- Freeradius-Users - lists.freeradius.org

Radius AD authentication issue
by Franck Rakotonindrainy 24 Feb '20

24 Feb '20

Hello the list, I have an issue in my radius authentication and I am unable to understand the cause of the issue, If anybody could point me to some tips for debugging ("same" config works on two other servers) here is part of the debug log : (253) Thu Feb 20 17:21:38 2020: Debug: Received Access-Request Id 170 from 10.211.120.171:49563 to 10.211.120.158:1812 length 514 (253) Thu Feb 20 17:21:38 2020: Debug: Framed-MTU = 1480 (253) Thu Feb 20 17:21:38 2020: Debug: NAS-IP-Address = 192.168.xxx.yyy (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Identifier = "SWAA-FV001234" (253) Thu Feb 20 17:21:38 2020: Debug: User-Name = "host/FV004665.kabi.ads.fresenius.com" (253) Thu Feb 20 17:21:38 2020: Debug: Service-Type = Framed-User (253) Thu Feb 20 17:21:38 2020: Debug: Framed-Protocol = PPP (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port = 40 (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port-Type = Ethernet (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port-Id = "40" (253) Thu Feb 20 17:21:38 2020: Debug: Called-Station-Id = "04-09-73-cc-dd-ee" (253) Thu Feb 20 17:21:38 2020: Debug: Calling-Station-Id = "10-65-30-aa-bb-cc" (253) Thu Feb 20 17:21:38 2020: Debug: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Type:0 = VLAN (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Medium-Type:0 = IEEE-802 (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Private-Group-Id:0 = "1136" (253) Thu Feb 20 17:21:38 2020: Debug: State = 0xfa22c4baff2add06e61b85de3ed7b62c (253) Thu Feb 20 17:21:38 2020: Debug: EAP-Message = 0x020800481900170303003d000000000000000123354593f8cee502592de9ad1a0b7d82103e59ac4049d7de806c086b98762c715fd0d287de74eb9828d7e4c143b6a8b09ddbeafcc5 (253) Thu Feb 20 17:21:38 2020: Debug: Message-Authenticator = 0xe58b264bf83043caafe7f2b4682ac5d7 (253) Thu Feb 20 17:21:38 2020: Debug: MS-RAS-Vendor = 11 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b28 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b2e (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b30 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b3d (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b18 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b19 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0138 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x013a (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0140 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0141 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0151 (253) Thu Feb 20 17:21:38 2020: Debug: PacketFence-KeyBalanced = "df58829ae3956b8619f745de7ed1580b" (253) Thu Feb 20 17:21:38 2020: Debug: Proxy-State = 0x313237 (253) Thu Feb 20 17:21:38 2020: Debug: Restoring &session-state (253) Thu Feb 20 17:21:38 2020: Debug: &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (253) Thu Feb 20 17:21:38 2020: Debug: &session-state:TLS-Session-Version = "TLS 1.2" (253) Thu Feb 20 17:21:38 2020: Debug: # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence (253) Thu Feb 20 17:21:38 2020: Debug: authorize { (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{Packet-Src-IP-Address} (253) Thu Feb 20 17:21:38 2020: Debug: --> 10.211.120.171 (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{Packet-Dst-IP-Address} (253) Thu Feb 20 17:21:38 2020: Debug: --> 10.211.120.158 (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %l (253) Thu Feb 20 17:21:38 2020: Debug: --> 1582215698 (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-realm-if-machine { (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) { (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) { (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{2} (253) Thu Feb 20 17:21:38 2020: Debug: --> kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-realm-if-machine = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-balanced-key-policy { (253) Thu Feb 20 17:21:38 2020: Debug: if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i)) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{md5:%{2}%{1}} (253) Thu Feb 20 17:21:38 2020: Debug: --> 785ef37fa229298f465f6b3eee6eeb38 (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{md5:%{2}%{1}} (253) Thu Feb 20 17:21:38 2020: Debug: --> 785ef37fa229298f465f6b3eee6eeb38 (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if (&PacketFence-KeyBalanced && (&PacketFence-KeyBalanced =~ /^(.*)(.)$/i)) = noop (253) Thu Feb 20 17:21:38 2020: Debug: ... skipping else: Preceding "if" was taken (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-balanced-key-policy = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-tenant-id { (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0"){ (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{%{control:PacketFence-Tenant-Id}:-0} (253) Thu Feb 20 17:21:38 2020: Debug: --> 0 (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: update control { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{User-Name} (253) Thu Feb 20 17:21:38 2020: Debug: --> host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: SQL-User-Name set to 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: Executing select query: SELECT IFNULL((SELECT tenant_id FROM radius_nas WHERE nasname = '192.168.xxx.yyy'), 0) (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{sql: SELECT IFNULL((SELECT tenant_id FROM radius_nas WHERE nasname = '%{NAS-IP-Address}'), 0)} (253) Thu Feb 20 17:21:38 2020: Debug: --> 1 (253) Thu Feb 20 17:21:38 2020: Debug: } # update control = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") = noop (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) { (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-tenant-id = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy rewrite_calling_station_id { (253) Thu Feb 20 17:21:38 2020: Debug: if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: update request { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}} (253) Thu Feb 20 17:21:38 2020: Debug: --> 10:65:30:aa:bb:cc (253) Thu Feb 20 17:21:38 2020: Debug: } # update request = noop (253) Thu Feb 20 17:21:38 2020: Debug: [updated] = updated (253) Thu Feb 20 17:21:38 2020: Debug: } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (253) Thu Feb 20 17:21:38 2020: Debug: ... skipping else: Preceding "if" was taken (253) Thu Feb 20 17:21:38 2020: Debug: } # policy rewrite_calling_station_id = updated (253) Thu Feb 20 17:21:38 2020: Debug: policy rewrite_called_station_id { (253) Thu Feb 20 17:21:38 2020: Debug: if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) { (253) Thu Feb 20 17:21:38 2020: Debug: update request { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}} (253) Thu Feb 20 17:21:38 2020: Debug: --> 04:09:73:cc:dd:ee (253) Thu Feb 20 17:21:38 2020: Debug: } # update request = noop (253) Thu Feb 20 17:21:38 2020: Debug: if ("%{8}") { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{8} (253) Thu Feb 20 17:21:38 2020: Debug: --> (253) Thu Feb 20 17:21:38 2020: Debug: if ("%{8}") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) { (253) Thu Feb 20 17:21:38 2020: Debug: elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: elsif (Aruba-Essid-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: elsif (Aruba-Essid-Name) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) { (253) Thu Feb 20 17:21:38 2020: Debug: elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: [updated] = updated (253) Thu Feb 20 17:21:38 2020: Debug: } # if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) = updated (253) Thu Feb 20 17:21:38 2020: Debug: ... skipping else: Preceding "if" was taken (253) Thu Feb 20 17:21:38 2020: Debug: } # policy rewrite_called_station_id = updated (253) Thu Feb 20 17:21:38 2020: Debug: policy filter_username { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ / /) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ / /) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /@[^@]*@/ ) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /@[^@]*@/ ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.\./ ) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.\./ ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (253) Thu Feb 20 17:21:38 2020: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.$/) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.$/) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /(a)\./) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /(a)\./) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # if (&User-Name) = updated (253) Thu Feb 20 17:21:38 2020: Debug: } # policy filter_username = updated (253) Thu Feb 20 17:21:38 2020: Debug: policy filter_password { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Password && (&User-Password != "%{string:User-Password}")) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy filter_password = updated (253) Thu Feb 20 17:21:38 2020: Debug: [preprocess] = ok (253) Thu Feb 20 17:21:38 2020: Debug: suffix: Request already has destination realm set. Ignoring (253) Thu Feb 20 17:21:38 2020: Debug: [suffix] = noop (253) Thu Feb 20 17:21:38 2020: Debug: ntdomain: Request already has destination realm set. Ignoring (253) Thu Feb 20 17:21:38 2020: Debug: [ntdomain] = noop (253) Thu Feb 20 17:21:38 2020: Debug: eap: Peer sent EAP Response (code 2) ID 8 length 72 (253) Thu Feb 20 17:21:38 2020: Debug: eap: Continuing tunnel setup (253) Thu Feb 20 17:21:38 2020: Debug: [eap] = ok (253) Thu Feb 20 17:21:38 2020: Debug: } # authorize = ok (253) Thu Feb 20 17:21:38 2020: Debug: Found Auth-Type = eap (253) Thu Feb 20 17:21:38 2020: Debug: # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence (253) Thu Feb 20 17:21:38 2020: Debug: authenticate { (253) Thu Feb 20 17:21:38 2020: Debug: eap: Expiring EAP session with state 0xfa22c4baff2add06 (253) Thu Feb 20 17:21:38 2020: Debug: eap: Finished EAP session with state 0xfa22c4baff2add06 (253) Thu Feb 20 17:21:38 2020: Debug: eap: Previous EAP request found for state 0xfa22c4baff2add06, released from the list (253) Thu Feb 20 17:21:38 2020: Debug: eap: Peer sent packet with method EAP PEAP (25) (253) Thu Feb 20 17:21:38 2020: Debug: eap: Calling submodule eap_peap to process data (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Continuing EAP-TLS (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: [eaptls verify] = ok (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Done initial handshake (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: [eaptls process] = ok (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Session established. Decoding tunneled attributes (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: PEAP state WAITING FOR INNER IDENTITY (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Identity - host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Got inner identity 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Setting default EAP type for tunneled EAP session (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Got tunneled request (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: EAP-Message = 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Setting User-Name to host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Sending tunneled request to packetfence-tunnel (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: EAP-Message = 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: User-Name = "host/FV004665.kabi.ads.fresenius.com" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Framed-MTU = 1480 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-IP-Address = 192.168.xxx.yyy (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-Identifier = "SWAA-FV001234" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Service-Type = Framed-User (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Framed-Protocol = PPP (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-Port = 40 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-Port-Type = Ethernet (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: NAS-Port-Id = "40" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Calling-Station-Id := "10:65:30:aa:bb:cc" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Tunnel-Type:0 = VLAN (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Tunnel-Medium-Type:0 = IEEE-802 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Tunnel-Private-Group-Id:0 = "1136" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: MS-RAS-Vendor = 11 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b28 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b2e (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b30 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b3d (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b18 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x011a0000000b19 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x0138 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x013a (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x0140 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x0141 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: HP-Capability-Advert = 0x0151 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: PacketFence-KeyBalanced := "785ef37fa229298f465f6b3eee6eeb38" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: PacketFence-Radius-Ip := "10.211.120.158" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Called-Station-Id := "04:09:73:cc:dd:ee" (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Event-Timestamp = "févr. 20 2020 17:21:38 CET" (253) Thu Feb 20 17:21:38 2020: Debug: Virtual server packetfence-tunnel received request (253) Thu Feb 20 17:21:38 2020: Debug: EAP-Message = 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d (253) Thu Feb 20 17:21:38 2020: Debug: FreeRADIUS-Proxied-To = 127.0.0.1 (253) Thu Feb 20 17:21:38 2020: Debug: User-Name = "host/FV004665.kabi.ads.fresenius.com" (253) Thu Feb 20 17:21:38 2020: Debug: Framed-MTU = 1480 (253) Thu Feb 20 17:21:38 2020: Debug: NAS-IP-Address = 192.168.xxx.yyy (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Identifier = "SWAA-FV001234" (253) Thu Feb 20 17:21:38 2020: Debug: Service-Type = Framed-User (253) Thu Feb 20 17:21:38 2020: Debug: Framed-Protocol = PPP (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port = 40 (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port-Type = Ethernet (253) Thu Feb 20 17:21:38 2020: Debug: NAS-Port-Id = "40" (253) Thu Feb 20 17:21:38 2020: Debug: Calling-Station-Id := "10:65:30:aa:bb:cc" (253) Thu Feb 20 17:21:38 2020: Debug: Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Type:0 = VLAN (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Medium-Type:0 = IEEE-802 (253) Thu Feb 20 17:21:38 2020: Debug: Tunnel-Private-Group-Id:0 = "1136" (253) Thu Feb 20 17:21:38 2020: Debug: MS-RAS-Vendor = 11 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b28 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b2e (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b30 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b3d (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b18 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x011a0000000b19 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0138 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x013a (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0140 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0141 (253) Thu Feb 20 17:21:38 2020: Debug: HP-Capability-Advert = 0x0151 (253) Thu Feb 20 17:21:38 2020: Debug: PacketFence-KeyBalanced := "785ef37fa229298f465f6b3eee6eeb38" (253) Thu Feb 20 17:21:38 2020: Debug: PacketFence-Radius-Ip := "10.211.120.158" (253) Thu Feb 20 17:21:38 2020: Debug: Called-Station-Id := "04:09:73:cc:dd:ee" (253) Thu Feb 20 17:21:38 2020: Debug: Event-Timestamp = "févr. 20 2020 17:21:38 CET" (253) Thu Feb 20 17:21:38 2020: WARNING: Outer and inner identities are the same. User privacy is compromised. (253) Thu Feb 20 17:21:38 2020: Debug: server packetfence-tunnel { (253) Thu Feb 20 17:21:38 2020: Debug: # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel (253) Thu Feb 20 17:21:38 2020: Debug: authorize { (253) Thu Feb 20 17:21:38 2020: Debug: if ( outer.EAP-Type == TTLS) { (253) Thu Feb 20 17:21:38 2020: Debug: if ( outer.EAP-Type == TTLS) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-realm-if-machine { (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) { (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) { (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{2} (253) Thu Feb 20 17:21:38 2020: Debug: --> kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if (User-Name =~ /host\/([a-z0-9_-]*)[\.](.*)/i) = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-realm-if-machine = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-tenant-id { (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0"){ (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{%{control:PacketFence-Tenant-Id}:-0} (253) Thu Feb 20 17:21:38 2020: Debug: --> 0 (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: update control { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{User-Name} (253) Thu Feb 20 17:21:38 2020: Debug: --> host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: SQL-User-Name set to 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: Executing select query: SELECT IFNULL((SELECT tenant_id FROM radius_nas WHERE nasname = '192.168.xxx.yyy'), 0) (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{sql: SELECT IFNULL((SELECT tenant_id FROM radius_nas WHERE nasname = '%{NAS-IP-Address}'), 0)} (253) Thu Feb 20 17:21:38 2020: Debug: --> 1 (253) Thu Feb 20 17:21:38 2020: Debug: } # update control = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") = noop (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) { (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-tenant-id = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy filter_username { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) -> TRUE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ / /) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ / /) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /@[^@]*@/ ) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /@[^@]*@/ ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.\./ ) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.\./ ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (253) Thu Feb 20 17:21:38 2020: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.$/) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /\.$/) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /(a)\./) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name =~ /(a)\./) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # if (&User-Name) = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # policy filter_username = noop (253) Thu Feb 20 17:21:38 2020: Debug: [mschap] = noop (253) Thu Feb 20 17:21:38 2020: Debug: suffix: Request already has destination realm set. Ignoring (253) Thu Feb 20 17:21:38 2020: Debug: [suffix] = noop (253) Thu Feb 20 17:21:38 2020: Debug: ntdomain: Request already has destination realm set. Ignoring (253) Thu Feb 20 17:21:38 2020: Debug: [ntdomain] = noop (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '192.168.xxx.yyy' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '40' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Framed-MTU'} = &request:Framed-MTU -> '1480' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Called-Station-Id'} = &request:Called-Station-Id -> '04:09:73:cc:dd:ee' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '10:65:30:aa:bb:cc' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'SWAA-FV001234' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Tunnel-Type'} = &request:Tunnel-Type -> 'VLAN' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Tunnel-Medium-Type'} = &request:Tunnel-Medium-Type -> 'IEEE-802' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Tunnel-Private-Group-Id'} = &request:Tunnel-Private-Group-Id -> '1136' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'févr. 20 2020 17:21:38 CET' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Connect-Info'} = &request:Connect-Info -> 'CONNECT Ethernet 100Mbps Full duplex' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'EAP-Message'} = &request:EAP-Message -> '0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> '40' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'FreeRADIUS-Proxied-To'} = &request:FreeRADIUS-Proxied-To -> '127.0.0.1' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[0] = &request:HP-Capability-Advert -> '0x011a0000000b28' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[1] = &request:HP-Capability-Advert -> '0x011a0000000b2e' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[2] = &request:HP-Capability-Advert -> '0x011a0000000b30' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[3] = &request:HP-Capability-Advert -> '0x011a0000000b3d' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[4] = &request:HP-Capability-Advert -> '0x011a0000000b18' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[5] = &request:HP-Capability-Advert -> '0x011a0000000b19' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[6] = &request:HP-Capability-Advert -> '0x0138' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[7] = &request:HP-Capability-Advert -> '0x013a' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[8] = &request:HP-Capability-Advert -> '0x0140' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[9] = &request:HP-Capability-Advert -> '0x0141' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'HP-Capability-Advert'}[10] = &request:HP-Capability-Advert -> '0x0151' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'MS-RAS-Vendor'} = &request:MS-RAS-Vendor -> '11' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'Realm'} = &request:Realm -> 'kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'SQL-User-Name'} = &request:SQL-User-Name -> 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'PacketFence-KeyBalanced'} = &request:PacketFence-KeyBalanced -> '785ef37fa229298f465f6b3eee6eeb38' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_REQUEST{'PacketFence-Radius-Ip'} = &request:PacketFence-Radius-Ip -> '10.211.120.158' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_CHECK{'EAP-Type'} = &control:EAP-Type -> 'MSCHAPv2' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_CHECK{'PacketFence-Tenant-Id'} = &control:PacketFence-Tenant-Id -> '1' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_CONFIG{'EAP-Type'} = &control:EAP-Type -> 'MSCHAPv2' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: $RAD_CONFIG{'PacketFence-Tenant-Id'} = &control:PacketFence-Tenant-Id -> '1' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: perl_embed:: module = /usr/local/pf/raddb/mods-config/perl/packetfence-multi-domain.pm , func = authorize exit status= hash- or arrayref expected (not a simple scalar, use allow_nonref to allow this) at /usr/local/pf/lib/pfconfig/cached.pm line 182. (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '40' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Tunnel-Medium-Type:0 = $RAD_REQUEST{'Tunnel-Medium-Type:0'} -> 'IEEE-802' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '192.168.xxx.yyy' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Connect-Info = $RAD_REQUEST{'Connect-Info'} -> 'CONNECT Ethernet 100Mbps Full duplex' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Framed-MTU = $RAD_REQUEST{'Framed-MTU'} -> '1480' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '10:65:30:aa:bb:cc' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Tunnel-Private-Group-Id:0 = $RAD_REQUEST{'Tunnel-Private-Group-Id:0'} -> '1136' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:PacketFence-KeyBalanced = $RAD_REQUEST{'PacketFence-KeyBalanced'} -> '785ef37fa229298f465f6b3eee6eeb38' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Realm = $RAD_REQUEST{'Realm'} -> 'kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:SQL-User-Name = $RAD_REQUEST{'SQL-User-Name'} -> 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> '40' (253) Thu Feb 20 17:21:38 2020: ERROR: packetfence-multi-domain: Failed to create pair - failed to parse time string "févr. 20 2020 17:21:38 CET" (253) Thu Feb 20 17:21:38 2020: ERROR: packetfence-multi-domain: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'févr. 20 2020 17:21:38 CET' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Called-Station-Id = $RAD_REQUEST{'Called-Station-Id'} -> '04:09:73:cc:dd:ee' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:PacketFence-Radius-Ip = $RAD_REQUEST{'PacketFence-Radius-Ip'} -> '10.211.120.158' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'SWAA-FV001234' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:MS-RAS-Vendor = $RAD_REQUEST{'MS-RAS-Vendor'} -> '11' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Tunnel-Type:0 = $RAD_REQUEST{'Tunnel-Type:0'} -> 'VLAN' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:FreeRADIUS-Proxied-To = $RAD_REQUEST{'FreeRADIUS-Proxied-To'} -> '127.0.0.1' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} -> '0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b28' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b2e' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b30' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b3d' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b18' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x011a0000000b19' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x0138' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x013a' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x0140' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x0141' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:HP-Capability-Advert += $RAD_REQUEST{'HP-Capability-Advert'} -> '0x0151' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &control:EAP-Type = $RAD_CHECK{'EAP-Type'} -> 'MSCHAPv2' (253) Thu Feb 20 17:21:38 2020: Debug: packetfence-multi-domain: &control:PacketFence-Tenant-Id = $RAD_CHECK{'PacketFence-Tenant-Id'} -> '1' (253) Thu Feb 20 17:21:38 2020: Debug: [packetfence-multi-domain] = fail (253) Thu Feb 20 17:21:38 2020: Debug: } # authorize = fail (253) Thu Feb 20 17:21:38 2020: Debug: Using Post-Auth-Type Reject (253) Thu Feb 20 17:21:38 2020: Debug: # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel (253) Thu Feb 20 17:21:38 2020: Debug: Post-Auth-Type REJECT { (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-set-tenant-id { (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0"){ (253) Thu Feb 20 17:21:38 2020: Debug: if (!NAS-IP-Address || NAS-IP-Address == "0.0.0.0") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{%{control:PacketFence-Tenant-Id}:-0} (253) Thu Feb 20 17:21:38 2020: Debug: --> 1 (253) Thu Feb 20 17:21:38 2020: Debug: if ( "%{%{control:PacketFence-Tenant-Id}:-0}" == "0") -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) { (253) Thu Feb 20 17:21:38 2020: Debug: if ( &control:PacketFence-Tenant-Id == 0 ) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-set-tenant-id = noop (253) Thu Feb 20 17:21:38 2020: Debug: update { (253) Thu Feb 20 17:21:38 2020: Debug: } # update = noop (253) Thu Feb 20 17:21:38 2020: Debug: policy packetfence-audit-log-reject { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name && (&User-Name == "dummy")) { (253) Thu Feb 20 17:21:38 2020: Debug: if (&User-Name && (&User-Name == "dummy")) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: else { (253) Thu Feb 20 17:21:38 2020: Debug: policy request-timing { (253) Thu Feb 20 17:21:38 2020: Debug: if ("%{%{control:PacketFence-Request-Time}:-0}" != 0) { (253) Thu Feb 20 17:21:38 2020: Debug: EXPAND %{%{control:PacketFence-Request-Time}:-0} (253) Thu Feb 20 17:21:38 2020: Debug: --> 0 (253) Thu Feb 20 17:21:38 2020: Debug: if ("%{%{control:PacketFence-Request-Time}:-0}" != 0) -> FALSE (253) Thu Feb 20 17:21:38 2020: Debug: } # policy request-timing = noop (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: EXPAND type.reject.query (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: --> type.reject.query (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: Using query template 'query' (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: EXPAND %{User-Name} (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: --> host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: SQL-User-Name set to 'host/FV004665.kabi.ads.fresenius.com' (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: EXPAND INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time, tenant_id, radius_ip) VALUES ( '%{request:Calling-Station-Id}', '%{request:Framed-IP-Address}', '%{%{control:PacketFence-Computer-Name}:-N/A}', '%{request:User-Name}', '%{request:Stripped-User-Name}', '%{request:Realm}', 'Radius-Access-Request', '%{%{control:PacketFence-Switch-Id}:-N/A}', '%{%{control:PacketFence-Switch-Mac}:-N/A}', '%{%{control:PacketFence-Switch-Ip-Address}:-N/A}', '%{Packet-Src-IP-Address}', '%{request:Called-Station-Id}', '%{request:Calling-Station-Id}', '%{request:NAS-Port-Type}', '%{request:Called-Station-SSID}', '%{request:NAS-Port-Id}', '%{%{control:PacketFence-IfIndex}:-N/A}', '%{request:NAS-Port}', '%{%{control:PacketFence-Connection-Type}:-N/A}', '%{request:NAS-IP-Address}', '%{request:NAS-Identifier}', 'Reject', '%{request:Module-Failure-Message}', '%{control:Auth-Type}', '%{request:EAP-Type}', '%{%{control:PacketFence-Role}:-N/A}', '%{%{control:PacketFence-Status}:-N/A}', '%{%{control:PacketFence-Profile}:-N/A}', '%{%{control:PacketFence-Source}:-N/A}', '%{%{control:PacketFence-AutoReg}:-0}', '%{%{control:PacketFence-IsPhone}:-0}', '%{request:PacketFence-Domain}', '', '%{pairs:&request:[*]}','%{pairs:&reply:[*]}', '%{%{control:PacketFence-Request-Time}:-N/A}', '%{control:PacketFence-Tenant-Id}', '%{request:PacketFence-Radius-Ip}') (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: --> INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time, tenant_id, radius_ip) VALUES ( '10:65:30:aa:bb:cc', '', 'N/A', 'host/FV004665.kabi.ads.fresenius.com', '', 'kabi.ads.fresenius.com', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '10.211.120.171', '04:09:73:cc:dd:ee', '10:65:30:aa:bb:cc', 'Ethernet', '', '40', 'N/A', '40', 'N/A', '192.168.xxx.yyy', 'SWAA-FV001234', 'Reject', '', '', '', 'N/A', 'N/A', 'N/A', 'N/A', '0', '0', '', '', 'NAS-Port =3D 40=2C Tunnel-Medium-Type:0 =3D IEEE-802=2C NAS-IP-Address =3D 192.168.xxx.yyy=2C Connect-Info =3D =22CONNECT Ethernet 100Mbps Full duplex=22=2C Framed-MTU =3D 1480=2C Calling-Station-Id =3D =2210:65:30:aa:bb:cc=22=2C NAS-Port-Type =3D Ethernet=2C Tunnel-Private-Group-Id:0 =3D =221136=22=2C PacketFence-KeyBalanced =3D =22785ef37fa229298f465f6b3eee6eeb38=22=2C Realm =3D =22kabi.ads.fresenius.com=22=2C User-Name =3D =22host/FV004665.kabi.ads.fresenius.com=22=2C Framed-Protocol =3D PPP=2C NAS-Port-Id =3D =2240=22=2C Event-Timestamp =3D =22janv. 1 1970 01:00:00 CET=22=2C Called-Station-Id =3D =2204:09:73:cc:dd:ee=22=2C PacketFence-Radius-Ip =3D =2210.211.120.158=22=2C NAS-Identifier =3D =22SWAA-FV001234=22=2C MS-RAS-Vendor =3D 11=2C Tunnel-Type:0 =3D VLAN=2C FreeRADIUS-Proxied-To =3D 127.0.0.1=2C EAP-Message =3D 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d=2C HP-Capability-Advert =3D 0x011a0000000b28=2C HP-Capability-Advert =3D 0x011a0000000b2e=2C HP-Capability-Advert =3D 0x011a0000000b30=2C HP-Capability-Advert =3D 0x011a0000000b3d=2C HP-Capability-Advert =3D 0x011a0000000b18=2C HP-Capability-Advert =3D 0x011a0000000b19=2C HP-Capability-Advert =3D 0x0138=2C HP-Capability-Advert =3D 0x013a=2C HP-Capability-Advert =3D 0x0140=2C HP-Capability-Advert =3D 0x0141=2C HP-Capability-Advert =3D 0x0151=2C Service-Type =3D Framed-User=2C User-Password =3D =22=2A=2A=2A=2A=2A=2A=22=2C SQL-User-Name =3D =22host/FV004665.kabi.ads.fresenius.com=22','', 'N/A', '1', '10.211.120.158') (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: Executing query: INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time, tenant_id, radius_ip) VALUES ( '10:65:30:aa:bb:cc', '', 'N/A', 'host/FV004665.kabi.ads.fresenius.com', '', 'kabi.ads.fresenius.com', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '10.211.120.171', '04:09:73:cc:dd:ee', '10:65:30:aa:bb:cc', 'Ethernet', '', '40', 'N/A', '40', 'N/A', '192.168.xxx.yyy', 'SWAA-FV001234', 'Reject', '', '', '', 'N/A', 'N/A', 'N/A', 'N/A', '0', '0', '', '', 'NAS-Port =3D 40=2C Tunnel-Medium-Type:0 =3D IEEE-802=2C NAS-IP-Address =3D 192.168.xxx.yyy=2C Connect-Info =3D =22CONNECT Ethernet 100Mbps Full duplex=22=2C Framed-MTU =3D 1480=2C Calling-Station-Id =3D =2210:65:30:aa:bb:cc=22=2C NAS-Port-Type =3D Ethernet=2C Tunnel-Private-Group-Id:0 =3D =221136=22=2C PacketFence-KeyBalanced =3D =22785ef37fa229298f465f6b3eee6eeb38=22=2C Realm =3D =22kabi.ads.fresenius.com=22=2C User-Name =3D =22host/FV004665.kabi.ads.fresenius.com=22=2C Framed-Protocol =3D PPP=2C NAS-Port-Id =3D =2240=22=2C Event-Timestamp =3D =22janv. 1 1970 01:00:00 CET=22=2C Called-Station-Id =3D =2204:09:73:cc:dd:ee=22=2C PacketFence-Radius-Ip =3D =2210.211.120.158=22=2C NAS-Identifier =3D =22SWAA-FV001234=22=2C MS-RAS-Vendor =3D 11=2C Tunnel-Type:0 =3D VLAN=2C FreeRADIUS-Proxied-To =3D 127.0.0.1=2C EAP-Message =3D 0x0208002901686f73742f46563030343636352e6b6162692e6164732e66726573656e6975732e636f6d=2C HP-Capability-Advert =3D 0x011a0000000b28=2C HP-Capability-Advert =3D 0x011a0000000b2e=2C HP-Capability-Advert =3D 0x011a0000000b30=2C HP-Capability-Advert =3D 0x011a0000000b3d=2C HP-Capability-Advert =3D 0x011a0000000b18=2C HP-Capability-Advert =3D 0x011a0000000b19=2C HP-Capability-Advert =3D 0x0138=2C HP-Capability-Advert =3D 0x013a=2C HP-Capability-Advert =3D 0x0140=2C HP-Capability-Advert =3D 0x0141=2C HP-Capability-Advert =3D 0x0151=2C Service-Type =3D Framed-User=2C User-Password =3D =22=2A=2A=2A=2A=2A=2A=22=2C SQL-User-Name =3D =22host/FV004665.kabi.ads.fresenius.com=22','', 'N/A', '1', '10.211.120.158') (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: SQL query returned: success (253) Thu Feb 20 17:21:38 2020: Debug: sql_reject: 1 record(s) updated (253) Thu Feb 20 17:21:38 2020: Debug: [sql_reject] = ok (253) Thu Feb 20 17:21:38 2020: Debug: } # else = ok (253) Thu Feb 20 17:21:38 2020: Debug: } # policy packetfence-audit-log-reject = ok (253) Thu Feb 20 17:21:38 2020: Debug: attr_filter.access_reject: EXPAND %{User-Name} (253) Thu Feb 20 17:21:38 2020: Debug: attr_filter.access_reject: --> host/FV004665.kabi.ads.fresenius.com (253) Thu Feb 20 17:21:38 2020: Debug: attr_filter.access_reject: Matched entry DEFAULT at line 11 (253) Thu Feb 20 17:21:38 2020: Debug: [attr_filter.access_reject] = updated (253) Thu Feb 20 17:21:38 2020: Debug: update outer.session-state { (253) Thu Feb 20 17:21:38 2020: Debug: No attributes updated for RHS &request:Module-Failure-Message (253) Thu Feb 20 17:21:38 2020: Debug: } # update outer.session-state = noop (253) Thu Feb 20 17:21:38 2020: Debug: } # Post-Auth-Type REJECT = updated (253) Thu Feb 20 17:21:38 2020: Debug: } # server packetfence-tunnel (253) Thu Feb 20 17:21:38 2020: Debug: Virtual server sending reply (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Got tunneled reply code 3 (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: Tunneled authentication was rejected (253) Thu Feb 20 17:21:38 2020: Debug: eap_peap: FAILURE (253) Thu Feb 20 17:21:38 2020: Debug: eap: Sending EAP Request (code 1) ID 9 length 46 (253) Thu Feb 20 17:21:38 2020: Debug: eap: EAP session adding &reply:State = 0xfa22c4bafc2bdd06 (253) Thu Feb 20 17:21:38 2020: Debug: [eap] = handled (253) Thu Feb 20 17:21:38 2020: Debug: } # authenticate = handled (253) Thu Feb 20 17:21:38 2020: Debug: Using Post-Auth-Type Challenge (253) Thu Feb 20 17:21:38 2020: Debug: Post-Auth-Type sub-section not found. Ignoring. (253) Thu Feb 20 17:21:38 2020: Debug: # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence (253) Thu Feb 20 17:21:38 2020: Debug: session-state: Saving cached attributes (253) Thu Feb 20 17:21:38 2020: Debug: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (253) Thu Feb 20 17:21:38 2020: Debug: TLS-Session-Version = "TLS 1.2" (253) Thu Feb 20 17:21:38 2020: Debug: Sent Access-Challenge Id 170 from 10.211.120.158:1812 to 10.211.120.171:49563 length 0 (253) Thu Feb 20 17:21:38 2020: Debug: EAP-Message = 0x0109002e190017030300234e17d2e7d99c021227e423d81418fe42c210ab655c8f76b79125105cc4f39aa16ae0fd (253) Thu Feb 20 17:21:38 2020: Debug: Message-Authenticator = 0x00000000000000000000000000000000 (253) Thu Feb 20 17:21:38 2020: Debug: State = 0xfa22c4bafc2bdd06e61b85de3ed7b62c (253) Thu Feb 20 17:21:38 2020: Debug: Proxy-State = 0x313237 (253) Thu Feb 20 17:21:38 2020: Debug: Finished request Thank you Franck R

2 2

OpenDirectory Authentication fails with eap but works with pap
by Ashley Drees 24 Feb '20

24 Feb '20

I have recently had to migrate my FreeRADIUS from one sick OpenDirectory server to a "fresh" one. FreeRadius was hard crashing whenever it got an eap authentication request on the "sick" server, on the newly promoted server it runs without crashing. the config checks out with XC and running as X works as expected. when I use (from a remote machine) radtest -x -t pap radiustest 2020Password 192.168.9.23 0 testing123 I get Received Access-Accept Id 139 from 192.168.9.23:1812 to 0.0.0.0:0 length 20 from the debug:- suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "radiustest", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: No EAP-Message, not doing EAP (3) [eap] = noop (3) [files] = noop (3) opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. (3) opendirectory: The host 192.168.9.9 does not have an access group. (3) opendirectory: no access control groups, all users allowed (3) opendirectory: Setting Auth-Type = opendirectory (3) [opendirectory] = ok (3) [expiration] = noop (3) [logintime] = noop Not doing PAP as Auth-Type is already set. (3) [pap] = noop (3) } # authorize = ok so with pap it seems to talk to OD nicely.. however... if i try and authenticate with the same id trying to auth for WiFI (unifi access points) i get a fail and the offending stanza in the debug is (11) eap_mschapv2: authenticate { (11) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (11) mschap: No NT-Password configured. Trying OpenDirectory Authentication (11) mschap: OD username_string = radiustest, OD shortUserName= (length = 0) (11) mschap: Stepbuf server challenge : 7972ffffffca6a52ffffffeb695bffffff87fffffffd46ffffffa4ffffffef18ffffffc9ffffffa0 (11) mschap: Stepbuf peer challenge : 37ffffffa043ffffffcdffffffe62503fffffffeffffffdf6f5cffffffd849ffffffb4ffffff8dffffffd2 (11) mschap: Stepbuf p24 : ffffffcdffffffc2ffffffd727472866ffffffd0fffffffe2fffffffa8263e5bffffffc150ffffff997fffffff90ffffffbbffffffb13dffffffeeffffff86 (11) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError I am a bit stuck with this, I am unsure why pap it works and it fails with eap. I did not fill this post with random logs, but if you have any ideas I can capture logs/configs etc as needed. Thanks in advance. I did have this working on the previous OD master, but a security update seemed to stop it working hence my migration efforts, I have followed the same "migration" document from Apple, but to be honest, after several days messing around I am just about ready to run up a VM and put FreeNAS into an Ubuntu box (if only I could be sure it would get its auth from OD) Ash -- -- ****Conciliation Resources | ****www.c-r.org <http://www.c-r.org/> **********Burghley Yard, 106 Burghley Road, London NW5 1AL UK *Why does inclusion matter for peace? Download our Accord <https://www.c-r.org/accord/inclusion-peace-processes> and explore our infographic <https://www.c-r.org/news-and-views/news/infographic-inclusion-why-does-it-m…> to find out.* Sign up <http://www.c-r.org/newsletter/subscribe> to our e-newsletter. See our latest updates on Twitter @CRbuildpeace <https://twitter.com/crbuildpeace> and _Facebook <https://www.facebook.com/ConciliationResources>*.*_ ***Charity registered in England and Wales (1055436). Company limited by guarantee registered in England and Wales (03196482) *** -- ***** **********This email is intended only for the named addressee(s) and may contain confidential and/or privileged material. If you have received this email in error, please notify Conciliation Resources immediately by emailing cr(a)c-r.org <mailto:cr@c-r.org> and delete the message. * * * *** ** ******* * *

2 1

Freeradius and unexpected TLS version ->Access-Reject
by iilinasi 24 Feb '20

24 Feb '20

Hello everyone! I have a weird issue with freeradius 3.0.16. I try to implement an auth exchange with the RADIUS, requesting EAP-TLS. At this moment I only need to get to the phase when server responds with Access-Challenge with server certificate (so, 2 packets from NAD and 2 from the server). To generate NAD-side packets I use python3 with scapy. Freeradius was set up to use EAP-TLS for test user auth. First access-request from the NAD side is responded with Access-Challenge from the server. So far so good. But when I send the second packet, I receive an Access-Reject. Suprisingly, the server reports I'm using unsupported TLS version ?0304?. Why "surprizingly"? Well, because I use earlier TLS version, and it is well visible even in server debugs (if you check "eap message" part, where is "0301"). I also checked in Wireshark (captured both on the server machine and "NAD" machine) - the packet is correctly dissected by latest wireshark and has TLS1.1 inside. Caching is disabled. OpenSSL is already at the newest version (1.1.1-1ubuntu2.1~18.04.5). I tried to rebuild my VM from scratch (so again, installed Ubuntu 18, freeradius 3.0.16, etc) - but the issue persists. Here is the debug: Ready to process requests (0) Received Access-Request Id 200 from 192.168.0.14:53256 to 192.168.0.59:1812 length 67 (0) Service-Type = Framed-User (0) User-Name = "test" (0) Framed-MTU = 1500 (0) EAP-Message = 0x020500090174657374 (0) Message-Authenticator = 0xefe697c97fd0118935d39e9a25d6baff (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]@/ ) { (0) if (&User-Name =~ /@[^@]@/ ) -> FALSE (0) if (&User-Name =~ /../ ) { (0) if (&User-Name =~ /../ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) -> FALSE (0) if (&User-Name =~ /.$/) { (0) if (&User-Name =~ /.$/) -> FALSE (0) if (&User-Name =~ /@./) { (0) if (&User-Name =~ /@./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Feb 14 15:03:01 2020 (0) [auth_log] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "test", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 5 length 9 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_tls to process data (0) eap_tls: Initiating new EAP-TLS session (0) eap_tls: Setting verify mode to require certificate from client (0) eap_tls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 6 length 6 (0) eap: EAP session adding &reply:State = 0xe879495de87f44cf (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 200 from 192.168.0.59:1812 to 192.168.0.14:53256 length 0 (0) EAP-Message = 0x010600060d20 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xe879495de87f44cfa950f055cfc4b84d (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 201 from 192.168.0.14:53256 to 192.168.0.59:1812 length 163 (1) Service-Type = Framed-User (1) User-Name = "test" (1) Framed-MTU = 1500 (1) EAP-Message = 0x020600570d800000004d16030100480100004403015e43c51b0000000000000000000000000000000000000000000000000000000000001600040005000a0009006400620003000600130012006301000005ff01000100 (1) State = 0xe879495de87f44cfa950f055cfc4b84d (1) Message-Authenticator = 0x70eca9c059289b575655c08683064d67 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]@/ ) { (1) if (&User-Name =~ /@[^@]@/ ) -> FALSE (1) if (&User-Name =~ /../ ) { (1) if (&User-Name =~ /../ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+).(.+)$/)) -> FALSE (1) if (&User-Name =~ /.$/) { (1) if (&User-Name =~ /.$/) -> FALSE (1) if (&User-Name =~ /@./) { (1) if (&User-Name =~ /@./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (1) auth_log: --> /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (1) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.0.14/auth-detail-20200214 (1) auth_log: EXPAND %t (1) auth_log: --> Fri Feb 14 15:03:01 2020 (1) [auth_log] = ok (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "test", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 6 length 87 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xe879495de87f44cf (1) eap: Finished EAP session with state 0xe879495de87f44cf (1) eap: Previous EAP request found for state 0xe879495de87f44cf, released from the list (1) eap: Peer sent packet with method EAP TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: Continuing EAP-TLS (1) eap_tls: Peer indicated complete TLS record size will be 77 bytes (1) eap_tls: Got complete TLS record (77 bytes) (1) eap_tls: [eaptls verify] = length included (1) eap_tls: (other): before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: <<< recv UNKNOWN TLS VERSION ?0304? [length 0048] (1) eap_tls: >>> send TLS 1.0 Alert [length 0002], fatal handshake_failure (1) eap_tls: ERROR: TLS Alert write:fatal:handshake failure tls: TLS_accept: Error in error (1) eap_tls: ERROR: Failed in FUNCTION (SSL_read): error:1417A0C1:SSL routines:tls_post_process_client_hello:no shared cipher (1) eap_tls: ERROR: System call (I/O) error (-1) (1) eap_tls: ERROR: TLS receive handshake failed during operation (1) eap_tls: ERROR: [eaptls process] = fail (1) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (1) eap: Sending EAP Failure (code 4) ID 6 length 4 (1) eap: Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject What could be wrong here? Where should I debug further? Thanks a ton in advance for any hints! Cheers, Iron

3 6

Username case insensitivity
by Luveh Keraph 23 Feb '20

23 Feb '20

> On Feb 21, 2020, at 5:48 PM, Luveh Keraph <1.41421 at gmail.com> wrote: >> >> I would like for my FreeRADIUS 3.0.20 server to match user names to be >> authenticated in a case-insensitive way. > You want it to match *all* names in a case insensitive way? All user names that the FreeRADIUS receives for authentication. The password should remain case-sensitive. >> To that effect, I changed the >> contents of /etc/raddb/mods-enabled/sradutmp as follows: >> >> radutmp sradutmp { >> filename = ${logdir}/sradutmp >> case_sensitive = "no" > > No... that changes the case insensitivity of the *radutmp* module. The comments in the module > make this clear. OK, thanks. >> When I launch the FreeRADIUS server with -sfXx in the resulting traces I >> can see that the module above has been loaded, and that the case_sensitive >> attribute is indeed set to "no". However, the FreeRADIUS server remains >> user name case-sensitive. What am I misunderstanding here? > > You're seeing the server run modules which *aren't* radump, and which *don't* take any > "case_sensitive" parameter. I'm not sure why editing the "radutmp" module would make the > "files" or "pap" module be case insensitive. OK. > In FreeRADIUS, user name lookups are generally done via databases. If you want the lookups > to be case insensitive, then change the database queries > > So... which database are you using to look up user names / passwords? I am just using the basic capabilities provided by FreeRADIUS - entries in /etc/raddb/users. The user name and password information is retrieved from that file. I tried adding a policy for this in /etc/raddb/policy.d, but I couldn't get that to work either.

2 2

Create New Session Based On Accounting Update
by One Zero Art 23 Feb '20

23 Feb '20

Hi, I am trying to create a new session and insert it into radacct table based on an accounting request from NAS. When NAS sends Interim Update I want to check if that user already in radacct table and null or not null. If not null then create a new session and make that user online in freeradius. I am not sure if it's possible or even the right thing to do. Want to do that because sometimes user online in NAS but offline in freeradius. Thank you

2 3

User name case insensitivity
by Luveh Keraph 21 Feb '20

21 Feb '20

I would like for my FreeRADIUS 3.0.20 server to match user names to be authenticated in a case-insensitive way. To that effect, I changed the contents of /etc/raddb/mods-enabled/sradutmp as follows: radutmp sradutmp { filename = ${logdir}/sradutmp case_sensitive = "no" permissions = 0644 caller_id = "no" } When I launch the FreeRADIUS server with -sfXx in the resulting traces I can see that the module above has been loaded, and that the case_sensitive attribute is indeed set to "no". However, the FreeRADIUS server remains user name case-sensitive. What am I misunderstanding here?

3 2

Re: User name case insensitivity
by Luveh Keraph 21 Feb '20

21 Feb '20

The output requested is attached. My FreeRADIUS server knows about a user called kji. I first attempted to log in as Kji, and that failed. A subsequent attempt to log in as kji succeeds. -------------------------------------------------------------------------------------------------------------------------------------- Luveh, Please https://wiki.freeradius.org/guide/radiusd-X < https://wiki.freeradius.org/guide/radiusd-X> and share the output here. — Jorge Pereira jpereira at freeradius.org <mailto:jpereira at freeradius.org> > On 21 Feb 2020, at 13:48, Luveh Keraph <1.41421 at gmail.com> wrote: > > I would like for my FreeRADIUS 3.0.20 server to match user names to be > authenticated in a case-insensitive way. To that effect, I changed the > contents of /etc/raddb/mods-enabled/sradutmp as follows: > > radutmp sradutmp { > filename = ${logdir}/sradutmp > case_sensitive = "no" > permissions = 0644 > caller_id = "no" > } > > When I launch the FreeRADIUS server with -sfXx in the resulting traces I > can see that the module above has been loaded, and that the case_sensitive > attribute is indeed set to "no". However, the FreeRADIUS server remains > user name case-sensitive. What am I misunderstanding here? > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

NAS-IP-Address Match Using Groups - Freeradius 3.0
by Ope Abe 21 Feb '20

21 Feb '20

Hi there, I am newbie and learning how to use freeradius 3.0 and I wanted to configure a match criteria in both users file and hints file to perform a specific action when RADIUS auth requests are received from a specific range of NAS IP addresses. I thought this could be done by specifying the regexp for the range of IP addresses in the hints and users file using the =~ operator e.g.: *users file* Default NAS-IP-Address =~ ^81\.1\.(7[6-9]|8[0-3])\.41$ Framed-Protocol := PPP, Tunnel-Preference:1 += 1, Tunnel-Preference:2 += 1, Tunnel-Server-Endpoint:1 += 16.39.255.14, Tunnel-Server-Endpoint:2 += 16.39.255.14 *hints file* Default NAS-IP-Address =~ ^81\.1\.(7[6-9]|8[0-3])\.41$ User-Name :="%{User-Name}.ppp" For both cases above, the regexp would match the following IPs: 81.1.76-83.41 My understanding is what I've done would work fine for freeradius 2.x. However, for freeradius 3.0 I need to create a group and define my list of NAS IPs under the group which I can then use as a match criteria in the hints and users file. I know how to define a new string attribute for the group using the dictionary file in etc/freeradius/3.0 but I am not sure where I need to define the NAS IP addresses against the group, and also where I need to set the group attribute using unlang like this: update request { My-Group := "foo" } I just need someone to help confirm if the steps I've specified below are correct: Define new string attribute in etc/freeradius/3.0/dictionary ATTRIBUTE NAS-Group 3003 string in /etc/freeradius/3.0/group_local, I define the following: lts:81.1.76.41 lts:81.1.77.41 lts:81.1.78.41 lts:81.1.79.41 lts:81.1.80.41 lts:81.1.81.41 lts:81.1.82.41 lts:81.1.83.41 in /etc/freeradius/3.0/mods-available/etc_group, I add the following to the file: passwd group_local { filename = /etc/freeradius/3.0/group_local format = "NAS-Group:*NAS-IP-Address" hash_size = 50 ignore_nislike = yes allow_multiple_keys = no delimiter = ":" } in /etc/freeradius/3.0/sites-enabled/default, I add the following in the authorize { } section immediately after the preprocess module i.e.: authorize { preprocess update request { NAS-Group := "lts" } } The update users and hints files to reflect the following: *users file* Default NAS-Group == "lts" Framed-Protocol := PPP, Tunnel-Preference:1 += 1, Tunnel-Preference:2 += 1, Tunnel-Server-Endpoint:1 += 16.39.255.14, Tunnel-Server-Endpoint:2 += 16.39.255.14 *hints file* Default NAS-Group == "lts" User-Name :="%{User-Name}.ppp" Does this make any sense at all? Is this the way I need to implement what I'd like to achieve? Many thanks in anticipation of your response. Abe.

2 2

Destination port invalid
by Bassem Mettichi 21 Feb '20

21 Feb '20

Hello, i have an issue with the response packet sended from my freeradius server to the NAS, a tcpdump on NAS side give this error message: The accounting response message is unfound,The message destination port invalid.ServerIP:0xac193c27 0x00000000 0x00000000 0x00000000,DstPort:31686,Correct Range:31671<=Port<=31685 Do you have any idea why freeradius choose this range port for response packet? Thanks Bassem

4 4

Emulate AD-based machine authentication
by Munroe Sollog 20 Feb '20

20 Feb '20

Our current wireless environment uses Microsoft Active Directory with Microsoft Network Policy Server to authenticate our 802.1x wireless network. As it is configured, it supports user authentication via PEAP and mschapv2, and it also supports what NPS calls "machine authentication". Which, based on its behavior allows any computer joined to the domain to access the network with user credentials. As an example, this is useful for loaner laptops where the computer needs access to the network in order to authenticate the user against AD. I am trying to replace our current Microsoft NPS server with freeradius. I was able to follow the docs and use winbind to get PEAP-mschap user authentication working flawlessly. The last piece of this puzzle is, NPS has a "magic checkbox" that enables machine-based authentication. I have been trying to figure out what that checkbox does, without much luck. My best guess is that it's using the Active Directory certificates to do EAP-TLS auth, but that is just my guess. Has anyone ever tried to replicate this feature? or have any insight? I realize this isn't strictly a freeradius question, but thought I would ask. -- Munroe Sollog Senior Network Engineer munroe(a)lehigh.edu

3 4