any advice on a config which will accomplish this? Thanks, N

2 1

Rlm_ippool provides invalid IP
by Arlindo F. Neto 30 Dec '11

30 Dec '11

Hi, When I use a range of addresses greater than one network /24, the ippool provides IP to the client with zero end (eg 192.168.10.0). The IP Pool configuration on radiusd.conf ippool pool1 { range-start = xxx.xxx.36.1 range-stop = xxx.xxx.39.152 netmask = 255.255.255.255 cache-size = 922 session-db = ${raddbdir}/ippool/db.pool1 ip-index = ${raddbdir}/ippool/db.pool1index override = no maximum-timeout = 30 } Nesta configuração, frequentemente o freeradius fornece endereços IPs inválidos, exemplo: xxx.xxx.37.0 xxx.xxx.38.0 xxx.xxx.39.0 Is there any configuration to be done to solve this problem? Regards,

3 4

Error Reading Certificate file
by McSparin, Joe 30 Dec '11

30 Dec '11

Get this error when running radiusd -X I checked my passwords in eap.cnf, ca.cnf, server.cnf and client.cnf rlm_eap: SSL error error:0200100D:system library:fopen:Permission denied rlm_eap_tls: Error reading certificate file /usr/local/etc/raddb/certs/server.pem rlm_eap: Failed to initialize type tls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[314]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 2

jradius onfail FAIL and REJECT
by Christian Springer 30 Dec '11

30 Dec '11

Hello, in the jRadius config there are the options FAIL and REJECT for the onfail parameter. Can someone explain the difference? Behaviour seems identical in wireshark traces, sending an Access Reject in both cases. Thanks Christian

2 1

FreeRadius Installation Errors
by McSparin, Joe 29 Dec '11

29 Dec '11

I got my test server up and running nicely with FreeRadius now I have my production server that I am installing exact same machine and same process however this time when I install freeradius from /usr/ports/net/freeradius2 I get the following errors and no /usr/local/etc/raddb directory is created gmake[6]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.12/src/modules/rl m_ippool' Making all in rlm_krb5... /usr/local/bin/gmake -w -C rlm_krb5 all gmake[6]: Entering directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.12/src/modules/rl m_krb5' /usr/local/bin/libtool --mode=compile cc -O2 -pipe -I/usr/local/include -L/usr/local/lib -fno-strict-aliasing -Wall -D_GNU_SOURCE -pthread -DNDEBUG -I/usr/ports/net/freeradius2/work/freeradius-server-2.1.12/src -DHEIMDAL_KRB5 -I/usr/local/include -I/usr/include/et -DKRB5_DEPRECATED -c rlm_krb5.c libtool: compile: cc -O2 -pipe -I/usr/local/include -L/usr/local/lib -fno-strict-aliasing -Wall -D_GNU_SOURCE -pthread -DNDEBUG -I/usr/ports/net/freeradius2/work/freeradius-server-2.1.12/src -DHEIMDAL_KRB5 -I/usr/local/include -I/usr/include/et -DKRB5_DEPRECATED -c rlm_krb5.c -fPIC -DPIC -o .libs/rlm_krb5.o In file included from /usr/local/include/krb5.h:846, from rlm_krb5.c:32: /usr/local/include/krb5-protos.h:41: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:49: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:402: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:486: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:634: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:843: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:908: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1007: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1281: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1289: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1297: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1305: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1313: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1321: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1329: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1337: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1600: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1608: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1616: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1624: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1632: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1640: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1648: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1656: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1741: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1844: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1854: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1874: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1919: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1952: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1975: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:1983: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2083: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2127: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2142: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2157: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2169: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2181: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2223: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2229: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2607: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2615: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2622: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:2629: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:3144: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:3178: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:3183: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:3734: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:4091: error: expected identifier or '(' before numeric constant /usr/local/include/krb5-protos.h:4378: error: expected identifier or '(' before numeric constant gmake[6]: *** [rlm_krb5.lo] Error 1 gmake[6]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.12/src/modules/rl m_krb5' gmake[5]: *** [rlm_krb5] Error 2 gmake[5]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.12/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.12/src/modules' gmake[3]: *** [modules] Error 2 gmake[3]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.12/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.12/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/usr/ports/net/freeradius2/work/freeradius-server-2.1.12' gmake: *** [all] Error 2 *** Error code 1 Stop in /usr/ports/net/freeradius2. *** Error code 1 Stop in /usr/ports/net/freeradius2. Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

2 3

RE: ppp and eap-tls
by Frank 29 Dec '11

29 Dec '11

Hi, > -----Original Message----- > From: Alan DeKok [mailto:aland@deployingradius.com] > Sent: Wednesday, December 28, 2011 15:40 > To: FreeRadius users mailing list [mailto:freeradius-users@lists.freeradius.org] > Subject: Re: ppp and eap-tls > > Alan wrote: > > I now get the following error in my radius log on an auth attempt: > > > > Error: TLS Alert write:fatal:decrypt error > > Error: TLS_accept: failed in SSLv3 read certificate verify B > > Error: rlm_eap: SSL error error:0407006A:rsa > routines:RSA_padding_check_PKCS1_type_1:block type is not 01 > > Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. > > The client is broken. Ok. The client is the build-in L2TP/IPSEC VPN client in MS Windows Vista > > > Now there's several issues: > > - I don't know what I changed which caused this behaviour (maybe an > openssl update in Squeeze? Something changes in Windows Vista?) > > No. It used to work fine with this client (MS Windows Vista L2TP/IPsec client) > > > - the client certificates are valid (tested with openssl cli), and > work fine when using for WPA auth > > - I don't really know what this error means > > - I can't find a solution for it. I've tried: 2048 bit (vs. 4096 bit) > RSA certs and the extensions for XP for both the server and client > certs > > > > Again, the same certificates work fine for WPA auth > > Which doesn't use certificates. This statement is confusing! I'm using freeradius for EAP-TLS auth and set up the client for WPA2 enterprise with EAP-TLS. If this is not using certificates for authentication, then what is it using? > > > I hope someone can shed some light onto this issue, or how to pin > down the exact cause of the 'rsa > routines:RSA_padding_check_PKCS1_type_1:block type is not 01' error. > > Find out which client it is. Mac? Windows? MS Windows Vista, build-in L2TP/IPSEC client, ppp authentication set to EAP-TLS. > > Alan DeKok. Regards, Frank

2 4

Problem with mysql-user
by Koenraad Lelong 28 Dec '11

28 Dec '11

Hi, I'm new to freeradius, I'm trying to setup freeradius to authenticate wifi-users using mysql. I'm running freeradius 2.1.12 from Fajar A. Nugraha (see post on 20 Dec 2011 11:16:27) on ubuntu 10.04. I'm using the daloradius-gui to create users. When I try via wifi using a user in the users-file, that user is accepted, a user in the mysql database is rejected. When I try the "mysql-user" with radtest, the user is authenticated : # radtest mtester1 mtester1 localhost 0 testing123 Sending Access-Request of id 56 to 127.0.0.1 port 1812 User-Name = "mtester1" User-Password = "mtester1" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=56, length=20 What am I doing wrong ? Thanks, Koenraad Lelong. This is the log when trying the mysql-user via wifi : FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Oct 7 2011 at 10:59:41 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client accesspoint2 { ipaddr = 192.168.185.14 require_message_authenticator = no secret = "fVn579og18h" nastype = "other" } client accesspoint { ipaddr = 192.168.185.8 require_message_authenticator = no secret = "azertyuiop" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client ::1 { require_message_authenticator = no secret = "testing123" shortname = "localhost" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radiusPassWord" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 40922 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.185.14 port 1027, id=0, length=156 User-Name = "mtester1" NAS-IP-Address = 192.168.185.14 NAS-Port = 0 Called-Station-Id = "06-18-E7-D4-37-D0:Isengard" Calling-Station-Id = "18-87-96-5A-25-C6" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0200000d016d74657374657231 Message-Authenticator = 0x9227fb64e8450452bbe860990bdb2f3d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> mtester1 [sql] sql_set_user escaped user --> 'mtester1' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mtester1' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mtester1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mtester1' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mtester1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'mtester1' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'mtester1' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.185.14 port 1027 EAP-Message = 0x010100160410a24de0b584080fbb1e034f30942feb74 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6f1d8ffb6e190f744a4ca7e33f5fc1 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.185.14 port 1027, id=1, length=167 User-Name = "mtester1" NAS-IP-Address = 192.168.185.14 NAS-Port = 0 Called-Station-Id = "06-18-E7-D4-37-D0:Isengard" Calling-Station-Id = "18-87-96-5A-25-C6" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020100060319 State = 0xfb6f1d8ffb6e190f744a4ca7e33f5fc1 Message-Authenticator = 0x5ddf6bf9643fe586173fbc440167488f # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> mtester1 [sql] sql_set_user escaped user --> 'mtester1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mtester1' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mtester1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mtester1' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mtester1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'mtester1' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'mtester1' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.185.14 port 1027 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6f1d8ffa6d040f744a4ca7e33f5fc1 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.185.14 port 1027, id=2, length=361 User-Name = "mtester1" NAS-IP-Address = 192.168.185.14 NAS-Port = 0 Called-Station-Id = "06-18-E7-D4-37-D0:Isengard" Calling-Station-Id = "18-87-96-5A-25-C6" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020200c81980000000be16030100b9010000b503014efafc0967a80394498db33ae6d23a7b2f1d23d55b53dbb4941859c5998090ab000048c014c00a00390038c00fc0050035c012c00800160013c00dc003000ac013c00900330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000044000b000403000102000a00340032000100020003000400050006000700080009000a000b000c000d000e000f001000110012001300140015001600170018001900230000 State = 0xfb6f1d8ffa6d040f744a4ca7e33f5fc1 Message-Authenticator = 0x9f011cfc69f73058e8f37ec36860d37a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 200 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 190 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 00b9], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 01bf], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.185.14 port 1027 EAP-Message = 0x0103039b190016030100310200002d03014efafbfe6d3fcb8e5ceb73c7194cc25552f3c147f077ed41cebd4c0d4f5ef095000039000005ff0100010016030101bf0b0001bb0001b80001b5308201b13082011a020900af126d9978d56337300d06092a864886f70d0101050500301d311b3019060355040313126e657074756e75732e74687569732e6c616e301e170d3130313232383039353231325a170d3230313232353039353231325a301d311b3019060355040313126e657074756e75732e74687569732e6c616e30819f300d06092a864886f70d010101050003818d0030818902818100e8be5ed3ac0448bbb461be55c4596278bcd81faf60 EAP-Message = 0xdd3f452ac9a38a087ef34e41b265fabfa26b36e501e1e2788ba233f0dbf7a6c8c52619382302fc5e75f052a856c35215c05d724ee7faadb1ef94b079bf9b49b98224a5335dbc36670332acb3d549961230e4c518bbf9f15b94be6e417537c5bf318c2e04fbe914836c11c30203010001300d06092a864886f70d010105050003818100258fbc6b9adb24f927896205d2628ca26769060795e5f05ee57e4354cca52927afd49a4f763c48b1319e60f39f6a839d01b8d45939cb00d4c898b4d23034f259246e10a1bf6f479c69d512e887a6a9f972b4a00a6dafd21ea5a58c95ba8a8a1a67d050ca30b66c693520de89ac34ff2ac5d56b5d90e750370ce1 EAP-Message = 0xc9462c57083f160301018d0c0001890080af417ea6886d8a085e9262be01288f66af64e1bc8ae34d25cd5eb83908d65d152e2abe7e699a4e31bcf0d9395d3512a87134f7f238f197023d93652e5cf51ddbf463f1f4ebbc9fe296e680acd0de11341f093a8dfcd6559cccdb14b49a2320c363b94d42c9ffa3c90d530fd063232390cce59e95b6b3e9c550246bde1bebfc1b000102008038dce157eea4bbd5c84722dd625768293291dde741cff47f6e30d7e5391850fd7dc2e5f34a88b0b8686fa9de73457432b910612ca3b5017cf7e713fe300ebaa8a2794c850589ca21bc9bd0555f513b9e93b1065a3b6840393f1cfa9181b8a59966ddd33c1bdab8 EAP-Message = 0x3960579855dadc9e06f1924a9c742b554fddb6017016b64830008069d2857facec6c013d31771b6929970e6aadb53288ea544c624cded9b8c61484bfae3e8e1f757db2268c02570c2cc8f0613d6f57fba01794aa6212b3cb6366ea33f76bf65b21a668374a402ddb68e14906cced047a1bc48861f457d4d3adaf4e667a5b47c0065637e33f63fdf3c0e2335e5d830e9590d0ed64f25d971d4185e016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6f1d8ff96c040f744a4ca7e33f5fc1 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.185.14 port 1027, id=3, length=369 User-Name = "mtester1" NAS-IP-Address = 192.168.185.14 NAS-Port = 0 Called-Station-Id = "06-18-E7-D4-37-D0:Isengard" Calling-Station-Id = "18-87-96-5A-25-C6" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020300d01980000000c616030100861000008200801c2e6089eda9a578c653274f9ba3c620edb11098b7dede14df159c3efc13c84effe35a5584d561f577bf4eefc20e8ae9c093c16c75462867c642e1662327db503157bb720919a4a78892ebeba7bdf84a737bcc8a915af5705b93047ca9cdc8ce8d81aed1b9e0bfeb2af128b022a67fd767794b7720c0d8e69782935fe04b7c781403010001011603010030ea360f92cbc949e7fbcd9d02f4690c8bd114ffbdad94cd7ca02f969f5d21fb1cb0d1de474a068ef85c9d2285e331fae2 State = 0xfb6f1d8ff96c040f744a4ca7e33f5fc1 Message-Authenticator = 0xca4c1446af6828ad61bd097d25cb1c5a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.185.14 port 1027 EAP-Message = 0x0104004119001403010001011603010030bf263e6fd0d3e9f036eab752545679f15c986b78907bc9e16f7a08d11494c7b6da74f623afe6012dd8b4e95fcd52aac8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6f1d8ff86b040f744a4ca7e33f5fc1 Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.185.14 port 1027, id=4, length=167 User-Name = "mtester1" NAS-IP-Address = 192.168.185.14 NAS-Port = 0 Called-Station-Id = "06-18-E7-D4-37-D0:Isengard" Calling-Station-Id = "18-87-96-5A-25-C6" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020400061900 State = 0xfb6f1d8ff86b040f744a4ca7e33f5fc1 Message-Authenticator = 0x56aec7766b8c740054cf868ce3dbdb48 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 4 to 192.168.185.14 port 1027 EAP-Message = 0x0105002b1900170301002008f04dd99be432416d646de8d6a39925b5020b8ebb44e4c163db9032b786c0b0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6f1d8fff6a040f744a4ca7e33f5fc1 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.185.14 port 1027, id=5, length=241 User-Name = "mtester1" NAS-IP-Address = 192.168.185.14 NAS-Port = 0 Called-Station-Id = "06-18-E7-D4-37-D0:Isengard" Calling-Station-Id = "18-87-96-5A-25-C6" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020500501900170301002026cb465f3fd7edba969a026291282a823270b8f7b7b5a402d38f3fb3a27af45d17030100205a04afc1bb18e0a613263f078278b914119a1cb78801e1418880af7f0f638d16 State = 0xfb6f1d8fff6a040f744a4ca7e33f5fc1 Message-Authenticator = 0xc30145e1f2fda7d6701bd5b5d2433ef2 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - mtester1 [peap] Got inner identity 'mtester1' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0205000d016d74657374657231 server { [peap] Setting User-Name to mtester1 Sending tunneled request EAP-Message = 0x0205000d016d74657374657231 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mtester1" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 5 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010600221a0106001d10514d6c3eb1282a4e0e825509da6c87d36d74657374657231 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x389b5ffe389d45b1fe5a106ea19e3db0 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010600221a0106001d10514d6c3eb1282a4e0e825509da6c87d36d74657374657231 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x389b5ffe389d45b1fe5a106ea19e3db0 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.185.14 port 1027 EAP-Message = 0x0106004b190017030100404181c98b87b929f7585a2f938a41de590850e03ecd0a63e1d1cbce0f8c660055d7b309ed9887f1edc0b4391bb776d1b3a7269cea901300e6701e98b796c009b0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6f1d8ffe69040f744a4ca7e33f5fc1 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.185.14 port 1027, id=6, length=305 User-Name = "mtester1" NAS-IP-Address = 192.168.185.14 NAS-Port = 0 Called-Station-Id = "06-18-E7-D4-37-D0:Isengard" Calling-Station-Id = "18-87-96-5A-25-C6" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0206009019001703010020046b4d412bd8658532d30b31ec31656f96ab19e6fa5bfef24bb748c7458119cc1703010060fcc47aed4764ac81885bd86e8490d090b046364ede1a552655c278e7c4ee9565b2b4321b0059a8e720e1a2e10dc0d0810741de20ccbaa03ce5e0e93b90cb56eb847929e124245e0c943355f064577b3272801ecc73e41b84a2d3ba6c4f7ea044 State = 0xfb6f1d8ffe69040f744a4ca7e33f5fc1 Message-Authenticator = 0xbd576294609771e4e88e500882540849 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020600431a0206003e31d0efd81bc55010af781828e319ba6bc20000000000000000bdf64aea88a1dd14619a42938e9c5f4faefde4630e17aea6006d74657374657231 server { [peap] Setting User-Name to mtester1 Sending tunneled request EAP-Message = 0x020600431a0206003e31d0efd81bc55010af781828e319ba6bc20000000000000000bdf64aea88a1dd14619a42938e9c5f4faefde4630e17aea6006d74657374657231 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "mtester1" State = 0x389b5ffe389d45b1fe5a106ea19e3db0 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 67 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: mtester1 [mschap] Told to do MS-CHAPv2 for mtester1 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [mtester1/<via Auth-Type = EAP>] (from client accesspoint2 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.185.14 port 1027 EAP-Message = 0x0107002b1900170301002097bdab26f63d2f6ff9220245471fcb79a246d23eabfc323c064fec7038fcf3ac Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6f1d8ffd68040f744a4ca7e33f5fc1 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.185.14 port 1027, id=7, length=241 User-Name = "mtester1" NAS-IP-Address = 192.168.185.14 NAS-Port = 0 Called-Station-Id = "06-18-E7-D4-37-D0:Isengard" Calling-Station-Id = "18-87-96-5A-25-C6" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x02070050190017030100206e8f0331ca3b8606b22d2da7708c7209bd3c4d513d1dfc137a985e72ea10d17017030100202040d8ab9f766ad0625215315da6b31e40cdb0aad2f225d09ccbe4933e2d6462 State = 0xfb6f1d8ffd68040f744a4ca7e33f5fc1 Message-Authenticator = 0x7179b504d4fd95c0108ed7a42d5b4152 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "mtester1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [mtester1/<via Auth-Type = EAP>] (from client accesspoint2 port 0 cli 18-87-96-5A-25-C6) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mtester1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 7 to 192.168.185.14 port 1027 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000

2 2

GUID based Authentication on FreeRadius
by McSparin, Joe 28 Dec '11

28 Dec '11

Anyone know if this is possible. I have found information on MAC Based Authentication but nothing on GUID. Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

3 5

Re: Logging User Accounts
by Alan Buxey 28 Dec '11

28 Dec '11

Yes, look at the linelog module alan

1 0

ppp and eap-tls
by Frank 28 Dec '11

28 Dec '11

Hi, I'm using freeradius for EAP-TLS authentication with my WPA NAS, with MS-CHAPv2 for ppp auth (in a L2TP/IPSEC VPN) and for a while for EAP-TLS for ppp auth (about half a year ago). However, without me consciously changing anything in my setup (running Debian Squeeze, connecting clients run MS Windows Vista), EAP-TLS for ppp auth no longer works since I've tested it again recently. I now get the following error in my radius log on an auth attempt: Error: TLS Alert write:fatal:decrypt error Error: TLS_accept: failed in SSLv3 read certificate verify B Error: rlm_eap: SSL error error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01 Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Now there's several issues: - I don't know what I changed which caused this behaviour (maybe an openssl update in Squeeze? Something changes in Windows Vista?) - the client certificates are valid (tested with openssl cli), and work fine when using for WPA auth - I don't really know what this error means - I can't find a solution for it. I've tried: 2048 bit (vs. 4096 bit) RSA certs and the extensions for XP for both the server and client certs Again, the same certificates work fine for WPA auth I hope someone can shed some light onto this issue, or how to pin down the exact cause of the 'rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01' error. Regards, Frank

2 1