- Freeradius-Users - lists.freeradius.org

Re: Post-Auth LDAP with computer names rather than usernames
by Kevin Virk 22 Oct '18

22 Oct '18

I recently sparked a discussion regarding post-auth with computer names rather than usernames and I did not include complete information, my apologies. I am currently using EAP-TLS and have crafted certificates based on usernames. Alan had responded saying that post-auth via Ldap was possible if you make certs with workstations names included. I can do this my question is then does the stripped username take the computer name and then do my ldap queries just need to change to check workstation groups rather than security groups ? Thank you in advance for any help.

2 1

freeradius3 couldnt connect to mysql-server
by Lukas Nuth 22 Oct '18

22 Oct '18

Hi, FreeRADIUS starts with my virtual machine. Therefore Ubuntu created the file "radiusd.service" itself. I activated "radius.service" with "systemctl enable radiusd.service" so that FR starts with the virtual machine. Now the problem when FR starts with the virtual machine is that the following error message can be found in the log file: Mon Oct 22 08:45:40 2018 : Info: Debugger not attached Mon Oct 22 08:45:41 2018 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Oct 22 08:45:42 2018 : Info: rlm_sql_mysql: libmysql version: 5.7.23 Mon Oct 22 08:45:42 2018 : Info: rlm_sql (sql): Attempting to connect to database "radius" Mon Oct 22 08:45:42 2018 : Info: rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used Mon Oct 22 08:45:42 2018 : Error: rlm_sql_mysql: Couldn't connect to MySQL server radius@localhost:radius Mon Oct 22 08:45:42 2018 : Error: rlm_sql_mysql: MySQL error: Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2) Mon Oct 22 08:45:42 2018 : Error: rlm_sql (sql): Opening connection failed (0) Mon Oct 22 08:45:42 2018 : Error: /etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" If I restart FR with "systemctl restart radiusd.service" this error does not occur. Can anyone help me? regards Lukas

3 4

Add bandwidth to user
by me＠erikthiart.com 21 Oct '18

21 Oct '18

Hello, What is the best way to go about adding additional bandwidth to a user in freeradius? Scenario: I have mikrotik hotspots using mac auth and in freeradius I have a realm setup with a bandwidth limit of 400mb, when some users perform a certain action I want to increase the bandwidth for said users by 200mb for example.

3 2

DB valid fields
by Stephen 20 Oct '18

20 Oct '18

So I'm using freeradius with postgresql and eap-tls. I would love to know where the documentation for the acceptable radreply entries is. The closest thing to documentation that I've found has been: https://wiki.freeradius.org/guide/SQL-HOWTO#populating-sql Aside from the limited and anecdotal references found there to fields like `Framed-IP-Address`, where can I find a comprehensive accounting of the attributes and values I can leverage in my radreply table? Thanks in advance!

4 9

Post-Auth LDAP with computer names rather than usernames
by Kevin Virk 20 Oct '18

20 Oct '18

I currently have dynamic vlans working with post-auth user authentication but my boss would like to do it based off computer name. I have searched and become a little confused as how to proceed. In the LDAP conf do I change stripped username to stripped computer name or is it more complicated than that? ________________________________ From: Freeradius-Users <freeradius-users-bounces+kevin.virk=faithlife.com(a)lists.freeradius.org> on behalf of freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Sent: Monday, September 3, 2018 10:19 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 161, Issue 2 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users<http://lists.freeradius.org/mailman/listinfo/freeradius-users> or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: VLan affect based on ldap attribute freeradius v3 (jehan procaccia INT) 2. rlm_sql not checking radgroupreply (tomas.meier(a)fettabernett.de) ---------------------------------------------------------------------- Message: 1 Date: Mon, 3 Sep 2018 16:04:11 +0200 From: jehan procaccia INT <jehan.procaccia(a)int-evry.fr> To: FreeRadius users mailing list <Freeradius-Users(a)lists.freeradius.org> Cc: aland(a)deployingradius.com, Christophe GABORET <Christophe.Gaboret(a)tem-tsp.eu> Subject: Re: VLan affect based on ldap attribute freeradius v3 Message-ID: <f6b5995f-5959-a196-5bb0-513525683e5a(a)int-evry.fr> Content-Type: text/plain; charset=utf-8 Hello sucessfull reponses below ... Le 31/08/2018 à 14:59, Alan DeKok a écrit : >> On Aug 31, 2018, at 4:45 AM, jehan procaccia INT >> <jehan.procaccia(a)int-evry.fr> wrote: >> >> unfortunatly it fails, User-Category attribute fetch from ldap >> edupersonPrimaryAffiliation doesn't pass though different >> states/modules apparently > Yes, it does. You should be able to tell what's going on by reading > the debug output. *Or* by posting the ENTIRE debug output here, and > letting someone else read it. > > You're falling into a common trap. You're trying all kinds of random > things. Without really understanding what's going on, or why. > You're posting *small* bits of the debug output, in the hope that > those bits are useful. > > They're not. > > Post the FULL DEBUG OUTPUT. > > And make sure it's for ONE USER. We're not going to read through > thousands of lines of logs about accounting packets, in order to > solve an authentication issue. you're right, after a weekend reading thouroughly http://networkradius.com/doc/FreeRADIUS Technical Guide.pdf<http://networkradius.com/doc/FreeRADIUS Technical Guide.pdf> and wiki thingsget better now , althought it's not easy to get a single user debug output from production . fortunatly you gave me the right answer with "use_tunneled_reply = yes" adding that not only (which was already set) to mods-enabled/eap section: eap { ttls { but moreover to peap { which is our prevalent method used, now makes the attribute correctly flowed in the process chapter 4.3 of the tech guide is important to understand the iteractive / recursive processing of the configuration sections and modules . the debug output seems very repetitive whitout that and https://wiki.freeradius.org/guide/radiusd-X<https://wiki.freeradius.org/guide/radiusd-X> helps a lot to . thanks for your help , now it work fine ;-) Regards PS my connection as an employee (ldap) and associated vlan accordingly : (86) prod: reply:Reply-Message := 'employee' (86) prod: reply:User-Category += 'employee' (86) Virtual server sending reply (86) Reply-Message := "employee" (86) User-Category += "employee" (86) eap_peap: Got tunneled reply RADIUS code 2 (86) eap_peap: Reply-Message := "employee" (86) eap_peap: User-Category += "employee" (88) eap_peap: Using saved attributes from the original Access-Accept (88) eap_peap: Reply-Message := "employee" (88) eap_peap: User-Category += "employee" (88) [eap] = ok (88) } # authenticate = ok (88) # Executing section post-auth from file /etc/raddb/sites-enabled/default (88) post-auth { (88) update { (88) No attributes updated (88) } # update = noop (88) reply_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (88) reply_log: --> /var/log/radius/radacct/10.91.10.10/reply-detail-20180903 (88) reply_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (88) reply_log: EXPAND %t (88) reply_log: --> Mon Sep 3 09:24:23 2018 (88) [reply_log] = ok (88) [exec] = noop (88) policy remove_reply_message_if_eap { (88) if (&reply:EAP-Message && &reply:Reply-Message) { (88) if (&reply:EAP-Message && &reply:Reply-Message) -> TRUE (88) if (&reply:EAP-Message && &reply:Reply-Message) { (88) update reply { (88) &Reply-Message !* ANY (88) } # update reply = noop (88) } # if (&reply:EAP-Message && &reply:Reply-Message) = noop (88) ... skipping else: Preceding "if" was taken (88) } # policy remove_reply_message_if_eap = noop (88) policy debug_reply { (88) if ("%{debug_attr:reply:}" == '') { (88) Attributes matching "reply:" (88) &reply:User-Category += employee (88) &reply:Stripped-User-Name = procacci (88) if ("%{debug_attr:reply:}" == '') -> TRUE (88) if ("%{debug_attr:reply:}" == '') { (88) [noop] = noop (88) } # if ("%{debug_attr:reply:}" == '') = noop (88) } # policy debug_reply = noop (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) -> TRUE (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (88) update reply { (88) Tunnel-Private-Group-Id := 903 > >> even with the usage of session-state (replacing "reply") it fails >> >> here's a new radiusd -X experiment : >> >> 1) ldap does find the attribute and associated value (here >> employee) >> >> rlm_ldap (prod): Reserved connection (7) (93) prod: >> reply:Reply-Message := 'employee' (93) prod: reply:User-Category += >> 'employee' >> >> 2) eap-peap has it >> >> (93) post-auth { (93) if (0) { (93) if (0) -> >> FALSE (93) } # post-auth = noop (93) Login OK: [radu/<via >> Auth-Type = eap>] (from client prod port 0 via TLS tunnel) (93) } # >> server inner-tunnel (93) Virtual server sending reply (93) >> Reply-Message := "employee" (93) *User-Category += "employee"* >> (93) eap_peap: Got tunneled reply code 2 (93) eap_peap: >> Reply-Message := "employee" (93) eap_peap: *User-Category += >> "employee"* > Note that's all in packet 93. AND in the "inner tunnel" virtual > server. > >> 3) eap_peap is success >> >> (94)*eap_peap: Success* > Which is packet 94. Note that "94" is NOT THE SAME as "93". > > i.e. it's a different packet. So unless you made sure to get the > attribute from packet 93 inner tunnel reply to packet 94 outer > reply... the attribute won't be in packet 94. > >> should I see something like &reply:User-Category above > No. > >> ? not been present means it's already lost ? > It hasn't been lost. > > All you need to do is read mods-available/eap, and set > "use_tunneled_reply = yes". And read the comments for that > configuration item. They explain what it is, why you need it, and > when you want to use it. > > Alan DeKok. > > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html> ------------------------------ Message: 2 Date: Mon, 3 Sep 2018 19:18:59 +0200 From: tomas.meier(a)fettabernett.de To: freeradius-users(a)lists.freeradius.org Subject: rlm_sql not checking radgroupreply Message-ID: <trinity-fc960aa8-16ac-446d-81e3-a3045449cc19-1535995139876@3c-app-gmx-bs44> Content-Type: text/plain; charset="UTF-8" Hello, I am using FreeRADIUS 3.0.17 in a MySQL setup that seems to not check radgroupreply. "radtest" gets user attributes but does not receive attributes of associated group at all. Complete debug output of radiusd -X: FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/sql including configuration file /usr/local/etc/raddb/mods-config/sql/main/sqlite/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/realm including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/accounting including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_exec # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_radutmp # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_sql # Loading module "sql" from file /usr/local/etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "sql.mydomain.de<http://sql.mydomain.de>" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND acctstoptime IS NULL" safe_characters = "#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } accounting-off { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-date('now')}, %{%{integer:Event-Timestamp}:-date('now')}, NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = %{%{integer:Event-Timestamp}:-date('now')}, acctinterval = 0, framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } instantiate { } # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "[1]http://127.0.0.1/ocsp/<http://127.0.0.1/ocsp/>" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.1.26-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Adding client 10.0.0.1 (RAS1) to global clients list rlm_sql (10.0.0.1): Client "RAS1" (sql) added [...] rlm_sql (sql): Adding client 192.168.100.1 (radius.mydomain.de<http://radius.mydomain.de>) to global clients list rlm_sql (192.168.100.1): Client "radius.mydomain.de<http://radius.mydomain.de>" (sql) added rlm_sql (sql): Adding client 127.0.0.1<http://127.0.0.1> (localhost) to global clients list rlm_sql (127.0.0.1<http://127.0.0.1>: Client "localhost" (sql) added rlm_sql (sql): Released connection (0) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipv4addr = 192.168.100.1 port = 1812 limit { max_connections = 64 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv4addr = 192.168.100.1 port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1<http://127.0.0.1> port = 18120 } Listening on auth address 192.168.100.1 port 1812 bound to server default Listening on acct address 192.168.100.1 port 1813 bound to server default Listening on auth address 127.0.0.1<http://127.0.0.1> port 18120 bound to server inner-tunnel Ready to process requests References 1. http://127.0.0.1/ocsp/<http://127.0.0.1/ocsp/> ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html> ------------------------------ End of Freeradius-Users Digest, Vol 161, Issue 2 ************************************************

4 9

Re: Compiling with OpenSSL 1.1.1 (Alan DeKok)
by Doug Wussler 19 Oct '18

19 Oct '18

Just FYI, I upgraded to 3.0.17 and compiled with OpenSSL 1.1.1. Debug info still reports UNKNOWN TLS VERSION: FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0092] (1) eap_peap: TLS_accept: SSLv3/TLS read client hello I should also mention that when using OpenSSL 1.1.1 the executable will not launch without this setting in radiusd.conf: allow_vulnerable_openssl = CVE-2016-6304 which should not be necessary with 1.1.1. Also, if interested, when attempting to compile with config setting "--without-dhcp" the compilation fails with: CC src/main/radattr.c build/objs/src/main/radattr.o: In function `process_file': /downloads/freeradius-server-3.0.17/src/main/radattr.c:842: undefined reference to `fr_dhcp_decode_options' /downloads/freeradius-server-3.0.17/src/main/radattr.c:813: undefined reference to `fr_dhcp_encode_option' collect2: error: ld returned 1 exit status make: *** [build/bin/local/radattr] Error 1 This information is not intended as a complaint. I love the freeradius application and am very appreciative of all the work that goes into it. The efforts and responsiveness of both the development team and the community are extremely robust and helpful. Doug On Oct 18, 2018, at 10:09 AM, Doug Wussler <doug.wussler(a)fsu.edu> wrote: > > Compiling FreeRADIUS v 3.0.15 with OpenSSL 1.1.1 works just fine. > Just thought you might like to know the debug info reports an UNKNOWN TLS VERSION: Upgrade to 3.0.17. Alan DeKok.

2 1

"Dummy" radiusd Python module ;-)
by Stefan Paetow 18 Oct '18

18 Oct '18

Hi, Question... there isn't per chance a dummy radiusd Python module out there that can be used to mock up FR structures accessible through Python, is there? :-) Reason I ask is because as much as FR can be built on a macOS environment, the person in question doesn't need/want a full FreeRADIUS environment on their system to develop some Python modules... :-) With Regards Stefan Paetow Consultant, Trust and Identity t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

3 3

EAP-TLS failure
by Stephen 18 Oct '18

18 Oct '18

Hi all- trying to understand a particular failure/error. I've been using dd-wrt, freeradius and strongswan together for almost a year (mostly) without issue. Freeradius provides my eap-tls functionality passed either through the wifi router (dd-wrt) or VPN (strongswan). Recently my macbook was upgraded to MacOS Mojave and I appear to no longer auth to wireless with the same cert. The cert still works for strongswan auth. Below are my logs for either scenario: [dd-wrt client auth failure] (993) eap: Expiring EAP session with state 0xaa3880f3ad308d40 (993) eap: Finished EAP session with state 0xaa3880f3ad308d40 (993) eap: Previous EAP request found for state 0xaa3880f3ad308d40, released from the list (993) eap: Peer sent packet with method EAP TLS (13) (993) eap: Calling submodule eap_tls to process data (993) eap_tls: Continuing EAP-TLS (993) eap_tls: Peer indicated complete TLS record size will be 7 bytes (993) eap_tls: Got complete TLS record (7 bytes) (993) eap_tls: [eaptls verify] = length included (993) eap_tls: <<< recv TLS 1.2 [length 0002] (993) eap_tls: ERROR: TLS_accept: Failed in SSLv3 read client certificate A (993) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:140350E5:SSL routines:ACCEPT_SR_CERT:ssl handshake failure (993) eap_tls: ERROR: System call (I/O) error (-1) (993) eap_tls: ERROR: TLS receive handshake failed during operation (993) eap_tls: ERROR: [eaptls process] = fail (993) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (993) eap: Sending EAP Failure (code 4) ID 8 length 4 (993) eap: Failed in EAP select --- [strongswan client auth success] (2171) eap: Expiring EAP session with state 0x92fe72999ff07f67 (2171) eap: Finished EAP session with state 0x92fe72999ff07f67 (2171) eap: Previous EAP request found for state 0x92fe72999ff07f67, released from the list (2171) eap: Peer sent packet with method EAP TLS (13) (2171) eap: Calling submodule eap_tls to process data (2171) eap_tls: Continuing EAP-TLS (2171) eap_tls: Got final TLS record fragment (272 bytes) (2171) eap_tls: [eaptls verify] = ok (2171) eap_tls: Done initial handshake (2171) eap_tls: <<< recv TLS 1.2 [length 1458] (2171) eap_tls: TLS - Creating attributes from certificate OIDs (2171) eap_tls: TLS-Cert-Serial := "<omitted>" (2171) eap_tls: TLS-Cert-Expiration := "<omitted>" (2171) eap_tls: TLS-Cert-Subject := "/C=ZL/ST=Null/L=Nowhere/O=Nulllabs/OU=Root CA/CN=server.mgmt/emailAddress=poseidon(a)services.mgmt" (2171) eap_tls: TLS-Cert-Issuer := "/C=ZL/ST=Null/L=Nowhere/O=Nulllabs/OU=Root CA/CN=server.mgmt/emailAddress=poseidon(a)services.mgmt" (2171) eap_tls: TLS-Cert-Common-Name := "server.mgmt" (2171) eap_tls: TLS - Creating attributes from certificate OIDs (2171) eap_tls: TLS-Client-Cert-Serial := "<omitted>" (2171) eap_tls: TLS-Client-Cert-Expiration := "<omitted>" (2171) eap_tls: TLS-Client-Cert-Subject := "/C=ZL/ST=Zero/L=Nowhere/O=Nulllabs/O=Endpoint/OU=Nulllabs-Endpoints/CN=mbp.home/emailAddress=poseidon(a)services.mgmt" (2171) eap_tls: TLS-Client-Cert-Issuer := "/C=ZL/ST=Null/L=Nowhere/O=Nulllabs/OU=Root CA/CN=server.mgmt/emailAddress=poseidon(a)services.mgmt" (2171) eap_tls: TLS-Client-Cert-Common-Name := "mbp.home" (2171) eap_tls: TLS-Client-Cert-X509v3-Authority-Key-Identifier += "<omitted>" (2171) eap_tls: TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication, IPSec User, IPSec End System, E-mail Protection, Code Signing" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.7" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.5" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.4" (2171) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.3" (2171) eap_tls: TLS_accept: SSLv3 read client certificate A What I should be seeing is the following: [dd-wrt client success] (1015) eap: Expiring EAP session with state 0xbd2980f9b0278d8b (1015) eap: Finished EAP session with state 0xbd2980f9b0278d8b (1015) eap: Previous EAP request found for state 0xbd2980f9b0278d8b, released from the list (1015) eap: Peer sent packet with method EAP TLS (13) (1015) eap: Calling submodule eap_tls to process data (1015) eap_tls: Continuing EAP-TLS (1015) eap_tls: Peer ACKed our handshake fragment. handshake is finished (1015) eap_tls: [eaptls verify] = success (1015) eap_tls: [eaptls process] = success (1015) eap: Sending EAP Success (code 3) ID 14 length 4 (1015) eap: Freeing handler This was shown by another dd-wrt client on the same setup (High Sierra). Anyone else seeing similar issues with MacOS Mojave? Am I missing an extended key usage parameter or am I doing something else wrong? Thanks in advance.

3 4

Compiling with OpenSSL 1.1.1
by Doug Wussler 18 Oct '18

18 Oct '18

Compiling FreeRADIUS v 3.0.15 with OpenSSL 1.1.1 works just fine. Just thought you might like to know the debug info reports an UNKNOWN TLS VERSION: (2) fsu-eap: Peer sent packet with method EAP PEAP (25) (2) fsu-eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 151 bytes (2) eap_peap: Got complete TLS record (151 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0092] (2) eap_peap: TLS_accept: SSLv3/TLS read client hello (2) eap_peap: >>> send TLS 1.2 [length 005d] (2) eap_peap: TLS_accept: SSLv3/TLS write server hello (2) eap_peap: >>> send TLS 1.2 [length 088b] (2) eap_peap: TLS_accept: SSLv3/TLS write certificate (2) eap_peap: >>> send TLS 1.2 [length 0095] (2) eap_peap: TLS_accept: SSLv3/TLS write key exchange (2) eap_peap: >>> send TLS 1.2 [length 0004] (2) eap_peap: TLS_accept: SSLv3/TLS write server done (2) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (2) eap_peap: In SSL Handshake Phase (2) eap_peap: In SSL Accept mode (2) eap_peap: [eaptls process] = handled Doug Wussler Florida State University

2 1

Debug log for just one user
by Enrico Polesel 17 Oct '18

17 Oct '18

Hi, I would like to have debug logs (like `freeradius -X`) only for one user (that I may identify with the mac address), using a dedicated SSID with a dedicated radius server is not an option since he has problems only with a particular SSID. I found in the wiki (https://wiki.freeradius.org/config/Logging) that I may increase debug level with unlang using > update control { > Tmp-String-0 = "%{debug:1}" > } I have two questions about that: 1. which levels are available? Which one is more verbose and which one is less verbose? 2. which level is equivalent (or similar) to the output of `freeradius -X`? I use freeradius 3.0.17 compiled from git. Thank you for your time and your great job on freeradius. Enrico Polesel

2 2