- Freeradius-Users - lists.freeradius.org

accounting based on message type
by Travis Dimmig 06 Sep '11

06 Sep '11

I use the jradius module for processing radius accounting packets, is there a way in freeRadius 1.X to specify that I only want to pass accounting start and stop packets to jradius? In 2.X it seems I can check out the packet's Acct-Status-Type in acct_users and set the Acct-Type attribute pair, and then use that to branch to different accounting modules. Since the acct_users file in 1.X seems to only allow me to specify an external executable, however, I can't seem to find a way to do this on the older version of freeRadius. Travis Dimmig Software Development Specialist Impulse Point www.impulse.com<http://www.impulse.com>

1 0

PEAP Authentication Problems with Windows Users
by Jacob Dawson 06 Sep '11

06 Sep '11

We're having an odd problem here, and I just can't pin down quite where to look to fix it. We use PEAP-MSCHAPv2 for authentication of our windows domain users on wireless. This is accomplished by terminating the TLS conversation at FreeRADIUS and sending along the MSCHAP conversation to an IAS server. We've tested this in the past, and it's worked fine, and we're doing a modified form of this in production, and it's working fine, but I've lately been unable to get it to work in our pre-production 2.1.11 environment. What's particularly odd is that it's only affecting the Windows clients. My OS X client doing PEAP with the same credentials is happy. What we're doing in production, which continues to work, is this: We terminate TLS at FreeRADIUS. This allows us to manage the wireless service certificate there, keeps the IAS operators from having to keep up with it. We proxy the MSCHAP conversation to our OpenRADIUS server (which is also running and interacting with TACACS). OpenRADIUS proxies the CHAP stuff to IAS. It may be tinkering with the MSCHAP fields from IAS to make them more compatible (basically changing out the secrets because it's standing in the middle). Successful authentication then percolates back through the chain and the user is happy. In pre-production, it looks like this: Request comes in from Windows client, is recognized to be a Domain authentication request, gets proxied to an FR virtual server. Said virtual server gets it, processes the TLS and terminates it, and proxies the MSCHAP conversation to IAS. IAS does its MSCHAP thing, accepts the user. Access-Accept percolates back up through the chain. We send an access challenge, the user sends an Access request, and FR says the user said something weird, so it's rejecting them. Request comes in from non-windows client, is recognized to be Domain authentication request, gets proxied to an FR virtual server Said virtual server gets it, processes the TLS and terminates it, and proxies the MSCHAP conversation to IAS. IAS does its MSCHAP thing, accepts the user. Access-Accept percolates back up through the chain. We send an access challenge, the user sends an Access request, and FR says everything's fine, user gets Access-Accept. Thoughts on where I need to look? I can't parse out what's happening to cause a response to be invalid for Windows users but not for, say, Mac users. Our initial guess here is that the Windows clients are looking at the MPPE keys, and are unhappy about them, whereas the Mac clients are not, though we suspect neither set of clients requires them. Posting relevant bits of debug output below. Thanks much, Jacob M. Dawson --------- Pre-production failure: rad_recv: Access-Request packet from host 198.82.171.153 port 32768, id=138, length=293 User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020b005f19001703010054bdd79574acfa8744908880dfa66a9e861f5fff5d2b3b7e387679b867704afa60476df6cc1ac0f30d92a4dc753cebb4bc4e71f4e0bc4db75534ab2403ec993619f05ad02497597deaa193debe78641e14b4718e84 State = 0x5b4a8e485341972bae816e794759d3ea Message-Authenticator = 0xc234d7f3f04c9d023687fd78e4d5c9da (75) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group authorize { (75) - entering group authorize {...} (75) policy split_username_prefix { (75) - entering policy split_username_prefix {...} (75) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) (75) ? Evaluating (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (75) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (75) if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) { (75) - entering if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {...} (75) update request { (75) expand: %{2} -> dawson (75) expand: %{1} -> HOKIES (75) } # update request = notfound (75) [updated] = updated (75) - if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) returns updated (75) ... skipping else for request 75: Preceding "if" was taken (75) - policy split_username_prefix returns updated (75) policy split_username_suffix { (75) - entering policy split_username_suffix {...} (75) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) (75) ? Evaluating (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (75) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (75) else else { (75) - entering else else {...} (75) [noop] = noop (75) - else else returns noop (75) - policy split_username_suffix returns noop (75) [preprocess] = ok (75) auth_log : expand: /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (75) auth_log : /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (75) auth_log : expand: %t -> Tue Aug 23 10:40:16 2011 (75) [auth_log] = ok rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair State = 0x5b4a8e485341972bae816e794759d3ea rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test rlm_perl: Added pair Message-Authenticator = 0xc234d7f3f04c9d023687fd78e4d5c9da rlm_perl: Added pair Airespace-Wlan-Id = 17 rlm_perl: Added pair Stripped-User-Domain = HOKIES rlm_perl: Added pair NAS-IP-Address = 198.82.171.153 rlm_perl: Added pair Tunnel-Private-Group-Id = 1381 rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b rlm_perl: Added pair EAP-Message = 0x020b005f19001703010054bdd79574acfa8744908880dfa66a9e861f5fff5d2b3b7e387679b867704afa60476df6cc1ac0f30d92a4dc753cebb4bc4e71f4e0bc4db75534ab2403ec993619f05ad02497597deaa193debe78641e14b4718e84 rlm_perl: Added pair Stripped-User-Name = dawson rlm_perl: Added pair NAS-Port = 29 rlm_perl: Added pair Framed-MTU = 1300 (75) [perl] = noop (75) ? if ("%{Stripped-User-Domain}" != "HOKIES") (75) expand: %{Stripped-User-Domain} -> HOKIES (75) ? Evaluating ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (75) ? if ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (75) eap : EAP packet type response id 11 length 95 (75) eap : Continuing tunnel setup. (75) [eap] = ok (75) Found Auth-Type = ? (75) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group authenticate { (75) - entering group authenticate {...} (75) eap : Request found, released from the list (75) eap : EAP/peap (75) eap : processing type peap (75) peap : processing EAP-TLS (75) peap : eaptls_verify returned 7 (75) peap : Done initial handshake (75) peap : eaptls_process returned 7 (75) peap : FR_TLS_OK (75) peap : Session established. Decoding tunneled attributes. (75) peap : Peap state phase2 (75) peap : EAP type mschapv2 (75) peap : Got tunneled request EAP-Message = 0x020b00481a020b004331bf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d06600484f4b4945535c646177736f6e server { (75) peap : Setting User-Name to HOKIES\dawson Sending tunneled request EAP-Message = 0x020b00481a020b004331bf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d06600484f4b4945535c646177736f6e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "HOKIES\\dawson" State = 0x21ebcfee21e0d5ab22fbf5cfb29bfd25 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Tunnel-Type:0 = VLAN Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-IP-Address = 198.82.171.153 Tunnel-Private-Group-Id:0 = "1381" Tunnel-Medium-Type:0 = IEEE-802 Calling-Station-Id = "00-1d-e0-90-5f-db" NAS-Identifier = "cas-6509-3.wsm8b" NAS-Port = 29 Framed-MTU = 1300 server proxy-inner-tunnel { (75) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel (75) group authorize { (75) - entering group authorize {...} (75) ? if ("%{User-Name}" =~ /^(host\/.*)$/) (75) expand: %{User-Name} -> HOKIES\dawson (75) ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE (75) ? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE (75) else else { (75) - entering else else {...} (75) update control { (75) } # update control = notfound (75) - else else returns notfound } # server proxy-inner-tunnel (75) peap : Got tunneled reply code 0 PEAP: Calling authenticate in order to initiate tunneled EAP session. (75) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel (75) group authenticate { (75) - entering group authenticate {...} (75) eap : Request found, released from the list (75) eap : EAP/mschapv2 (75) eap : processing type mschapv2 rlm_eap_mschapv2: cancelling authentication and letting it be proxied (75) eap : Not-EAP proxy set. Not composing EAP (75) [eap] = handled PEAP: Tunneled authentication will be proxied to DomainUser PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. (75) eap : Tunneled session will be proxied. Not doing EAP. (75) [eap] = handled (75) WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 161 to 198.82.160.219 port 1812 User-Name = "HOKIES\\dawson" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Tunnel-Type:0 = VLAN Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-IP-Address = 198.82.171.153 Tunnel-Private-Group-Id:0 = "1381" Tunnel-Medium-Type:0 = IEEE-802 Calling-Station-Id = "00-1d-e0-90-5f-db" NAS-Identifier = "cas-6509-3.wsm8b" NAS-Port = 29 Framed-MTU = 1300 MS-CHAP-Challenge = 0xd3827513a357a99d4eb9a5c87a716418 MS-CHAP2-Response = 0x0b4fbf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d066 Proxy-State = 0x313338 (75) Proxying request to home server 198.82.160.219 port 1812 Sending Access-Request of id 161 to 198.82.160.219 port 1812 User-Name = "HOKIES\\dawson" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Tunnel-Type:0 = VLAN Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-IP-Address = 198.82.171.153 Tunnel-Private-Group-Id:0 = "1381" Tunnel-Medium-Type:0 = IEEE-802 Calling-Station-Id = "00-1d-e0-90-5f-db" NAS-Identifier = "cas-6509-3.wsm8b" NAS-Port = 29 Framed-MTU = 1300 MS-CHAP-Challenge = 0xd3827513a357a99d4eb9a5c87a716418 MS-CHAP2-Response = 0x0b4fbf4d439d3028cbdba8fff532c04f1cf60000000000000000bee44f94acbe708a682535adc0505e56a87462580576d066 Proxy-State = 0x313338 Waking up in 0.2 seconds. rad_recv: Access-Accept packet from host 198.82.160.219 port 1812, id=161, length=219 DEBUG: Compare b472204 to calculated digest f796ca40, secret temporaryS3CR3T Proxy-State = 0x313338 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586 MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1 MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2 MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134 MS-CHAP-Domain = "\013HOKIES" (75) # Executing section post-proxy from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group post-proxy { (75) - entering group post-proxy {...} (75) eap : Doing post-proxy callback (75) eap : Passing reply from proxy back into the tunnel. server proxy-inner-tunnel { (75) eap : Passing reply back for EAP-MS-CHAP-V2 (75) # Executing section post-proxy from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/proxy-inner-tunnel (75) group post-proxy { (75) - entering group post-proxy {...} (75) [eap] = noop (75) WARNING: Empty post-auth section. Using default return values. } # server proxy-inner-tunnel (75) eap : Final reply from tunneled session code 2 Proxy-State = 0x313338 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586 MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1 MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2 MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134 MS-CHAP-Domain = "\013HOKIES" (75) eap : Got reply 2 (75) eap : Got tunneled reply RADIUS code 2 Proxy-State = 0x313338 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x6538078a000001370001c652a0db01cc5476fe414ece0000000000004586 MS-MPPE-Recv-Key = 0x7208bb9a9555b125d123303ac3db12a1 MS-MPPE-Send-Key = 0x0cd6218a695a558ade111bcd7b05cfc2 MS-CHAP2-Success = 0x0b533d32434230433038364541464632333233453842414534314643443231333130453939354641454134 MS-CHAP-Domain = "\013HOKIES" (75) eap : Tunneled authentication was successful. (75) eap : SUCCESS (75) eap : Reply was handled (75) [eap] = ok (75) Found Auth-Type = ? (75) Found Auth-Type = ? (75) Warning: Found 2 auth-types on request for user 'HOKIES\dawson' (75) Auth-Type = Accept, accepting the user (75) Login OK: [HOKIES\\dawson] (from client 198.82.171.153 port 29 cli 00-1d-e0-90-5f-db) (75) # Executing section post-auth from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (75) group post-auth { (75) - entering group post-auth {...} (75) [exec] = noop Sending Access-Challenge of id 138 to 198.82.171.153 port 32768 EAP-Message = 0x010c00261900170301001b0167b434a0313cb3f29b20e1f731efe3d173083c964cda1451135a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5b4a8e485246972bae816e794759d3ea (75) Finished request 75. Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 198.82.171.153 port 32768, id=139, length=236 User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020c00261900170301001b00dae368dd150e9d42e0c8888cb128e6ecc520b887a849a8a1d743 State = 0x5b4a8e485246972bae816e794759d3ea Message-Authenticator = 0x26b42d72271f1819599977a28920622f (76) # Executing section authorize from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (76) group authorize { (76) - entering group authorize {...} (76) policy split_username_prefix { (76) - entering policy split_username_prefix {...} (76) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) (76) ? Evaluating (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (76) ? if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) -> TRUE (76) if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) { (76) - entering if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) {...} (76) update request { (76) expand: %{2} -> dawson (76) expand: %{1} -> HOKIES (76) } # update request = notfound (76) [updated] = updated (76) - if (request:User-Name =~ /^([a-z]+)[\\\/]+([-a-z0-9_.]+)$/i) returns updated (76) ... skipping else for request 76: Preceding "if" was taken (76) - policy split_username_prefix returns updated (76) policy split_username_suffix { (76) - entering policy split_username_suffix {...} (76) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) (76) ? Evaluating (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (76) ? if (request:User-Name =~ /^([^@]*)@([-[:alnum:]]+\.[-[:alnum:].]+)$/i) -> FALSE (76) else else { (76) - entering else else {...} (76) [noop] = noop (76) - else else returns noop (76) - policy split_username_suffix returns noop (76) [preprocess] = ok (76) auth_log : expand: /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (76) auth_log : /usr/local/freeradius-2.1.11/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/freeradius-2.1.11/var/log/radius/radacct/198.82.171.153/auth-detail-20110823 (76) auth_log : expand: %t -> Tue Aug 23 10:40:16 2011 (76) [auth_log] = ok rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair State = 0x5b4a8e485246972bae816e794759d3ea rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test rlm_perl: Added pair Message-Authenticator = 0x26b42d72271f1819599977a28920622f rlm_perl: Added pair Airespace-Wlan-Id = 17 rlm_perl: Added pair Stripped-User-Domain = HOKIES rlm_perl: Added pair NAS-IP-Address = 198.82.171.153 rlm_perl: Added pair Tunnel-Private-Group-Id = 1381 rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b rlm_perl: Added pair EAP-Message = 0x020c00261900170301001b00dae368dd150e9d42e0c8888cb128e6ecc520b887a849a8a1d743 rlm_perl: Added pair Stripped-User-Name = dawson rlm_perl: Added pair NAS-Port = 29 rlm_perl: Added pair Framed-MTU = 1300 (76) [perl] = noop (76) ? if ("%{Stripped-User-Domain}" != "HOKIES") (76) expand: %{Stripped-User-Domain} -> HOKIES (76) ? Evaluating ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (76) ? if ("%{Stripped-User-Domain}" != "HOKIES") -> FALSE (76) eap : EAP packet type response id 12 length 38 (76) eap : Continuing tunnel setup. (76) [eap] = ok (76) Found Auth-Type = ? (76) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (76) group authenticate { (76) - entering group authenticate {...} (76) eap : Request found, released from the list (76) eap : EAP/peap (76) eap : processing type peap (76) peap : processing EAP-TLS (76) peap : eaptls_verify returned 7 (76) peap : Done initial handshake (76) peap : eaptls_process returned 7 (76) peap : FR_TLS_OK (76) peap : Session established. Decoding tunneled attributes. (76) peap : Peap state send tlv success (76) peap : Received EAP-TLV response. (76) peap : Client rejected our response. The password is probably incorrect. (76) peap : We sent a success, but received something weird in return. (76) eap : Handler failed in EAP/peap (76) eap : Failed in EAP select (76) [eap] = invalid (76) Failed to authenticate the user. (76) Login incorrect: [HOKIES\\dawson] (from client 198.82.171.153 port 29 cli 00-1d-e0-90-5f-db) (76) Using Post-Auth-Type Reject (76) # Executing group from file /usr/local/freeradius-2.1.11/etc/raddb/sites-enabled/default (76) group REJECT { (76) - entering group REJECT {...} (76) attr_filter.access_reject : expand: %{User-Name} -> HOKIES\dawson attr_filter: Matched entry DEFAULT at line 11 (76) [attr_filter.access_reject] = updated (76) Finished request 76. Waking up in 0.2 seconds. Waking up in 0.6 seconds. (76) Sending delayed reject Sending Access-Reject of id 139 to 198.82.171.153 port 32768 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 ----- Production Success: Waking up in 4.9 seconds. User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020a005f1900170301005499a000fc4d08b0c067d3251047d61b836767466160c386b38d37d4b6c39b07ce3b09c85590c8a923419e6f0ae464ac472050214b71b4d641e06f8a439348319233d622cd7900f8f172726407b0010bcb54c6a1d6 State = 0x764462057e4e7bc59f1c525ed4400d40 Message-Authenticator = 0xd9566738adb17439ce7d7568c8bc8264 +- entering group authorize ++[mschap] returns noop rlm_eap: EAP packet type response id 10 length 95 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to HOKIES\dawson +- entering group authorize ++? if ("%{User-Name}" =~ /^(host\/.*)$/) expand: %{User-Name} -> HOKIES\dawson ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++- entering else else +++[control] returns notfound ++- else else returns notfound PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Not-EAP proxy set. Not composing EAP ++[eap] returns handled PEAP: Tunneled authentication will be proxied to openradius PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. Tunneled session will be proxied. Not doing EAP. ++[eap] returns handled +- entering group pre-proxy preproxy_users: Matched entry DEFAULT at line 1 ++[files] returns ok User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address := 198.82.247.103 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type := Framed-User Framed-MTU = 1300 NAS-Port-Type := Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" MS-CHAP-Challenge = 0x20760eb105e545d6a131f324c1d30464 MS-CHAP2-Response = 0x0a4f84e590f059f31dc3ca5b621b238582190000000000000000385984c78f91f816edb8f1b279838a0a890bdd6573bac9f7 Proxy-State = 0x323433 Proxying request 9 to home server 198.82.247.67 port 1812 User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address := 198.82.247.103 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type := Framed-User Framed-MTU = 1300 NAS-Port-Type := Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" MS-CHAP-Challenge = 0x20760eb105e545d6a131f324c1d30464 MS-CHAP2-Response = 0x0a4f84e590f059f31dc3ca5b621b238582190000000000000000385984c78f91f816edb8f1b279838a0a890bdd6573bac9f7 Proxy-State = 0x323433 Going to the next request Waking up in 0.9 seconds. Framed-Protocol = PPP Service-Type = Framed-User MS-MPPE-Recv-Key = 0xe32365fe45921738025084f44fd7822a MS-MPPE-Send-Key = 0xf65c13fbcd70a80768ea868ec27085ff MS-CHAP2-Success = 0x0a533d46333146313034313438374339373131303542344546363341364339333146344135424141383434 MS-CHAP-Domain = "\nHOKIES" +- entering group post-proxy rlm_eap: Doing post-proxy callback PEAP: Passing reply from proxy back into the tunnel. PEAP: Passing reply back for EAP-MS-CHAP-V2 +- entering group post-proxy rlm_eap: Doing post-proxy callback rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x1cd469a0 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success ++[eap] returns ok PEAP: Got reply 11 PEAP: Got tunneled Access-Challenge PEAP: Reply was handled ++[eap] returns ok EAP-Message = 0x010b004a1900170301003f084cf62c48fb9b9e951aa3801c9a88bbe2078c7a667df320929296299bdff2863bf8572a744dac5d9409953cda9855feca24aa24b8205677fbf3f7e3767f36 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x764462057f4f7bc59f1c525ed4400d40 Finished request 9. Going to the next request Waking up in 4.9 seconds. User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020b001d19001703010012091d2f1089b72dd14c76daf331c2dc4de167 State = 0x764462057f4f7bc59f1c525ed4400d40 Message-Authenticator = 0xee39bc3d804727c33f69fc7d8172d2bf +- entering group authorize ++[mschap] returns noop rlm_eap: EAP packet type response id 11 length 29 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 PEAP: Setting User-Name to HOKIES\dawson +- entering group authorize ++? if ("%{User-Name}" =~ /^(host\/.*)$/) expand: %{User-Name} -> HOKIES\dawson ? Evaluating ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++? if ("%{User-Name}" =~ /^(host\/.*)$/) -> FALSE ++- entering else else +++[control] returns notfound ++- else else returns notfound PEAP: Calling authenticate in order to initiate tunneled EAP session. +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler ++[eap] returns ok PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS ++[eap] returns handled EAP-Message = 0x010c00261900170301001badffc5c8196273037ffc5ae8b421cb5a11d4cdbf3d67e521a2dd10 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x764462057c487bc59f1c525ed4400d40 Finished request 10. Going to the next request Waking up in 4.9 seconds. User-Name = "HOKIES\\dawson" Calling-Station-Id = "00-1d-e0-90-5f-db" Called-Station-Id = "00-21-55-4d-c4-40:CNS-Test" NAS-Port = 29 NAS-IP-Address = 198.82.171.153 NAS-Identifier = "cas-6509-3.wsm8b" Airespace-Wlan-Id = 17 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1381" EAP-Message = 0x020c00261900170301001be252b19386182f2a3d9b6255f0b51007da074f90f732568c1dfbb8 State = 0x764462057c487bc59f1c525ed4400d40 Message-Authenticator = 0xc04ab29e63cd60e30bfd3fed2ba3be09 +- entering group authorize ++[mschap] returns noop rlm_eap: EAP packet type response id 12 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group EAP rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok perl_pool: item 0x17a6e7a0 asigned new request. Handled so far: 1 found interpetator at address 0x17a6e7a0 rlm_perl: no serial number; assuming non-TLS authentication rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair State = 0x764462057c487bc59f1c525ed4400d40 rlm_perl: Added pair Called-Station-Id = 00-21-55-4d-c4-40:CNS-Test rlm_perl: Added pair Message-Authenticator = 0xc04ab29e63cd60e30bfd3fed2ba3be09 rlm_perl: Added pair Airespace-Wlan-Id = 17 rlm_perl: Added pair EAP-Type = PEAP rlm_perl: Added pair NAS-IP-Address = 198.82.171.153 rlm_perl: Added pair Tunnel-Private-Group-Id = 1381 rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Calling-Station-Id = 00-1d-e0-90-5f-db rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair NAS-Identifier = cas-6509-3.wsm8b rlm_perl: Added pair EAP-Message = 0x020c00261900170301001be252b19386182f2a3d9b6255f0b51007da074f90f732568c1dfbb8 rlm_perl: Added pair NAS-Port = 29 rlm_perl: Added pair Framed-MTU = 1300 rlm_perl: Added pair User-Name = HOKIES\\dawson rlm_perl: Added pair MS-MPPE-Recv-Key = 0x4e3e827b7fb173dbe293fadd607586b838cd55ae5261090fd483569509a070de rlm_perl: Added pair EAP-Message = 0x030c0004 rlm_perl: Added pair MS-MPPE-Send-Key = 0xb43ef9e36d44d66d205184ee8ca81f0f14e3a52cd254bd27268c7c99f58a18b0 rlm_perl: Added pair Message-Authenticator = 0x00000000000000000000000000000000 rlm_perl: Added pair Auth-Type = EAP perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x17a6e7a0 ++[perl] returns ok Login OK: [HOKIES\\\\dawson/<via Auth-Type = EAP>] (from client cas-6509-3.wsm8b port 29 cli 00-1d-e0-90-5f-db) User-Name = "HOKIES\\\\dawson" MS-MPPE-Recv-Key = 0x4e3e827b7fb173dbe293fadd607586b838cd55ae5261090fd483569509a070de EAP-Message = 0x030c0004 MS-MPPE-Send-Key = 0xb43ef9e36d44d66d205184ee8ca81f0f14e3a52cd254bd27268c7c99f58a18b0 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 11. Going to the next request Waking up in 4.9 seconds.

1 1

Authentication fails
by Rajkumar balaji 06 Sep '11

06 Sep '11

Hi All, During the authentication i got the following logs, Please help me to resolve - thanks log info ------- rad_recv: Access-Request packet from host 172.17.148.152 port 40814, id=0, length=63 User-Name = "emsadmin" User-Password = "admin" NAS-Identifier = "sunems8-zone2" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "emsadmin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry emsadmin at line 204 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> emsadmin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 172.17.148.152 port 40814 Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +810 Ready to process requests. rad_recv: Access-Request packet from host 172.17.148.152 port 41694, id=0, length=63 User-Name = "emsadmin" User-Password = "admin" NAS-Identifier = "sunems8-zone2" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "emsadmin", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry emsadmin at line 204 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> emsadmin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 0 to 172.17.148.152 port 41694 Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +3000 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-fails-tp4774303p4774… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Freeradius security limitation
by Jevos, Peter 06 Sep '11

06 Sep '11

Hi all The point is that at one time ntlm_auth stop to work on the primary server. When I test it from the command line it says "No logon server" I noticed in the logs that there were 10 attempts per minute with wrong password from one of our routers. When I applied ACL on the router to block this attempts, ntlm_auth started to work During this time standby radius was able to communicate with AD So the question is if there are some restrictions in freeradius when it will stop to communicate with AD in some special cases ? It happened few times with the same scenario Thanks pet

2 1

RADIUS Sending Duplicate Reply
by Det Det 06 Sep '11

06 Sep '11

Hi, This question maybe a bit off from RADIUS, but is there a way to limit NAS or RADIUS to send only one access-request/access-accept in a single dial attempt? i am connecting via PPPoE. I can see from RADIUS logs receiving multiple access-request thus it is also giving multiple access-accept. How do i prevent this? Coz it is causing an issue "connection is terminated because the remote server did not respond in a timely manner". Then I have to redial again coz the IP does not get assigned to the client. rad_recv: Access-Request packet from host 10.10.11.223 port 1645, id=110, length=93 Sending duplicate reply to client 10.10.11.223 port 1645 - ID: 110 Sending Access-Accept of id 110 to 10.10.11.223 port 1645 thanks!

4 5

Segmentation Fault (core dumped)
by Rajkumar balaji 06 Sep '11

06 Sep '11

Hi All, When I try to start radius using ./radiusd -X the following error I am getting Please help me to resolve this The machine is Sun solaris 10 Sparc FreeRadius verion 1.1.7 is the latest from sunfreeware site output -------- # ./radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Segmentation Fault (core dumped) # -- View this message in context: http://freeradius.1045715.n5.nabble.com/Segmentation-Fault-core-dumped-tp47… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Expiration Module Not Returning the Error Message
by Det Det 06 Sep '11

06 Sep '11

Hi, The expiration module works but it is not returning the error message. Everytime I include the Expiration attribute and set date accordingly. The user is denied login. The reason is because the account expired and NOT because there is "no known good password found" as shown below. How to tell RADIUS to stop processing anything after expiration check? I suspect it proceeds the rest of the checks and so the error message has been overwritten by other modules' error message. +++[sql2] returns ok ++- redundant-load-balance group redundant_load_balance_sql returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop thanks, det

2 2

different acctuniqueids with common keys?
by andrew＠sybaweb.com 06 Sep '11

06 Sep '11

I have a curious problem with my FreeRADIUS 2.1.10 installation. I'm using a PostgresQL backend and something close to the default config. It seems that sometimes (judging from the value of affected sessions this is a fairly rare occurrence) a duplicate entry is added to the radacct table which has a different acctuniqueid to its related duplicate entries. Relevant radconf2xml snippet is: <acct_unique> <key>User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port</key> </acct_unique> Related entries I'm looking at in the radacct table are: username, acctsessionid, nasipaddress, framedipaddress, nasportid. I have checked these with a script and confirmed that I have a number of entries which share all these attributes yet have different acctuniqueids. This is a problem for me since it causes my billing software to overconsume usage. I could change this to not use acctuniqueid, but a fixed acctuniqueid would make my life easier. Any ideas? Best, -AL.

6 7

Re: Pre release of 2.1.12
by ironrake＠yahoo.com 05 Sep '11

05 Sep '11

It is running on one of my production servers. So far no problems, but it has only run for q few hours. Sent from Verizon Wireless

5 13

Conditional Dynamic VLAN
by joaocdc＠gmail.com 05 Sep '11

05 Sep '11

Hello Guys, I need the following in a wireless environment, using 802.1X authentication based on LDAP, need to do dynamic VLAN assignment. Need to consult an LDAP attribute, and from this attribute to determine which VLAN to send to my wireless controler. I need something like this: ... if ( habitantWirelessActive == FALSE ){ update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 100 } }else{ update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 30 } } ... habitantWirelessActive the attribute is the LDAP, each user has this attribute in a Boolean set to TRUE or FALSE. How can I make this check? Another question is about where I make this verification, the correct location is the session post-auth? I thank the attention. João -- João Paulo de Lima Barbosa

1 0