- Freeradius-Users - lists.freeradius.org

Failed authentication on FreeRadius
by Tal Nur 27 Jun '19

27 Jun '19

I installed FR 3.0.20 with plain text file storing users and their passwords.When I tried to connect end user bob(a)turan.kz via WiFi AP I failed.What is my mistake? Here is output of freeradius -X command during connection attempt: Received Access-Request Id 30 from 89.250.80.7:1026 to 89.250.80.6:1812 length 182 User-Name = "bob(a)turan.kz" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "C8-3A-35-40-1C-F0" Calling-Station-Id = "84-B1-53-DF-3E-BC" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02070030190017030300253bc5db1b0542fe953989206abc908f78fc9bd5babd5d93bf8913bf3d361ea67cccdf066be5 State = 0xfefad346fbfdca45684956ecf2b10489 Message-Authenticator = 0x1d94ee8285d897bee4e535fc3012a89a Restoring &session-state &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" &session-state:TLS-Session-Version = "TLS 1.2" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default authorize { policy filter_username { if (&User-Name) { if (&User-Name) -> TRUE if (&User-Name) { if (&User-Name =~ / /) { if (&User-Name =~ / /) -> FALSE if (&User-Name =~ /@[^@]*@/ ) { if (&User-Name =~ /@[^@]*@/ ) -> FALSE if (&User-Name =~ /\.\./ ) { if (&User-Name =~ /\.\./ ) -> FALSE if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE if (&User-Name =~ /\.$/) { if (&User-Name =~ /\.$/) -> FALSE if (&User-Name =~ /(a)\./) { if (&User-Name =~ /(a)\./) -> FALSE } # if (&User-Name) = notfound } # policy filter_username = notfound [preprocess] = ok [chap] = noop [mschap] = noop [digest] = noop suffix: Checking for suffix after "@" suffix: Looking up realm "turan.kz" for User-Name = "bob(a)turan.kz" suffix: Found realm "turan.kz" suffix: Adding Realm = "turan.kz" suffix: Authentication realm is LOCAL [suffix] = ok eap: Peer sent EAP Response (code 2) ID 7 length 48 eap: Continuing tunnel setup [eap] = ok } # authorize = ok Found Auth-Type = eap # Executing group from file /usr/local/etc/raddb/sites-enabled/default authenticate { eap: Expiring EAP session with state 0xfefad346fbfdca45 eap: Finished EAP session with state 0xfefad346fbfdca45 eap: Previous EAP request found for state 0xfefad346fbfdca45, released from the list eap: Peer sent packet with method EAP PEAP (25) eap: Calling submodule eap_peap to process data eap_peap: Continuing EAP-TLS eap_peap: [eaptls verify] = ok eap_peap: Done initial handshake eap_peap: [eaptls process] = ok eap_peap: Session established. Decoding tunneled attributes eap_peap: PEAP state WAITING FOR INNER IDENTITY eap_peap: Identity - bob(a)turan.kz eap_peap: Got inner identity 'bob(a)turan.kz' eap_peap: Setting default EAP type for tunneled EAP session eap_peap: Got tunneled request eap_peap: EAP-Message = 0x0207001101626f6240747572616e2e6b7a eap_peap: Setting User-Name to bob(a)turan.kz eap_peap: Sending tunneled request to eduroam-inner-tunnel eap_peap: EAP-Message = 0x0207001101626f6240747572616e2e6b7a eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 eap_peap: User-Name = "bob(a)turan.kz" eap_peap: NAS-IP-Address = 192.168.0.1 eap_peap: NAS-Port = 0 eap_peap: Called-Station-Id = "C8-3A-35-40-1C-F0" eap_peap: Calling-Station-Id = "84-B1-53-DF-3E-BC" eap_peap: Framed-MTU = 1400 eap_peap: NAS-Port-Type = Wireless-802.11 eap_peap: Event-Timestamp = "Jun 26 2019 07:06:42 UTC" Virtual server eduroam-inner-tunnel received request EAP-Message = 0x0207001101626f6240747572616e2e6b7a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "bob(a)turan.kz" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "C8-3A-35-40-1C-F0" Calling-Station-Id = "84-B1-53-DF-3E-BC" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Event-Timestamp = "Jun 26 2019 07:06:42 UTC" WARNING: Outer and inner identities are the same. User privacy is compromised. server eduroam-inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel authorize { auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d auth_log: --> /usr/local/var/log/radius/radacct/89.250.80.7/auth-detail-20190626 auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/89.250.80.7/auth-detail-20190626 auth_log: EXPAND %t auth_log: --> Wed Jun 26 07:06:42 2019 [auth_log] = ok eap: Peer sent EAP Response (code 2) ID 7 length 17 eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize [eap] = ok files: users: Matched entry bob(a)turan.kz at line 87 files: EXPAND Hello, %{User-Name} files: --> Hello, bob(a)turan.kz [files] = ok [mschap] = noop pap: WARNING: Auth-Type already set. Not setting to PAP [pap] = noop } # authorize = ok Found Auth-Type = eap # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel authenticate { eap: Peer sent packet with method EAP Identity (1) eap: Calling submodule eap_mschapv2 to process data eap_mschapv2: Issuing Challenge eap: Sending EAP Request (code 1) ID 8 length 43 eap: EAP session adding &reply:State = 0x58cb71f258c36b09 [eap] = handled } # authenticate = handled } # server eduroam-inner-tunnel Virtual server sending reply Reply-Message = "Hello, bob(a)turan.kz" EAP-Message = 0x0108002b1a01080026106a0612ff605c3452f6e178745c8eba94667265657261646975732d332e302e3230 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x58cb71f258c36b095384618a82349908 eap_peap: Got tunneled reply code 11 eap_peap: Reply-Message = "Hello, bob(a)turan.kz" eap_peap: EAP-Message = 0x0108002b1a01080026106a0612ff605c3452f6e178745c8eba94667265657261646975732d332e302e3230 eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 eap_peap: State = 0x58cb71f258c36b095384618a82349908 eap_peap: Got tunneled reply RADIUS code 11 eap_peap: Reply-Message = "Hello, bob(a)turan.kz" eap_peap: EAP-Message = 0x0108002b1a01080026106a0612ff605c3452f6e178745c8eba94667265657261646975732d332e302e3230 eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 eap_peap: State = 0x58cb71f258c36b095384618a82349908 eap_peap: Got tunneled Access-Challenge eap: Sending EAP Request (code 1) ID 8 length 74 eap: EAP session adding &reply:State = 0xfefad346f8f2ca45 [eap] = handled } # authenticate = handled Using Post-Auth-Type Challenge # Executing group from file /usr/local/etc/raddb/sites-enabled/default Challenge { ... } # empty sub-section is ignored session-state: Saving cached attributes TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" TLS-Session-Version = "TLS 1.2" Sent Access-Challenge Id 30 from 89.250.80.6:1812 to 89.250.80.7:1026 length 0 EAP-Message = 0x0108004a1900170303003f65d2d81fede8586ad658fe2ef68148cdd00a0fe7d7b86fc891c73f2c4382c50fe3d4c8d8c75decf5ed2e079ab13f12c470df1c6d7eba8b61fcf7cfda3a4603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfefad346f8f2ca45684956ecf2b10489 Finished request

2 1

Write additional accounting fields to sql
by Matthew McTague 27 Jun '19

27 Jun '19

Hi, I have two additional fields that I receive in Accounting-Request packets from my NAS, and I want to write these to radacct, or if that is not possible, to another table. The fields are: ADSL-Agent-Circuit-Id ADSL-Agent-Remote-Id Is it correct alter the table, then amend column_list within the accounting section of mods-config/sql/main/mysql/queries.conf? Warm Regards, Matthew McTague Head of Infrastructure, Reliance Networks d. +64 3 222 6013 t. 0800 483 882 (+64 3 683 9090) Website | Service Desk | Internet Services Reliance Networks Ltd accepts no liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided, unless that information is subsequently confirmed in writing. Any views or opinions presented in this email are solely those of the author and do not necessarily represent those of the company.

2 3

Bug?
by Aurélio de Souza Ribeiro Neto 26 Jun '19

26 Jun '19

Hello Alan, I'm using Freeradius 3.0.19 in Ubuntu 16. I was having trouble when I tried to update control in authenticate session in default file, for Auth-Type mschap, when authentication is rejected. The condition wasn't reached. In debug mode, I see this line (complete dump below): (7) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' So I changed "Auth-Type MS-CHAP { " to "Auth-Type mschap" in default file and all works fine!! It's a bug or just my fault? :: "ERROR DUMP" Ready to process requests (7) Received Access-Request Id 114 from 172.17.6.2:33846 to XXX.XXX.XXX.XXX:1812 length 193 (7) Service-Type = Framed-User (7) Framed-Protocol = PPP (7) NAS-Port = 15729015 (7) NAS-Port-Type = Ethernet (7) User-Name = "XXXXXXXXXXX" (7) Calling-Station-Id = "XX:XX:XX:XX:XX:XX" (7) Called-Station-Id = "CE - POP ITPM5" (7) NAS-Port-Id = "ether5" (7) MS-CHAP-Challenge = 0xdb9cf50eb227ee11 (7) MS-CHAP-Response = 0x01010000000000000000000000000000000000000000000000006bc5f0726031baa47 5638dca8a9348c12d6d0d8d21ffe29e (7) NAS-Identifier = "CE-ITPM" (7) NAS-IP-Address = 172.17.6.2 (7) # Executing section authorize from file /etc/freeradius/sites-enabled/default (7) authorize { (7) [preprocess] = ok (7) [chap] = noop (7) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (7) [mschap] = ok (7) sql: EXPAND %{User-Name} (7) sql: --> XXXXXXXXXXXXX (7) sql: SQL-User-Name set to 'XXXXXXXXXXXXXXX' rlm_sql (sql): Reserved connection (9) (7) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND N.nasname = '%{Nas-IP-Address}' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY '%{SQL-User-Name}' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '%{Nas-IP-Address}' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND M.grupocliente = 'ALL-POPS' (7) sql: --> SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'XXXXXXXXXXXXX' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND M.grupocliente = 'ALL-POPS' (7) sql: Executing select query: SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'XXXXXXXXXXXXX' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND M.grupocliente = 'ALL-POPS' rlm_sql (sql): Closing expired connection (7): Hit lifetime limit rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Reserved connection (10) rlm_sql (sql): Released connection (10) Need 8 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (11), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'mpc_freeradius' on mysql.mpc.com.br via TCP/IP, server version 5.7.26-0ubuntu0.16.04.1-log, protocol version 10 (7) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (7) sql: --> SELECT groupname FROM radusergroup WHERE username = 'XXXXXXXXXXXXX' ORDER BY priority (7) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'XXXXXXXXXXXXX' ORDER BY priority (7) sql: User not found in any groups rlm_sql (sql): Released connection (9) (7) [sql] = notfound (7) [expiration] = noop (7) [logintime] = noop Not doing PAP as Auth-Type is already set. (7) [pap] = noop (7) } # authorize = ok (7) Found Auth-Type = mschap (7) # Executing group from file /etc/freeradius/sites-enabled/default (7) authenticate { (7) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (7) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (7) mschap: Client is using MS-CHAPv1 with NT-Password (7) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (7) mschap: ERROR: MS-CHAP2-Response is incorrect (7) [mschap] = reject (7) } # authenticate = reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/freeradius/sites-enabled/default (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject: EXPAND %{User-Name} (7) attr_filter.access_reject: --> XXXXXXXXXXXXX (7) attr_filter.access_reject: Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (7) linelog: --> messages.Access-Reject (7) linelog: No such entry ".messages.Access-Reject" (7) [linelog] = noop (7) } # Post-Auth-Type REJECT = updated (7) Login incorrect (mschap: FAILED: No NT/LM-Password. Cannot perform authentication): [XXXXXXXXXXXXX/<via Auth-Type = mschap>] (from client ce-popitpm-rb port 15729015 cli XX:XX:XX:XX:XX:XX) (7) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (7) Sending delayed response (7) Sent Access-Reject Id 114 from 187.120.197.140:1812 to 172.17.6.2:33846 length 61 (7) MS-CHAP-Error = "\001E=691 R=1 C=aa56c73c463c7a63 V=2" Waking up in 8.9 seconds. :: "ALL OK DUMP" (1) Received Access-Request Id 209 from 172.17.6.2:59186 to XXX.XXX.XXX.XXX:1812 length 193 (1) Service-Type = Framed-User (1) Framed-Protocol = PPP (1) NAS-Port = 15729042 (1) NAS-Port-Type = Ethernet (1) User-Name = "XXXXXXXXXXXXX" (1) Calling-Station-Id = "XX:XX:XX:XX:XX:XX" (1) Called-Station-Id = "CE - POP ITPM5" (1) NAS-Port-Id = "ether5" (1) MS-CHAP-Challenge = 0xdf11a990dc9e9fb7 (1) MS-CHAP-Response = 0x010100000000000000000000000000000000000000000000000075ad989b83ff7ae24 102c6e3a0f272e11ff159260152f933 (1) NAS-Identifier = "CE-ITPM" (1) NAS-IP-Address = 172.17.6.2 (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) authorize { (1) [preprocess] = ok (1) [chap] = noop (1) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (1) [mschap] = ok (1) sql: EXPAND %{User-Name} (1) sql: --> XXXXXXXXXXXXX (1) sql: SQL-User-Name set to 'XXXXXXXXXXXXX' rlm_sql (sql): Reserved connection (3) (1) sql: EXPAND SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND N.nasname = '%{Nas-IP-Address}' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY '%{SQL-User-Name}' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '%{Nas-IP-Address}' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY '%{SQL-User-Name}' AND M.usuario_login = BINARY '%{SQL-User-Name}' AND M.grupocliente = 'ALL-POPS' (1) sql: --> SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'XXXXXXXXXXXXX' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND M.grupocliente = 'ALL-POPS' (1) sql: Executing select query: SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND N.nasname = '172.17.6.2' AND N.gw_id = (SELECT gateway_id FROM mpc_lw.maclist WHERE usuario_login = BINARY 'XXXXXXXXXXXXX' AND plano_id NOT IN (6,8,9,793) AND gateway_id = ( SELECT gw_id FROM mpc_freeradius.nas WHERE nasname = '172.17.6.2' ) ORDER BY ID) UNION ALL SELECT DISTINCT (R.id), R.username, R.attribute, R.value, R.op FROM mpc_freeradius.radcheck R, mpc_freeradius.nas N, mpc_lw.maclist M WHERE R.username = BINARY 'XXXXXXXXXXXXX' AND M.usuario_login = BINARY 'XXXXXXXXXXXXX' AND M.grupocliente = 'ALL-POPS' rlm_sql (sql): Reserved connection (4) rlm_sql (sql): Released connection (4) Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'mpc_freeradius' on mysql.mpc.com.br via TCP/IP, server version 5.7.26-0ubuntu0.16.04.1-log, protocol version 10 (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'XXXXXXXXXXXXX' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'XXXXXXXXXXXXX' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (3) (1) [sql] = notfound (1) [expiration] = noop (1) [logintime] = noop Not doing PAP as Auth-Type is already set. (1) [pap] = noop (1) } # authorize = ok (1) Found Auth-Type = mschap (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Auth-Type mschap { (1) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (1) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (1) mschap: Client is using MS-CHAPv1 with NT-Password (1) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (1) mschap: ERROR: MS-CHAP2-Response is incorrect (1) [mschap] = reject (1) if (reject) { (1) if (reject) -> TRUE (1) if (reject) { (1) update control { (1) Pool-Name := "mkt_pool" (1) } # update control = noop (1) update reply { (1) Mikrotik-Rate-Limit := "300K/2M 600K/2200K 450K/1500K 10/10" (1) } # update reply = noop (1) [ok] = ok (1) } # if (reject) = ok (1) } # Auth-Type mschap = ok (1) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (1) post-auth { (1) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (1) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (1) update { (1) No attributes updated for RHS &session-state: (1) } # update = noop (1) sql: EXPAND .query (1) sql: --> .query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (0) (1) sql: EXPAND %{User-Name} (1) sql: --> XXXXXXXXXXXXX (1) sql: SQL-User-Name set to 'XXXXXXXXXXXXX' (1) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (1) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'XXXXXXXXXXXXX', '', 'Access-Accept', '2019-06-26 11:44:54') (1) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'XXXXXXXXXXXXX', '', 'Access-Accept', '2019-06-26 11:44:54') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (0) (1) [sql] = ok rlm_sql (sql): Reserved connection (5) (1) sqlippool: EXPAND %{User-Name} (1) sqlippool: --> XXXXXXXXXXXXX (1) sqlippool: SQL-User-Name set to 'XXXXXXXXXXXXX' (1) sqlippool: EXPAND START TRANSACTION (1) sqlippool: --> START TRANSACTION (1) sqlippool: Executing query: START TRANSACTION (1) sqlippool: EXPAND UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}' (1) sqlippool: --> UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '172.17.6.2' (1) sqlippool: Executing query: UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '172.17.6.2' rlm_sql_mysql: Rows matched: 0 Changed: 0 Warnings: 0 (1) sqlippool: EXPAND COMMIT (1) sqlippool: --> COMMIT (1) sqlippool: Executing query: COMMIT (1) sqlippool: EXPAND START TRANSACTION (1) sqlippool: --> START TRANSACTION (1) sqlippool: Executing query: START TRANSACTION (1) sqlippool: EXPAND SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE (1) sqlippool: --> SELECT framedipaddress FROM radippool WHERE pool_name = 'mkt_pool' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'XXXXXXXXXXXXX'), (callingstationid <> 'XX:XX:XX:XX:XX:XX'), expiry_time LIMIT 1 FOR UPDATE (1) sqlippool: Executing select query: SELECT framedipaddress FROM radippool WHERE pool_name = 'mkt_pool' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'XXXXXXXXXXXXX'), (callingstationid <> 'XX:XX:XX:XX:XX:XX'), expiry_time LIMIT 1 FOR UPDATE (1) sqlippool: Allocated IP 10.10.10.6 (1) sqlippool: EXPAND UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.10.10.6' AND expiry_time IS NULL (1) sqlippool: --> UPDATE radippool SET nasipaddress = '172.17.6.2', pool_key = 'XX:XX:XX:XX:XX:XX', callingstationid = 'XX:XX:XX:XX:XX:XX', username = 'XXXXXXXXXXXXX', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.10.10.6' AND expiry_time IS NULL (1) sqlippool: Executing query: UPDATE radippool SET nasipaddress = '172.17.6.2', pool_key = 'XX:XX:XX:XX:XX:XX', callingstationid = 'XX:XX:XX:XX:XX:XX', username = 'XXXXXXXXXXXXX', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '10.10.10.6' AND expiry_time IS NULL rlm_sql_mysql: Rows matched: 1 Changed: 1 Warnings: 0 (1) sqlippool: EXPAND COMMIT (1) sqlippool: --> COMMIT (1) sqlippool: Executing query: COMMIT rlm_sql (sql): Released connection (5) (1) sqlippool: EXPAND Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1) sqlippool: --> Allocated IP: 10.10.10.6 from mkt_pool (did CE - POP ITPM5 cli XX:XX:XX:XX:XX:XX port 15729042 user XXXXXXXXXXXXX) (1) [sqlippool] = ok (1) log_post_auth: EXPAND %{reply:Packet-Type} (1) log_post_auth: --> Access-Accept (1) log_post_auth: EXPAND %t : Info: Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1) log_post_auth: --> Wed Jun 26 11:44:54 2019 : Info: Allocated IP: 10.10.10.6 from mkt_pool (did CE - POP ITPM5 cli XX:XX:XX:XX:XX:XX port 15729042 user XXXXXXXXXXXXX) (1) log_post_auth: EXPAND /var/log/freeradius/radius.log (1) log_post_auth: --> /var/log/freeradius/radius.log (1) [log_post_auth] = ok (1) [exec] = noop (1) } # post-auth = ok (1) Login OK: [XXXXXXXXXXXXX] (from client ce-popitpm-rb port 15729042 cli XX:XX:XX:XX:XX:XX) (1) Sent Access-Accept Id 209 from 187.120.197.140:1812 to 172.17.6.2:59186 length 0 (1) MS-CHAP-Error = "\001E=691 R=1 C=6514e8f833e51125 V=2" (1) Mikrotik-Rate-Limit := "300K/2M 600K/2200K 450K/1500K 10/10" (1) Framed-IP-Address = 10.10.10.6 (1) Finished request

2 1

Freeradius 3 DHCP server with SQL and 'anty dos' protection, how?
by Kamil de Bardon 26 Jun '19

26 Jun '19

Hello, I configure freeradius to be a unicast dhcp server for working with Cisco ASR. client --> cisco relay -> freeradius My configuration is: dhcp DHCP-Discover { if ( "%{mms: ${..ip_query}}" ) { update reply { DHCP-Message-Type = DHCP-Offer } update reply { &DHCP-Your-IP-Address = "%{mms: ${....ip_query} }" &DHCP-Subnet-Mask = "%{mms: ${....mask_query} }" &DHCP-Router-Address = "%{mms: ${....gw_query} }" &DHCP-Domain-Name-Server = "%{mms: ${....ns1_query} }" &DHCP-Domain-Name-Server += "%{mms: ${....ns2_query} }" &DHCP-IP-Address-Lease-Time = _DHCP_LEASE_TIME_ } ok } else { update reply { &DHCP-Message-Type = DHCP-Do-Not-Respond } reject } } dhcp DHCP-Request { update reply { &DHCP-Message-Type = DHCP-Ack } update reply { &DHCP-Your-IP-Address = "%{mms: ${...ip_query} }" &DHCP-Subnet-Mask = "%{mms: ${...mask_query} }" &DHCP-Router-Address = "%{mms: ${...gw_query} }" &DHCP-Domain-Name-Server = "%{mms: ${...ns1_query} }" &DHCP-Domain-Name-Server += "%{mms: ${...ns2_query} }" &DHCP-IP-Address-Lease-Time = _DHCP_LEASE_TIME_ } ok } This is working, but my concern is, if client's mac adres is not in the database, they dhcp client will send dhcp-discovery all the time, and one discovery = one sql query. Is there any way to prevent that? Some cache or so? Thanks for help.

3 5

EAP-TTLS proxiing the tunneled request fails
by Ekkehard Burkon 25 Jun '19

25 Jun '19

Hi, I spent a bit of time on this but can't get it to work. My goal is to have a freeradius server handle EAP authentication with the EAP typ being EAP-TTLS. The data from the tunneled request should be proxied to an other radius server. I got as far as that. The proxy gets the request and answers it accordingly. But to me it looks like freeradius does not put enough info into that request and then looses track of things. The info sent to the AP is a plain accept with no EAP-Message and Message-Authenticator attribute. Accordingly the whole thing does not work. (The EAP-TLS stuff is working) I include the config. I tried to keep just the necessary stuff and a debug output from one request. Would somone be willing to help me a bit with this? Thank you Ekkehard sites-enabled/default: server default { listen { type = auth ipaddr = * port = 1812 } authorize { eap { ok = return updated = return } } authenticate { eap } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject linelog_send_reject } } } sites-enabled/eap-inner: server eap-inner { authorize { update control { Proxy-To-Realm := "NPS" } } authenticate { eap } post-proxy { eap } } proxy.conf: home_server ad_nps1 { ipaddr = 10.0.0.21 secret = biscplus status_check = status-server response_window = 5 check_interval = 10 check_timeout = 5 } home_server_pool bis_ad { type = keyed-balance home_server = ad_nps1 } realm NPS { auth_pool = bis_ad nostrip } mods-enabled/eap: eap { default_eap_type = ttls timer_expire = 60 max_sessions = ${max_requests} tls-config tls-common { certificate_file = ${certdir}/radius3.crt private_key_file = ${certdir}/radius3.key # private_key_password = 12345678 ca_file = ${cadir}/BIS-ROOT-1.pem fragment_size = 1024 ocsp { enable = yes override_cert_url = no use_nonce = yes } } tls { tls = tls-common virtual_server = check-eap-tls } ttls { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "eap-inner" } } Im testing with eapol here is the debug output from freeradius: (0) Received Access-Request Id 0 from 127.0.0.1:38193 to 127.0.0.1:1812 length 174 (0) User-Name = "anonymous(a)admin.bis-school.com" (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = "02-00-00-00-00-01" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Connect-Info = "CONNECT 11Mbps 802.11b" (0) EAP-Message = 0x02e3002301616e6f6e796d6f75734061646d696e2e6269732d7363686f6f6c2e636f6d (0) Message-Authenticator = 0x90f2882e640a53847b562bcdd8d88046 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) eap: Peer sent EAP Response (code 2) ID 227 length 35 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_ttls to process data (0) eap_ttls: Initiating new EAP-TLS session (0) eap_ttls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 228 length 6 (0) eap: EAP session adding &reply:State = 0xbdbe794dbd5a6c9b (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Sent Access-Challenge Id 0 from 127.0.0.1:1812 to 127.0.0.1:38193 length 0 (0) EAP-Message = 0x01e400061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xbdbe794dbd5a6c9b1371e49bfa915200 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 1 from 127.0.0.1:38193 to 127.0.0.1:1812 length 335 (1) User-Name = "anonymous(a)admin.bis-school.com" (1) NAS-IP-Address = 127.0.0.1 (1) Calling-Station-Id = "02-00-00-00-00-01" (1) Framed-MTU = 1400 (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Connect-Info = "CONNECT 11Mbps 802.11b" (1) EAP-Message = 0x02e400b2150016030100a7010000a30303e90f8da43470e52c2afaa380c820e5a50c293ac3050b815924910aec99ae5410000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000042000b0004030001 (1) State = 0xbdbe794dbd5a6c9b1371e49bfa915200 (1) Message-Authenticator = 0x4938ad10c3b7d3495950fa889670e64e (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) eap: Peer sent EAP Response (code 2) ID 228 length 178 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xbdbe794dbd5a6c9b (1) eap: Finished EAP session with state 0xbdbe794dbd5a6c9b (1) eap: Previous EAP request found for state 0xbdbe794dbd5a6c9b, released from the list (1) eap: Peer sent packet with method EAP TTLS (21) (1) eap: Calling submodule eap_ttls to process data (1) eap_ttls: Authenticate (1) eap_ttls: Continuing EAP-TLS (1) eap_ttls: Got final TLS record fragment (172 bytes) (1) eap_ttls: WARNING: Total received TLS record fragments (172 bytes), does not equal indicated TLS record length (0 bytes) (1) eap_ttls: [eaptls verify] = ok (1) eap_ttls: Done initial handshake (1) eap_ttls: (other): before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: <<< recv TLS 1.2 [length 00a7] (1) eap_ttls: TLS_accept: SSLv3/TLS read client hello (1) eap_ttls: >>> send TLS 1.2 [length 003d] (1) eap_ttls: TLS_accept: SSLv3/TLS write server hello (1) eap_ttls: >>> send TLS 1.2 [length 097a] (1) eap_ttls: TLS_accept: SSLv3/TLS write certificate (1) eap_ttls: >>> send TLS 1.2 [length 014d] (1) eap_ttls: TLS_accept: SSLv3/TLS write key exchange (1) eap_ttls: >>> send TLS 1.2 [length 0004] (1) eap_ttls: TLS_accept: SSLv3/TLS write server done (1) eap_ttls: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_ttls: In SSL Handshake Phase (1) eap_ttls: In SSL Accept mode (1) eap_ttls: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 229 length 1014 (1) eap: EAP session adding &reply:State = 0xbdbe794dbc5b6c9b (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Sent Access-Challenge Id 1 from 127.0.0.1:1812 to 127.0.0.1:38193 length 0 (1) EAP-Message = 0x01e503f615c000000b1c160303003d02000039030354a1c912b7f4ffec22fbff6a7f9f77e8ef4c67e6b6bc2e97d069f79fe3e1c7f300c030000011ff01000100000b00040300010200170000160303097a0b0009760009730005b0308205ac30820494a003020102020a1b9b4d9f000000000004300d06 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xbdbe794dbc5b6c9b1371e49bfa915200 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 2 from 127.0.0.1:38193 to 127.0.0.1:1812 length 163 (2) User-Name = "anonymous(a)admin.bis-school.com" (2) NAS-IP-Address = 127.0.0.1 (2) Calling-Station-Id = "02-00-00-00-00-01" (2) Framed-MTU = 1400 (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) Connect-Info = "CONNECT 11Mbps 802.11b" (2) EAP-Message = 0x02e500061500 (2) State = 0xbdbe794dbc5b6c9b1371e49bfa915200 (2) Message-Authenticator = 0x80b05a75c57103e50a0d4ca23f52ecdc (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) eap: Peer sent EAP Response (code 2) ID 229 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xbdbe794dbc5b6c9b (2) eap: Finished EAP session with state 0xbdbe794dbc5b6c9b (2) eap: Previous EAP request found for state 0xbdbe794dbc5b6c9b, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: Peer ACKed our handshake fragment (2) eap_ttls: [eaptls verify] = request (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 230 length 1014 (2) eap: EAP session adding &reply:State = 0xbdbe794dbf586c9b (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Sent Access-Challenge Id 2 from 127.0.0.1:1812 to 127.0.0.1:38193 length 0 (2) EAP-Message = 0x01e603f615c000000b1c2b060105050730028681ae6c6461703a2f2f2f434e3d4249532d41442d43412d524f4f542d312c434e3d4149412c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e66696775726174696f6e2c44433d61646d69 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xbdbe794dbf586c9b1371e49bfa915200 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 3 from 127.0.0.1:38193 to 127.0.0.1:1812 length 163 (3) User-Name = "anonymous(a)admin.bis-school.com" (3) NAS-IP-Address = 127.0.0.1 (3) Calling-Station-Id = "02-00-00-00-00-01" (3) Framed-MTU = 1400 (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) Connect-Info = "CONNECT 11Mbps 802.11b" (3) EAP-Message = 0x02e600061500 (3) State = 0xbdbe794dbf586c9b1371e49bfa915200 (3) Message-Authenticator = 0xbc676bdb840006d114c4d5534e697668 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) eap: Peer sent EAP Response (code 2) ID 230 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0xbdbe794dbf586c9b (3) eap: Finished EAP session with state 0xbdbe794dbf586c9b (3) eap: Previous EAP request found for state 0xbdbe794dbf586c9b, released from the list (3) eap: Peer sent packet with method EAP TTLS (21) (3) eap: Calling submodule eap_ttls to process data (3) eap_ttls: Authenticate (3) eap_ttls: Continuing EAP-TLS (3) eap_ttls: Peer ACKed our handshake fragment (3) eap_ttls: [eaptls verify] = request (3) eap_ttls: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 231 length 846 (3) eap: EAP session adding &reply:State = 0xbdbe794dbe596c9b (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Sent Access-Challenge Id 3 from 127.0.0.1:1812 to 127.0.0.1:38193 length 0 (3) EAP-Message = 0x01e7034e158000000b1c1f7cf0bc75d77cef8ab1e0b0d70191863666447688049d6a7b1370086e925c81e494c817e89e76fbb35b20f9dd06a9a3edea94d217cb02c06c49165a619bf474d673c14496ade687ac8eeb28fb22dc57c02faeb327ad534fbd530430d48ceb3067670310f50203010001a36930 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xbdbe794dbe596c9b1371e49bfa915200 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 4 from 127.0.0.1:38193 to 127.0.0.1:1812 length 289 (4) User-Name = "anonymous(a)admin.bis-school.com" (4) NAS-IP-Address = 127.0.0.1 (4) Calling-Station-Id = "02-00-00-00-00-01" (4) Framed-MTU = 1400 (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Connect-Info = "CONNECT 11Mbps 802.11b" (4) EAP-Message = 0x02e7008415001603030046100000424104297d569882c17684c3dc575059bea02a61f3ccf021334a9ece982c33ed5796948b42fbc1e19db50b55234a58e24364f2cd6d3a87f0b6ae0bcdf5aee053d61cde1403030001011603030028b248fc46d27b63d070e1cffbdac668845d9ef5b05c90fb9f7a8540 (4) State = 0xbdbe794dbe596c9b1371e49bfa915200 (4) Message-Authenticator = 0x81790218229b4d6b27a2b1d421eadae2 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (4) authorize { (4) eap: Peer sent EAP Response (code 2) ID 231 length 132 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0xbdbe794dbe596c9b (4) eap: Finished EAP session with state 0xbdbe794dbe596c9b (4) eap: Previous EAP request found for state 0xbdbe794dbe596c9b, released from the list (4) eap: Peer sent packet with method EAP TTLS (21) (4) eap: Calling submodule eap_ttls to process data (4) eap_ttls: Authenticate (4) eap_ttls: Continuing EAP-TLS (4) eap_ttls: [eaptls verify] = ok (4) eap_ttls: Done initial handshake (4) eap_ttls: TLS_accept: SSLv3/TLS write server done (4) eap_ttls: <<< recv TLS 1.2 [length 0046] (4) eap_ttls: TLS_accept: SSLv3/TLS read client key exchange (4) eap_ttls: TLS_accept: SSLv3/TLS read change cipher spec (4) eap_ttls: <<< recv TLS 1.2 [length 0010] (4) eap_ttls: TLS_accept: SSLv3/TLS read finished (4) eap_ttls: >>> send TLS 1.2 [length 0001] (4) eap_ttls: TLS_accept: SSLv3/TLS write change cipher spec (4) eap_ttls: >>> send TLS 1.2 [length 0010] (4) eap_ttls: TLS_accept: SSLv3/TLS write finished (4) eap_ttls: (other): SSL negotiation finished successfully (4) eap_ttls: SSL Connection Established (4) eap_ttls: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 232 length 61 (4) eap: EAP session adding &reply:State = 0xbdbe794db9566c9b (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) Post-Auth-Type sub-section not found. Ignoring. (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Sent Access-Challenge Id 4 from 127.0.0.1:1812 to 127.0.0.1:38193 length 0 (4) EAP-Message = 0x01e8003d1580000000331403030001011603030028bfbb1165dab6d3ad067fd077e0b86fe6b330caa641fd7cf9d71fd3dfa7b7eadf624b79c8c4540ecd (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xbdbe794db9566c9b1371e49bfa915200 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 5 from 127.0.0.1:38193 to 127.0.0.1:1812 length 252 (5) User-Name = "anonymous(a)admin.bis-school.com" (5) NAS-IP-Address = 127.0.0.1 (5) Calling-Station-Id = "02-00-00-00-00-01" (5) Framed-MTU = 1400 (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) Connect-Info = "CONNECT 11Mbps 802.11b" (5) EAP-Message = 0x02e8005f15001703030054b248fc46d27b63d18e71ab2e68197c93122eb1f823fa8da0434c2d0edc8b721d9cdf48ddbce73bc70c4972173f0f3be19ae64431f975dae8effdb0968999b9713f74d23b61fef09f910913280e446ce0a43e7465 (5) State = 0xbdbe794db9566c9b1371e49bfa915200 (5) Message-Authenticator = 0x1e1efc4e85e5088d06e33b64894a3579 (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (5) authorize { (5) eap: Peer sent EAP Response (code 2) ID 232 length 95 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0xbdbe794db9566c9b (5) eap: Finished EAP session with state 0xbdbe794db9566c9b (5) eap: Previous EAP request found for state 0xbdbe794db9566c9b, released from the list (5) eap: Peer sent packet with method EAP TTLS (21) (5) eap: Calling submodule eap_ttls to process data (5) eap_ttls: Authenticate (5) eap_ttls: Continuing EAP-TLS (5) eap_ttls: [eaptls verify] = ok (5) eap_ttls: Done initial handshake (5) eap_ttls: [eaptls process] = ok (5) eap_ttls: Session established. Proceeding to decode tunneled attributes (5) eap_ttls: Got tunneled request (5) eap_ttls: User-Name = "eburkon(a)admin.bis-school.com" (5) eap_ttls: User-Password = "dumbo888" (5) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (5) eap_ttls: Sending tunneled request (5) Virtual server eap-inner received request (5) User-Name = "eburkon(a)admin.bis-school.com" (5) User-Password = "dumbo888" (5) FreeRADIUS-Proxied-To = 127.0.0.1 (5) NAS-IP-Address = 127.0.0.1 (5) Calling-Station-Id = "02-00-00-00-00-01" (5) Framed-MTU = 1400 (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) Connect-Info = "CONNECT 11Mbps 802.11b" (5) server eap-inner { (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/eap-inner (5) authorize { (5) update control { (5) Proxy-To-Realm := "NPS" (5) } # update control = noop (5) } # authorize = noop (5) } # server eap-inner (5) Virtual server sending reply (5) eap_ttls: Tunneled authentication will be proxied to NPS (5) eap: WARNING: Tunneled session will be proxied. Not doing EAP (5) [eap] = handled (5) } # authenticate = handled (5) Starting proxy to home server 10.0.0.21 port 1812 (5) Proxying request to home server 10.0.0.21 port 1812 timeout 5.000000 (5) Sent Access-Request Id 1 from 0.0.0.0:38924 to 10.0.0.21:1812 length 156 (5) User-Name = "eburkon(a)admin.bis-school.com" (5) User-Password = "dumbo888" (5) NAS-IP-Address = 127.0.0.1 (5) Calling-Station-Id = "02-00-00-00-00-01" (5) Framed-MTU = 1400 (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) Connect-Info = "CONNECT 11Mbps 802.11b" (5) Message-Authenticator := 0x00 (5) Proxy-State = 0x35 Waking up in 0.3 seconds. (5) Marking home server 10.0.0.21 port 1812 alive (5) Clearing existing &reply: attributes (5) Received Access-Accept Id 1 from 10.0.0.21:1812 to 10.9.0.204:38924 length 146 (5) Proxy-State = 0x35 (5) Filter-Id = "fallback" (5) Framed-Protocol = PPP (5) Reply-Message = "Ohmei" (5) Service-Type = Framed-User (5) Class = 0x83c3078e00000137000102000a00001500000000f566755d44f84d2101d5264eda20537f0000000000002e18 (5) MS-Link-Utilization-Threshold = 50 (5) MS-Link-Drop-Time-Limit = 120 (5) MS-MPPE-Encryption-Policy = Encryption-Required (5) MS-MPPE-Encryption-Types = 14 (5) Found Auth-Type = eap (5) Found Auth-Type = Accept (5) ERROR: Warning: Found 2 auth-types on request for user 'anonymous(a)admin.bis-school.com' (5) Auth-Type = Accept, accepting the user (5) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (5) Sent Access-Accept Id 5 from 127.0.0.1:1812 to 127.0.0.1:38193 length 0 (5) Filter-Id = "fallback" (5) Framed-Protocol = PPP (5) Reply-Message = "Ohmei" (5) Service-Type = Framed-User (5) Class = 0x83c3078e00000137000102000a00001500000000f566755d44f84d2101d5264eda20537f0000000000002e18 (5) MS-Link-Utilization-Threshold = 50 (5) MS-Link-Drop-Time-Limit = 120 (5) MS-MPPE-Encryption-Policy = Encryption-Required (5) MS-MPPE-Encryption-Types = 14 (5) Finished request Waking up in 4.9 seconds. : Trusted Network GmbH : Max-Planck-Str. 1 : D-85716 Unterschleissheim : Telefon: 089 / 54 80 163 - 0 : Telefax: 089 / 54 80 163 - 222 : Web: http://www.tnib.de<http://www.tnib.de/> : Geschaeftsfuehrer: Joerg Staedele, Stefan Kinner : Sitz der Gesellschaft: Unterschleissheim : Registergericht: AG Muenchen HRB 108 388 Die Informationspflichten zum Datenschutz, insbesondere zur Rechtsgrundlage zur Mandantenkommunikation, finden Sie unter https://www.trusted-network.de/datenschutz

3 3

separating Useres
by myxmail1919＠yahoo.com 24 Jun '19

24 Jun '19

Hi Guys, i have freeradius 3.0.15 and Mysql DB we use MAC authentication so everyone allowed to connect if they are not exceeded their limits. (anonymusers , not exist in DB ) In /etc/freeradius/3.0/sites-available/default I have update control { Max-Daily-Session= 1800 } update control { Acct-Output-Octets := 307200 } So by default every user has 1800 Seconds and 300 Mb daily limit is there anyway to make exception for some users ? like 7200 seconds and 1 Gb daily limit Thanks

1 1

FREERADIUS - show VLAN in radacct's NAS-PORT-ID column
by JAHANZAIB SYED 23 Jun '19

23 Jun '19

IN A tEST lab, We are using an old box with FreeRADIUS Version 2.2.8 along with Mikrotik routerboard (v6.43.3) as NAS. Vlans are properly configured. users connect via pppoe service. Each Vlan has pppoe server assigned. in Radacct "nas-port-id" column, how can we show VLAN name or Vlan number instead of just numbers. currently in radacct we can see this NAS-PORT-ID column: 1548484 NAS-PORT-ID column: 1529618 at another network I can saw the VLAN names there, like NAS-PORT-ID column: Vlan11 NAS-PORT-ID column: vlan20 is there any additional config required on freeradius to achieve this ? Regards, J.Z <http:///>

2 1

Conflicting vs Duplicate
by Bassem Mettichi 21 Jun '19

21 Jun '19

Hello, could you please give me the difference between conflicting packet and ducplicate packet? Thanks Bassem

2 1

problem with Simultaneous-Use roaming
by Mustafa Nassir 21 Jun '19

21 Jun '19

hi there i have problem with 802.1X , i have multi openwrt access point all it work with wpa2-enterprise and freeradius server with mysql in other side , in freeradius i enable Simultaneous-Use my problem is when my users move from first ap to second or to third ap its disconnect and reconnect and in some time its take over 10-30 second to reconnect successful . i set ideal time-out 1s and life-time 1s . its reconnect faster than first one , but its stay disconnect when they move , any idea ? Note: when i disable Simultaneous-Use its work fine and client stay connect but when i enable it i see this problem . Note: I use value 1 for Simultaneous-Use .

4 8

EAP-AKA support in FreeRADIUS
by sangram kishore 20 Jun '19

20 Jun '19

Hi Experts, I am using FreeRADIUS (3.0.19). Does FreeRADIUS support EAP-AKA? If yes, please share the pointers to the code, build commands and sample configurations for the same. Much appreciated any help here. Thanks, Sangram Kishore

2 4