- Freeradius-Users - lists.freeradius.org

EAP-TLS not working with windows 7
by Elias Pereira 07 Mar '22

07 Mar '22

hi, I have set up on our freeradius server EAP-TLS with a user certificate. I put together the user certificate + key + CA server in a .p12 file. At first on android, windows 10 and 11 it is working. My problem is with windows 7. *The freeradius log shows this:* Mon Mar 7 10:40:38 2022 : Debug: (46) eap_tls: (TLS) recv TLS 1.3 Handshake, ClientHello Mon Mar 7 10:40:38 2022 : Debug: (TLS) Ignoring cbtls_msg call with pseudo content type 256, version 0 Mon Mar 7 10:40:38 2022 : Debug: (TLS) Received 2 bytes of TLS data Mon Mar 7 10:40:38 2022 : Debug: (TLS) 02 46 Mon Mar 7 10:40:38 2022 : Debug: (46) eap_tls: (TLS) send TLS 1.0 Alert, fatal protocol_version Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) Alert write:fatal:protocol version Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) Server : Error in error Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) Failed reading from OpenSSL: ../ssl/statem/statem_srvr.c[1661]:error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) System call (I/O) error (-1) Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: (TLS) EAP Receive handshake failed during operation Mon Mar 7 10:40:38 2022 : ERROR: (46) eap_tls: [eaptls process] = fail Mon Mar 7 10:40:38 2022 : ERROR: (46) eap: Failed continuing EAP TLS (13) session. EAP sub-module failed Mon Mar 7 10:40:38 2022 : Debug: (46) eap: Sending EAP Failure (code 4) ID 82 length 4 Mon Mar 7 10:40:38 2022 : Debug: (46) eap: Failed in EAP select Mon Mar 7 10:40:38 2022 : Debug: (46) modsingle[authenticate]: returned from eap (rlm_eap) Mon Mar 7 10:40:38 2022 : Debug: (46) [eap] = invalid Mon Mar 7 10:40:38 2022 : Debug: (46) } # authenticate = invalid Mon Mar 7 10:40:38 2022 : Debug: (46) Failed to authenticate the user In windows 7 client I looked for some information in the event viewer, but found nothing. Anyone else using this method, is having this problem? -- Elias Pereira

3 2

FreeRADIUS acting slow? Check your database(s)
by Network RADIUS 07 Mar '22

07 Mar '22

** My FreeRADIUS server is slow. What’s wrong? --------------------------------------------- If you are encountering performance issues with FreeRADIUS, the first thought is usually to blame FreeRADIUS. In fact, it’s always the database which is the source of a system slowdown. Well, maybe not always, but 99 times out of a 100, it’s the database. It is extremely unlikely that FreeRADIUS is the culprit when you notice slow performance. Here’s how we know. We have run tests running the server with a minimal configuration, i.e. no database, and minimal processing rules. These tests can easily reach 40,000-50,000 packets per second. But when we add a database such as SQL, the performance drops significantly, to around two thousand packets per second. Given that FreeRADIUS alone can handle 40K pps, and FreeRADIUS with a DB can only handle 2K pps, the question is do we blame FreeRADIUS, or the DB for the slow performance? In our experience, the database is almost always the performance bottleneck. Read the full article… https://networkradius.com/articles/2022/01/10/its-always-the-database.html ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/request/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be. Powered by Mailbutler, the email extension that does it all

1 0

Fwd: radiusd -X - command not found - Regarding
by P.Thirunavukkarasu 07 Mar '22

07 Mar '22

*Hi Team,* *Greetings..* *I am getting the message for radiusd -X as "-bash command not found"* *How to do the radiusd -X to identify the issues?* *root@packetfence:~# /etc/init.d/freeradius status● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; disabled; vendor preset: enabled) Active: inactive (dead) Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ <http://wiki.freeradius.org/> http://networkradius.com/doc/ <http://networkradius.com/doc/>----------------------* *root@packetfence:~# /etc/init.d/freeradius startStarting freeradius (via systemctl): freeradius.serviceJob for freeradius.service failed because the control process exited with error code.See "systemctl status freeradius.service" and "journalctl -xe" for details.* *failed!* *----------------------* *root@packetfence:~# systemctl status freeradius.service● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; disabled; vendor p> Active: activating (auto-restart) (Result: exit-code) since Sun 2022-03-06> Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ <http://wiki.freeradius.org/> http://networkradius.com/doc/ <http://networkradius.com/doc/> Process: 3947 ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius (> Process: 3948 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -ls> Process: 3949 ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS (code=e> Main PID: 3949 (code=exited, status=1/FAILURE) CPU: 176msMar 06 19:31:00 packetfence systemd[1]: freeradius.service: Main process exited>Mar 06 19:31:00 packetfence systemd[1]: freeradius.service: Failed with result >Mar 06 19:31:00 packetfence systemd[1]: Failed to start FreeRADIUS multi-protoc>lines 1-16/16 (END)...skipping...● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; disabled; vendor preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Sun 2022-03-06 19:31:00 IST; 2s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ <http://wiki.freeradius.org/> http://networkradius.com/doc/ <http://networkradius.com/doc/> Process: 3947 ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius (code=exited, status=0/SUCCESS) Process: 3948 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Process: 3949 ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS (code=exited, status=1/FAILURE) Main PID: 3949 (code=exited, status=1/FAILURE) CPU: 176msMar 06 19:31:00 packetfence systemd[1]: freeradius.service: Main process exited, code=exited, status=1/FAILUREMar 06 19:31:00 packetfence systemd[1]: freeradius.service: Failed with result 'exit-code'.Mar 06 19:31:00 packetfence systemd[1]: Failed to start FreeRADIUS multi-protocol policy server.* *--------------------* *root@packetfence:~# journalctl -xeMar 06 19:32:58 packetfence freeradius[4676]: Starting - reading configuration files ...Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 20.000000", forcing to "response_window = >Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 30.000000", forcing to "response_window = >Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 30.000000", forcing to "response_window = >Mar 06 19:32:58 packetfence freeradius[4676]: /usr/local/pf/raddb/proxy.conf.inc[20]: Duplicate home server address >Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Control process exited, code=exited, statu>░░ Subject: Unit process exited░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ An ExecStartPre= process belonging to unit packetfence-radiusd-auth.service has exited.░░░░ The process' exit code is 'exited' and its exit status is 1.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Failed with result 'exit-code'.░░ Subject: Unit failed░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service has entered the 'failed' state with result 'exit-code'.Mar 06 19:32:58 packetfence systemd[1]: Failed to start PacketFence FreeRADIUS authentication multi-protocol authent>░░ Subject: A start job for unit packetfence-radiusd-auth.service has failed░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A start job for unit packetfence-radiusd-auth.service has finished with a failure.░░░░ The job identifier is 37980 and the job result is failed.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Consumed 3.214s CPU time.░░ Subject: Resources consumed by unit runtime░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service completed and consumed the indicated resources.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Scheduled restart job, restart counter is >░░ Subject: Automatic restarting of a unit has been scheduled░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ Automatic restarting of the unit packetfence-radiusd-auth.service has been scheduled, as the result for░░ the configured Restart= setting for the unit.Mar 06 19:32:58 packetfence systemd[1]: Stopped PacketFence FreeRADIUS authentication multi-protocol authentication >░░ Subject: A stop job for unit packetfence-radiusd-auth.service has finished░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A stop job for unit packetfence-radiusd-auth.service has finished.░░░░ The job identifier is 38364 and the job result is done.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Consumed 3.214s CPU time.░░ Subject: Resources consumed by unit runtime░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service completed and consumed the indicated resources.Mar 06 19:32:58 packetfence systemd[1]: Starting PacketFence FreeRADIUS authentication multi-protocol authentication>░░ Subject: A start job for unit packetfence-radiusd-auth.service has begun execution░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A start job for unit packetfence-radiusd-auth.service has begun execution.░░░░ The job identifier is 38364.lines 2663-2724/2724 (END)Mar 06 19:32:58 packetfence freeradius[4676]: Starting - reading configuration files ...Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 20.000000", forcing to "response_window = 10.000000"Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 30.000000", forcing to "response_window = 10.000000"Mar 06 19:32:58 packetfence freeradius[4676]: Ignoring "response_window = 30.000000", forcing to "response_window = 10.000000"Mar 06 19:32:58 packetfence freeradius[4676]: /usr/local/pf/raddb/proxy.conf.inc[20]: Duplicate home server address (already in use by eduroam_server2): 144.16.140.190:UDP/1812Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Control process exited, code=exited, status=1/FAILURE░░ Subject: Unit process exited░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ An ExecStartPre= process belonging to unit packetfence-radiusd-auth.service has exited.░░░░ The process' exit code is 'exited' and its exit status is 1.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Failed with result 'exit-code'.░░ Subject: Unit failed░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service has entered the 'failed' state with result 'exit-code'.Mar 06 19:32:58 packetfence systemd[1]: Failed to start PacketFence FreeRADIUS authentication multi-protocol authentication server.░░ Subject: A start job for unit packetfence-radiusd-auth.service has failed░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A start job for unit packetfence-radiusd-auth.service has finished with a failure.░░░░ The job identifier is 37980 and the job result is failed.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Consumed 3.214s CPU time.░░ Subject: Resources consumed by unit runtime░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service completed and consumed the indicated resources.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Scheduled restart job, restart counter is at 107.░░ Subject: Automatic restarting of a unit has been scheduled░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ Automatic restarting of the unit packetfence-radiusd-auth.service has been scheduled, as the result for░░ the configured Restart= setting for the unit.Mar 06 19:32:58 packetfence systemd[1]: Stopped PacketFence FreeRADIUS authentication multi-protocol authentication server.░░ Subject: A stop job for unit packetfence-radiusd-auth.service has finished░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A stop job for unit packetfence-radiusd-auth.service has finished.░░░░ The job identifier is 38364 and the job result is done.Mar 06 19:32:58 packetfence systemd[1]: packetfence-radiusd-auth.service: Consumed 3.214s CPU time.░░ Subject: Resources consumed by unit runtime░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ The unit packetfence-radiusd-auth.service completed and consumed the indicated resources.Mar 06 19:32:58 packetfence systemd[1]: Starting PacketFence FreeRADIUS authentication multi-protocol authentication server...░░ Subject: A start job for unit packetfence-radiusd-auth.service has begun execution░░ Defined-By: systemd░░ Support: https://www.debian.org/support <https://www.debian.org/support>░░░░ A start job for unit packetfence-radiusd-auth.service has begun execution.░░░░ The job identifier is 38364.lines 2663-2724/2724 (END)* *--------------* root@packetfence:~# /etc/init.d/freeradius status ● freeradius.service - FreeRADIUS multi-protocol policy server Loaded: loaded (/lib/systemd/system/freeradius.service; disabled; vendor preset: enabled) Active: activating (auto-restart) (Result: exit-code) since Sun 2022-03-06 19:37:08 IST; 2s ago Docs: man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ http://networkradius.com/doc/ Process: 6189 ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius (code=exited, status=0/SUCCESS) Process: 6191 ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout (code=exited, status=0/SUCCESS) Process: 6192 ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS (code=exited, status=1/FAILURE) Main PID: 6192 (code=exited, status=1/FAILURE) CPU: 176ms Thanks and Regards Thirunavukkarasu

5 6

Accounting issues
by mohamed almeshal 06 Mar '22

06 Mar '22

dear savers ... I struggle with these problems ? please help me to figure out what is going wrong -in Hotspot users always mikrotik give these message " RADIUS accounting request not sent: no response" now I try to figure out what is going on I found that mikrotik some times don't sync with radius for sending data and then I figure that if I don't set Interlam-update it's correct by 85% but in heavy load it's not . So how I can explore the problem and find out what is happening. -I have the free radius set to TLS users and it's work fine but I need to operate UDP users and TLS on same freeradius is that possible. and who I can set those parameters together. Your's Mohammed Almeeshal

2 1

Re: "redundant" block works in "default" virtual server, but does not work in "inner-tunnel"
by Rahman Duran 05 Mar '22

05 Mar '22

Ok, you are right as always :) It is not working as I expect, in default virtual server either (with radtest). But I was sure it was working like this. I made too many changes, maybe. So at least you know what I try to do. How can I achieve this then? I want to use multiple authentication sources, they can be users text file, sql or ldap, and there can be multiple of the same kind, multiple sql, multiple files, multiple ldap. User-Name should be searched in them sequentially and if the user is not found in any of them (noop for files, notfound for sql and ldap), I set the module failure message and reject the request here. The problem is testing for "ok", "noop", "notfound" etc with a following unlang if condition is not working as expected everywhere. So I am using "group" statements as I need to be sure I am checking the correct module return value. Any advice is appreciated. Rahman Duran

2 3

Timeout after invalid login
by Nazar Tareyev 05 Mar '22

05 Mar '22

Hello. We are experiencing some issues when users login with incorrect credentials to local wifi via FreeRadius. After incorrect login, authentication window doesn't show for several minutes, as if it is locked by some kind of timeout. Is there an option in FreeRadius config that controls authentication timeout after entering invalid credentials? Thank you! [https://www.1cb.kz/signature/img/fcb_logo_en.png] Nazar Tareyev Information Security Specialist First Credit Bureau Kazakhstan [https://www.1cb.kz/signature/img/phone-icon.png] +7 727 300 0171<callto:+7%20727%20300%200171> / [https://www.1cb.kz/signature/img/mobile.png] +7 707 105 4491<callto:+7%20707%20105%204491> [https://www.1cb.kz/signature/img/mail.jpg] NTareev(a)1cb.kz<mailto:NTareev@1cb.kz> / [https://www.1cb.kz/signature/img/Skype.png] nazzartareev<skype:nazzartareev?chat> [https://www.1cb.kz/signature/img/web.png] www.1cb.kz<http://www.1cb.kz> [https://www.1cb.kz/signature/img/facebook.png] @1cb.kz<https://www.facebook.com/1cb.kz> [https://www.1cb.kz/signature/img/vk_favicon.png] @1cb.kz<https://vk.com/firstcreditbureau> [https://www.1cb.kz/signature/img/android.png] Android<https://play.google.com/store/apps/details?id=kz.crystalspring.cs_1cb> [https://www.1cb.kz/signature/img/ios.png] iOS<https://itunes.apple.com/uz/app/1cb.kz-pervoe-kreditnoe-buro> [https://www.1cb.kz/signature/img/banner.png]<https://www.1cb.kz/>

2 1

User existence check
by Fred Neich 04 Mar '22

04 Mar '22

1 0

Check if a user exists
by Fred Neich 04 Mar '22

04 Mar '22

1 0

Accounting-On behavior
by Can Paçacı 04 Mar '22

04 Mar '22

Hi, How is the default system behavior when the NAS sends the message "Acct-Status-Type = Accounting-On"? Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

2 1

"redundant" block works in "default" virtual server, but does not work in "inner-tunnel".
by Rahman Duran 03 Mar '22

03 Mar '22

Hi, I am trying to implement a service based authorize section in FreeRadius (just like in Aruba ClearPass) so I can selectively decide what to do with the request based on source IP, SSID, username realm etc. Long story short, the following configuration works in default virtual server but it does not in inner tunnel. In inner-tunnel, if the first ldap section could not find user, then it does not go on and check second ldap; authorize { ..... ..... ..... ### AUTHORIZE: Hizmet verecek servis tanımları buradan itibaren tanımlanacak. ### Bu bölüm olduğu gibi "inner-tunnel" virtual server'ın aynı kısmına kopyalanmalı. ### 000: BIDB Test Ağı Servisi ### ### Test ağı if ( \ ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) \ && (&NAS-Port-Type == "Wireless-802.11") \ && (&Called-Station-SSID == "bidb-test") \ && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) \ ) { update request { ETU-Radius-Service-Name := "BIDB_Test" } if (&Virtual-Server == "inner-tunnel") { update outer.request { ETU-Radius-Service-Name := "BIDB_Test" } } # EAP modülü OK döndürüyorsa işlemleri burada kes, gerisini authentication bölümündeki EAP modülü işleyecek. group etu_eap_process { eap if (ok) { return } } # İstek bir EAP isteği ise ve biz inner-tunnel değil isek burada başka bir kontrol yapma. Bunları inner-tunele bırak if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) { # Authentication source group etu_auth_source { redundant { ldap_personel ldap_ogrenci } # Auth source'da kullanıcı bulunmuyorsa isteği reddet if (noop || notfound) { update request { Module-Failure-Message := "Auth Source Reject: [%{User-Name}] No matching user found in authentication source!" } if (&Virtual-Server == "inner-tunnel") { update outer.request { Module-Failure-Message := "Auth Source Reject: [%{User-Name}] No matching user found in authentication source!" } } reject } } # Authentication modules group etu_auth_modules { pap mschap } } # Servis eşleştiyse burada işleyişi kes, diğer servislere bakma return } ..... ..... ..... The above section is same in both default and inner tunnel, but when doing eap-peap or eap-ttls (so inner-tunnel used), user sarched in [ldap_personel] and not found, so it should search in [ldap_ogrenci] but it does not. Here is the debug section: .... .... .... (633) if ( ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) && (&NAS-Port-Type == "Wireless-802.11") && (&Called-Station-SSID == "bidb-test") && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) ) { (633) EXPAND &Packet-Src-IP-Address (633) --> 10.10.243.23 (633) if ( ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) && (&NAS-Port-Type == "Wireless-802.11") && (&Called-Station-SSID == "bidb-test") && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) ) -> TRUE (633) if ( ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) && (&NAS-Port-Type == "Wireless-802.11") && (&Called-Station-SSID == "bidb-test") && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) ) { (633) update request { (633) ETU-Radius-Service-Name := "BIDB_Test" (633) } # update request = noop (633) if (&Virtual-Server == "inner-tunnel") { (633) EXPAND &Virtual-Server (633) --> inner-tunnel (633) if (&Virtual-Server == "inner-tunnel") -> TRUE (633) if (&Virtual-Server == "inner-tunnel") { (633) update outer.request { (633) ETU-Radius-Service-Name := "BIDB_Test" (633) } # update outer.request = noop (633) } # if (&Virtual-Server == "inner-tunnel") = noop (633) group { (633) eap: No EAP-Message, not doing EAP (633) [eap] = noop (633) if (ok) { (633) if (ok) -> FALSE (633) } # group = noop (633) if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) { (633) EXPAND &Virtual-Server (633) --> inner-tunnel (633) if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) -> TRUE (633) if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) { (633) group { (633) redundant { rlm_ldap (ldap_personel): Closing connection (10): Hit idle_timeout, was idle for 53546 seconds rlm_ldap (ldap_personel): Closing connection (12): Hit idle_timeout, was idle for 53529 seconds rlm_ldap (ldap_personel): Closing connection (11): Hit idle_timeout, was idle for 53522 seconds rlm_ldap (ldap_personel): You probably need to lower "min" rlm_ldap (ldap_personel): Closing connection (13): Hit idle_timeout, was idle for 53521 seconds rlm_ldap (ldap_personel): You probably need to lower "min" rlm_ldap (ldap_personel): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap_personel): Opening additional connection (14), 1 of 32 pending slots used rlm_ldap (ldap_personel): Connecting to ldap://95.183.213.8:389 rlm_ldap (ldap_personel): Waiting for bind result... rlm_ldap (ldap_personel): Bind successful rlm_ldap (ldap_personel): Reserved connection (14) (633) ldap_personel: EXPAND (&(email=%{User-Name})(objectClass=kPerson)) (633) ldap_personel: --> (&(email=ogr1(a)erzurum.edu.tr )(objectClass=kPerson)) (633) ldap_personel: Performing search in "cn=personel,dc=etu" with filter "(&(email=ogr1(a)erzurum.edu.tr)(objectClass=kPerson))", scope "sub" (633) ldap_personel: Waiting for search result... (633) ldap_personel: Search returned no results rlm_ldap (ldap_personel): Released connection (14) Need 1 more connections to reach min connections (2) rlm_ldap (ldap_personel): Opening additional connection (15), 1 of 31 pending slots used rlm_ldap (ldap_personel): Connecting to ldap://95.183.213.8:389 rlm_ldap (ldap_personel): Waiting for bind result... rlm_ldap (ldap_personel): Bind successful (633) [ldap_personel] = notfound (633) } # redundant = notfound (633) if (noop || notfound) { (633) if (noop || notfound) -> TRUE (633) if (noop || notfound) { (633) update request { (633) EXPAND Auth Source Reject: [%{User-Name}] No matching user found in authentication source! (633) --> Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source! (633) Module-Failure-Message := Auth Source Reject: [ ogr1(a)erzurum.edu.tr] No matching user found in authentication source! (633) } # update request = noop (633) if (&Virtual-Server == "inner-tunnel") { (633) EXPAND &Virtual-Server (633) --> inner-tunnel (633) if (&Virtual-Server == "inner-tunnel") -> TRUE (633) if (&Virtual-Server == "inner-tunnel") { (633) update outer.request { (633) EXPAND Auth Source Reject: [%{User-Name}] No matching user found in authentication source! (633) --> Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source! (633) Module-Failure-Message := Auth Source Reject: [ ogr1(a)erzurum.edu.tr] No matching user found in authentication source! (633) } # update outer.request = noop (633) } # if (&Virtual-Server == "inner-tunnel") = noop (633) [reject] = reject (633) } # if (noop || notfound) = reject (633) } # group = reject (633) } # if ((&Virtual-Server == "inner-tunnel") || (!(&Virtual-Server == "inner-tunnel") && !&EAP-Message)) = reject (633) } # if ( ((&Packet-Src-IP-Address < 10.10.243.0/24) || (&Packet-Src-IP-Address == 172.19.148.9/32)) && (&NAS-Port-Type == "Wireless-802.11") && (&Called-Station-SSID == "bidb-test") && (&User-Name =~ /^.+(a)erzurum\.edu\.tr$/) ) = reject (633) } # authorize = reject (633) EXPAND Called-Station-ID: %{Called-Station-ID} Calling-Station-ID: %{Calling-Station-ID} Auth-Type: %{control:Auth-Type} (633) --> Called-Station-ID: a8bd27c04dac Calling-Station-ID: 3233fb9fb6d3 Auth-Type: (633) Invalid user (Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source!): [ogr1(a)erzurum.edu.tr] (from client rektorluk port 0 cli 3233fb9fb6d3 via TLS tunnel) Called-Station-ID: a8bd27c04dac Calling-Station-ID: 3233fb9fb6d3 Auth-Type: (633) Using Post-Auth-Type Reject (633) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (633) Post-Auth-Type REJECT { (633) attr_filter.access_reject: EXPAND %{User-Name} (633) attr_filter.access_reject: --> ogr1(a)erzurum.edu.tr (633) attr_filter.access_reject: Matched entry DEFAULT at line 11 (633) [attr_filter.access_reject] = updated (633) update outer.session-state { (633) &Module-Failure-Message := &request:Module-Failure-Message -> 'Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source!' (633) } # update outer.session-state = noop (633) } # Post-Auth-Type REJECT = updated (633) EXPAND Called-Station-ID: %{Called-Station-ID} Calling-Station-ID: %{Calling-Station-ID} Auth-Type: %{control:Auth-Type} (633) --> Called-Station-ID: a8bd27c04dac Calling-Station-ID: 3233fb9fb6d3 Auth-Type: (633) Login incorrect (Auth Source Reject: [ogr1(a)erzurum.edu.tr] No matching user found in authentication source!): [ogr1(a)erzurum.edu.tr] (from client rektorluk port 0 cli 3233fb9fb6d3 via TLS tunnel) Called-Station-ID: a8bd27c04dac Calling-Station-ID: 3233fb9fb6d3 Auth-Type: (633) } # server inner-tunnel (633) Virtual server sending reply (633) eap_ttls: Got tunneled Access-Reject (633) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed .... .... .... Any idea why "redundant" behaves different in the inner-tunnel or what am I missing? Regards, Rahman Duran

3 3