- Freeradius-Users - lists.freeradius.org

freeradius winbind and require-membership-of
by Vieri 08 Dec '17

08 Dec '17

Hi, I used to specify an AD group with a command such as: /usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=DOMAIN --require-membership-of=DOMAIN\\ALLOWED_GROUP --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} I'm now using winbind with freeradius. mods-available/mschap: winbind_username = "%{mschap:User-Name}" winbind_domain = "%{mschap:NT-Domain}" Is there a require-membership-of alternative for winbind? Thanks, Vieri

2 1

connectivity issues with different devices
by Andrew Meyer 07 Dec '17

07 Dec '17

Hello, I emailed in about a week ago trying to get eap+ttls configured to work with my MacBooks and mobile devices. I have finally gotten that working. However now i'm running into another issues. We had to do a code upgrade on my wireless to support TLS 1.2 which is now done. Right now i'm facing an issue JUST on Mac OS X High Sierra where it is not able to authenticate. In order to get the mobile devices working on my test SSID I had to disable EAP+TLS termination from the Access Points to the FreeRADIUS server. I have EAP+TTLS setup to use PAP beacuse I'm authenticating to LDAP/FreeIPA. This is working for Mac OS X 10.11.x, 10.12.x, Android 6 & 7, but not for High Sierra 10.13.x. I am still working on procuring a Apple Mobile device that is on the latest code. So i'm trying to figure out if I need to change the config slightly but not 100% sure. But here is my debug output right now: Thu Dec 7 21:00:28 2017 : Debug: (35) Message-Authenticator = 0x9cc50130f378dd9808a639a0c01c246d Thu Dec 7 21:00:28 2017 : Debug: (35) session-state: No cached attributes Thu Dec 7 21:00:28 2017 : Debug: (35) # Executing section authorize from file /etc/raddb/sites-enabled/default Thu Dec 7 21:00:28 2017 : Debug: (35) authorize { Thu Dec 7 21:00:28 2017 : Debug: (35) policy filter_username { Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name) { Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name) -> TRUE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name) { Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ / /) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ / /) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /@[^@]*@/ ) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /\.\./ ) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /\.\./ ) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /\.$/) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /\.$/) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /(a)\./) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /(a)\./) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) } # if (&User-Name) = notfound Thu Dec 7 21:00:28 2017 : Debug: (35) } # policy filter_username = notfound Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling preprocess (rlm_preprocess) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from preprocess (rlm_preprocess) Thu Dec 7 21:00:28 2017 : Debug: (35) [preprocess] = ok Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling chap (rlm_chap) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from chap (rlm_chap) Thu Dec 7 21:00:28 2017 : Debug: (35) [chap] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling mschap (rlm_mschap) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from mschap (rlm_mschap) Thu Dec 7 21:00:28 2017 : Debug: (35) [mschap] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling digest (rlm_digest) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from digest (rlm_digest) Thu Dec 7 21:00:28 2017 : Debug: (35) [digest] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling suffix (rlm_realm) Thu Dec 7 21:00:28 2017 : Debug: (35) suffix: Checking for suffix after "@" Thu Dec 7 21:00:28 2017 : Debug: (35) suffix: No '@' in User-Name = "andrew.meyer", looking up realm NULL Thu Dec 7 21:00:28 2017 : Debug: (35) suffix: No such realm "NULL" Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from suffix (rlm_realm) Thu Dec 7 21:00:28 2017 : Debug: (35) [suffix] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Peer sent EAP Response (code 2) ID 8 length 119 Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Continuing tunnel setup Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) [eap] = ok Thu Dec 7 21:00:28 2017 : Debug: (35) } # authorize = ok Thu Dec 7 21:00:28 2017 : Debug: (35) Found Auth-Type = eap Thu Dec 7 21:00:28 2017 : Debug: (35) # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 7 21:00:28 2017 : Debug: (35) authenticate { Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authenticate]: calling eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Expiring EAP session with state 0x7ee913c27feb09b0 Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Finished EAP session with state 0x4bff8a3e4df79f46 Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Previous EAP request found for state 0x4bff8a3e4df79f46, released from the list Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Peer sent packet with method EAP TTLS (21) Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Calling submodule eap_ttls to process data Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: Authenticate Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: Continuing EAP-TLS Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: Peer sent flags --L Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: Peer indicated complete TLS record size will be 109 bytes Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: Got complete TLS record (109 bytes) Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: [eaptls verify] = length included Thu Dec 7 21:00:28 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: [eaptls process] = ok Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: Session established. Proceeding to decode tunneled attributes Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: Got tunneled request Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: EAP-Message = 0x020200471a02020042310c2b32464a4d784b18430da9031e0a2c0000000000000000b79f070b5edc9d77e6b3a8afe5e8e14058595469c43a365700616e647265772e6d65796572 Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 Thu Dec 7 21:00:28 2017 : Debug: (35) Virtual server inner-tunnel received request Thu Dec 7 21:00:28 2017 : Debug: (35) EAP-Message = 0x020200471a02020042310c2b32464a4d784b18430da9031e0a2c0000000000000000b79f070b5edc9d77e6b3a8afe5e8e14058595469c43a365700616e647265772e6d65796572 Thu Dec 7 21:00:28 2017 : Debug: (35) FreeRADIUS-Proxied-To = 127.0.0.1 Thu Dec 7 21:00:28 2017 : Debug: (35) User-Name = "andrew.meyer" Thu Dec 7 21:00:28 2017 : Debug: (35) State = 0x7ee913c27feb09b057d7e8dcddbcec86 Thu Dec 7 21:00:28 2017 : WARNING: (35) Outer and inner identities are the same. User privacy is compromised. Thu Dec 7 21:00:28 2017 : Debug: (35) server inner-tunnel { Thu Dec 7 21:00:28 2017 : Debug: (35) session-state: No cached attributes Thu Dec 7 21:00:28 2017 : Debug: (35) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Thu Dec 7 21:00:28 2017 : Debug: (35) authorize { Thu Dec 7 21:00:28 2017 : Debug: (35) policy filter_username { Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name) { Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name) -> TRUE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name) { Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ / /) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ / /) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /@[^@]*@/ ) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /@[^@]*@/ ) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /\.\./ ) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /\.\./ ) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /\.$/) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /\.$/) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /(a)\./) { Thu Dec 7 21:00:28 2017 : Debug: No matches Thu Dec 7 21:00:28 2017 : Debug: (35) if (&User-Name =~ /(a)\./) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) } # if (&User-Name) = notfound Thu Dec 7 21:00:28 2017 : Debug: (35) } # policy filter_username = notfound Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling chap (rlm_chap) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from chap (rlm_chap) Thu Dec 7 21:00:28 2017 : Debug: (35) [chap] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling mschap (rlm_mschap) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from mschap (rlm_mschap) Thu Dec 7 21:00:28 2017 : Debug: (35) [mschap] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling suffix (rlm_realm) Thu Dec 7 21:00:28 2017 : Debug: (35) suffix: Checking for suffix after "@" Thu Dec 7 21:00:28 2017 : Debug: (35) suffix: No '@' in User-Name = "andrew.meyer", looking up realm NULL Thu Dec 7 21:00:28 2017 : Debug: (35) suffix: No such realm "NULL" Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from suffix (rlm_realm) Thu Dec 7 21:00:28 2017 : Debug: (35) [suffix] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) update control { Thu Dec 7 21:00:28 2017 : Debug: (35) &Proxy-To-Realm := LOCAL Thu Dec 7 21:00:28 2017 : Debug: (35) } # update control = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Peer sent EAP Response (code 2) ID 2 length 71 Thu Dec 7 21:00:28 2017 : Debug: (35) eap: No EAP Start, assuming it's an on-going EAP conversation Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) [eap] = updated Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling files (rlm_files) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from files (rlm_files) Thu Dec 7 21:00:28 2017 : Debug: (35) [files] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling ldap (rlm_ldap) Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: EXPAND TMPL LITERAL Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: EXPAND TMPL LITERAL Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: EXPAND TMPL LITERAL Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: EXPAND TMPL LITERAL Thu Dec 7 21:00:28 2017 : Debug: rlm_ldap (ldap): Reserved connection (10) Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: EXPAND TMPL XLAT Thu Dec 7 21:00:28 2017 : Debug: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Thu Dec 7 21:00:28 2017 : Debug: Parsed xlat tree: Thu Dec 7 21:00:28 2017 : Debug: literal --> (uid= Thu Dec 7 21:00:28 2017 : Debug: XLAT-IF { Thu Dec 7 21:00:28 2017 : Debug: attribute --> Stripped-User-Name Thu Dec 7 21:00:28 2017 : Debug: } Thu Dec 7 21:00:28 2017 : Debug: XLAT-ELSE { Thu Dec 7 21:00:28 2017 : Debug: attribute --> User-Name Thu Dec 7 21:00:28 2017 : Debug: } Thu Dec 7 21:00:28 2017 : Debug: literal --> ) Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: --> (uid=andrew.meyer) Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: EXPAND TMPL LITERAL Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: Performing search in "cn=users,cn=accounts,dc=gatewayblend,dc=net" with filter "(uid=andrew.meyer)", scope "sub" Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: Waiting for search result... Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: User object found at DN "uid=andrew.meyer,cn=users,cn=accounts,dc=gatewayblend,dc=net" Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: Processing user attributes Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: Attribute "userPassword" not found in LDAP object Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: Attribute "radiusControlAttribute" not found in LDAP object Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: Attribute "radiusRequestAttribute" not found in LDAP object Thu Dec 7 21:00:28 2017 : Debug: (35) ldap: Attribute "radiusReplyAttribute" not found in LDAP object Thu Dec 7 21:00:28 2017 : WARNING: (35) ldap: No "known good" password added. Ensure the admin user has permission to read the password attribute Thu Dec 7 21:00:28 2017 : WARNING: (35) ldap: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) Thu Dec 7 21:00:28 2017 : Debug: rlm_ldap (ldap): Released connection (10) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from ldap (rlm_ldap) Thu Dec 7 21:00:28 2017 : Debug: (35) [ldap] = ok Thu Dec 7 21:00:28 2017 : Debug: (35) if ((ok || updated) && User-Password) { Thu Dec 7 21:00:28 2017 : Debug: (35) if ((ok || updated) && User-Password) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling expiration (rlm_expiration) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from expiration (rlm_expiration) Thu Dec 7 21:00:28 2017 : Debug: (35) [expiration] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling logintime (rlm_logintime) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from logintime (rlm_logintime) Thu Dec 7 21:00:28 2017 : Debug: (35) [logintime] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: calling pap (rlm_pap) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authorize]: returned from pap (rlm_pap) Thu Dec 7 21:00:28 2017 : Debug: (35) [pap] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) } # authorize = updated Thu Dec 7 21:00:28 2017 : Debug: (35) Found Auth-Type = eap Thu Dec 7 21:00:28 2017 : Debug: (35) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Thu Dec 7 21:00:28 2017 : Debug: (35) authenticate { Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authenticate]: calling eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Expiring EAP session with state 0x7ee913c27feb09b0 Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Finished EAP session with state 0x7ee913c27feb09b0 Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Previous EAP request found for state 0x7ee913c27feb09b0, released from the list Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Peer sent packet with method EAP MSCHAPv2 (26) Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Calling submodule eap_mschapv2 to process data Thu Dec 7 21:00:28 2017 : Debug: (35) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Thu Dec 7 21:00:28 2017 : Debug: (35) eap_mschapv2: authenticate { Thu Dec 7 21:00:28 2017 : Debug: (35) eap_mschapv2: modsingle[authenticate]: calling mschap (rlm_mschap) Thu Dec 7 21:00:28 2017 : WARNING: (35) mschap: No Cleartext-Password configured. Cannot create NT-Password Thu Dec 7 21:00:28 2017 : WARNING: (35) mschap: No Cleartext-Password configured. Cannot create LM-Password Thu Dec 7 21:00:28 2017 : Debug: (35) mschap: Creating challenge hash with username: andrew.meyer Thu Dec 7 21:00:28 2017 : Debug: (35) mschap: Client is using MS-CHAPv2 Thu Dec 7 21:00:28 2017 : ERROR: (35) mschap: FAILED: No NT/LM-Password. Cannot perform authentication Thu Dec 7 21:00:28 2017 : ERROR: (35) mschap: MS-CHAP2-Response is incorrect Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authenticate]: returned from mschap (rlm_mschap) Thu Dec 7 21:00:28 2017 : Debug: (35) [mschap] = reject Thu Dec 7 21:00:28 2017 : Debug: (35) } # authenticate = reject Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Sending EAP Failure (code 4) ID 2 length 4 Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Freeing handler Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authenticate]: returned from eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) [eap] = reject Thu Dec 7 21:00:28 2017 : Debug: (35) } # authenticate = reject Thu Dec 7 21:00:28 2017 : Debug: (35) Failed to authenticate the user Thu Dec 7 21:00:28 2017 : Debug: (35) Using Post-Auth-Type Reject Thu Dec 7 21:00:28 2017 : Debug: (35) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Thu Dec 7 21:00:28 2017 : Debug: (35) Post-Auth-Type REJECT { Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Thu Dec 7 21:00:28 2017 : Debug: %{User-Name} Thu Dec 7 21:00:28 2017 : Debug: Parsed xlat tree: Thu Dec 7 21:00:28 2017 : Debug: attribute --> User-Name Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: EXPAND %{User-Name} Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: --> andrew.meyer Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: Matched entry DEFAULT at line 11 Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: MS-CHAP-Error = "\002E=691 R=1 C=6bfbf7b2dac4da0509b000cb87f64dd1 V=3 M=Authentication failed" allowed by MS-CHAP-Error =* "" Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: Attribute "MS-CHAP-Error" allowed by 1 rules, disallowed by 0 rules Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: EAP-Message = 0x04020004 allowed by EAP-Message =* 0x Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: Attribute "EAP-Message" allowed by 1 rules, disallowed by 0 rules Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: Message-Authenticator = 0x00000000000000000000000000000000 allowed by Message-Authenticator =* 0x Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: Attribute "Message-Authenticator" allowed by 1 rules, disallowed by 0 rules Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) Thu Dec 7 21:00:28 2017 : Debug: (35) [attr_filter.access_reject] = updated Thu Dec 7 21:00:28 2017 : Debug: (35) update outer.session-state { Thu Dec 7 21:00:28 2017 : Debug: (35) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: FAILED: No NT/LM-Password. Cannot perform authentication' Thu Dec 7 21:00:28 2017 : Debug: (35) } # update outer.session-state = noop Thu Dec 7 21:00:28 2017 : Debug: (35) } # Post-Auth-Type REJECT = updated Thu Dec 7 21:00:28 2017 : Debug: (35) } # server inner-tunnel Thu Dec 7 21:00:28 2017 : Debug: (35) Virtual server sending reply Thu Dec 7 21:00:28 2017 : Debug: (35) MS-CHAP-Error = "\002E=691 R=1 C=6bfbf7b2dac4da0509b000cb87f64dd1 V=3 M=Authentication failed" Thu Dec 7 21:00:28 2017 : Debug: (35) EAP-Message = 0x04020004 Thu Dec 7 21:00:28 2017 : Debug: (35) Message-Authenticator = 0x00000000000000000000000000000000 Thu Dec 7 21:00:28 2017 : Debug: (35) eap_ttls: Got tunneled Access-Reject Thu Dec 7 21:00:28 2017 : ERROR: (35) eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Sending EAP Failure (code 4) ID 8 length 4 Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Failed in EAP select Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[authenticate]: returned from eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) [eap] = invalid Thu Dec 7 21:00:28 2017 : Debug: (35) } # authenticate = invalid Thu Dec 7 21:00:28 2017 : Debug: (35) Failed to authenticate the user Thu Dec 7 21:00:28 2017 : Debug: (35) Using Post-Auth-Type Reject Thu Dec 7 21:00:28 2017 : Debug: (35) # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 7 21:00:28 2017 : Debug: (35) Post-Auth-Type REJECT { Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) Thu Dec 7 21:00:28 2017 : Debug: %{User-Name} Thu Dec 7 21:00:28 2017 : Debug: Parsed xlat tree: Thu Dec 7 21:00:28 2017 : Debug: attribute --> User-Name Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: EXPAND %{User-Name} Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: --> andrew.meyer Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: Matched entry DEFAULT at line 11 Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: EAP-Message = 0x04080004 allowed by EAP-Message =* 0x Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: Attribute "EAP-Message" allowed by 1 rules, disallowed by 0 rules Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: Message-Authenticator = 0x00000000000000000000000000000000 allowed by Message-Authenticator =* 0x Thu Dec 7 21:00:28 2017 : Debug: (35) attr_filter.access_reject: Attribute "Message-Authenticator" allowed by 1 rules, disallowed by 0 rules Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) Thu Dec 7 21:00:28 2017 : Debug: (35) [attr_filter.access_reject] = updated Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[post-auth]: calling eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) eap: Reply already contained an EAP-Message, not inserting EAP-Failure Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[post-auth]: returned from eap (rlm_eap) Thu Dec 7 21:00:28 2017 : Debug: (35) [eap] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) policy remove_reply_message_if_eap { Thu Dec 7 21:00:28 2017 : Debug: (35) if (&reply:EAP-Message && &reply:Reply-Message) { Thu Dec 7 21:00:28 2017 : Debug: (35) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE Thu Dec 7 21:00:28 2017 : Debug: (35) else { Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[post-auth]: calling noop (rlm_always) Thu Dec 7 21:00:28 2017 : Debug: (35) modsingle[post-auth]: returned from noop (rlm_always) Thu Dec 7 21:00:28 2017 : Debug: (35) [noop] = noop Thu Dec 7 21:00:28 2017 : Debug: (35) } # else = noop Thu Dec 7 21:00:28 2017 : Debug: (35) } # policy remove_reply_message_if_eap = noop Thu Dec 7 21:00:28 2017 : Debug: (35) } # Post-Auth-Type REJECT = updated Thu Dec 7 21:00:28 2017 : Debug: (35) Delaying response for 1.000000 seconds Thu Dec 7 21:00:28 2017 : Debug: Thread 4 waiting to be assigned a request Thu Dec 7 21:00:28 2017 : Debug: Waking up in 0.6 seconds. Thu Dec 7 21:00:29 2017 : Debug: (35) Sending delayed response Thu Dec 7 21:00:29 2017 : Debug: (35) Sent Access-Reject Id 249 from 10.1.6.160:1812 to 10.1.10.2:37381 length 44 Thu Dec 7 21:00:29 2017 : Debug: (35) EAP-Message = 0x04080004 Thu Dec 7 21:00:29 2017 : Debug: (35) Message-Authenticator = 0x00000000000000000000000000000000 Thu Dec 7 21:00:29 2017 : Debug: Waking up in 3.9 seconds. Thu Dec 7 21:00:33 2017 : Debug: (28) Cleaning up request packet ID 242 with timestamp +3225 Thu Dec 7 21:00:33 2017 : Debug: (29) Cleaning up request packet ID 243 with timestamp +3225 Thu Dec 7 21:00:33 2017 : Debug: (30) Cleaning up request packet ID 244 with timestamp +3225 Thu Dec 7 21:00:33 2017 : Debug: (31) Cleaning up request packet ID 245 with timestamp +3225 Thu Dec 7 21:00:33 2017 : Debug: (32) Cleaning up request packet ID 246 with timestamp +3225 Thu Dec 7 21:00:33 2017 : Debug: (33) Cleaning up request packet ID 247 with timestamp +3225 Thu Dec 7 21:00:33 2017 : Debug: (34) Cleaning up request packet ID 248 with timestamp +3225 Thu Dec 7 21:00:33 2017 : Debug: (35) Cleaning up request packet ID 249 with timestamp +3225 Thu Dec 7 21:00:33 2017 : Info: Ready to process requests Thank you in advance, Andrew

2 3

Subject: Re: Google authentication FreeRadius stop working
by Janet Wang 07 Dec '17

07 Dec '17

Thank you Alan Buxey. Here are my debug result: radtest jzwang(a)yyy.yyy.yy 'yyy11111' localhost 18120 testing123 Sending Access-Request of id 149 to 127.0.0.1 port 1812 User-Name = "jzwang(a)yyy.yyy.yy" User-Password = "yyy11111" NAS-IP-Address = 10.10.10.10 NAS-Port = 18120 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 149 to 127.0.0.1 port 1812 User-Name = "jzwang(a)yyy.yyy.yy" User-Password = "yyy11111" NAS-IP-Address = 10.10.10.10 NAS-Port = 18120 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 149 to 127.0.0.1 port 1812 User-Name = "jzwang(a)yyy.yyy.yy" User-Password = "yyy11111" NAS-IP-Address = 10.10.10.10 NAS-Port = 18120 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 149 socket 3 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 56584, id=149, length=8 9 User-Name = "jzwang(a)yyy.yyy.yy" User-Password = "yyy11111" NAS-IP-Address = 10.10.10.10 NAS-Port = 18120 Message-Authenticator = 0x40bb61c5f9140c89eceab51ae14f3df3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "yyy.yyy.yy" for User-Name = "jzwang(a)yyy.yyy.yy" [suffix] No such realm "yyy.yyy.yy" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 73 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = PAM # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: authentication succeeded for <jzwang(a)yyy.yyy.yy> ++[pam] returns ok Login OK: [jzwang(a)yyy.yyy.yy/yyy11111] (from client localhost port 18120) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 149 to 127.0.0.1 port 56584 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 56584, id=149, length=89 Sending duplicate reply to client localhost port 56584 - ID: 149 Sending Access-Accept of id 149 to 127.0.0.1 port 56584 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 56584, id=149, length=89 Sending duplicate reply to client localhost port 56584 - ID: 149 Sending Access-Accept of id 149 to 127.0.0.1 port 56584 Waking up in 4.9 seconds. Cleaning up request 0 ID 149 with timestamp +164 Ready to process requests.

1 0

Google authentication FreeRadius stop working
by Janet Wang 07 Dec '17

07 Dec '17

Hello all, I have google authentication Free Radius server. It is running Ubuntu. It is for 2 factor authentication for our Horzion View. Since yesterday afternoon, this radius server stopped working. It won't authenticator any domain users anymore. I ran radtest from the box itself, it gave me err message: radclient: no response from server for ID 88 socket 3 In the radius.log: Thu Dec 7 11:02:07 2017 : Error: Discarding duplicate request from client localhost port 50181 - ID: 222 due to unfinished request 0 Thu Dec 7 11:02:12 2017 : Error: Discarding duplicate request from client localhost port 50181 - ID: 222 due to unfinished request 0 Thu Dec 7 11:02:34 2017 : Error: WARNING: Unresponsive child for request 0, in component authenticate module pam Thu Dec 7 11:02:35 2017 : Info: WARNING: Child is hung for request 0 in component authenticate module pam. Thu Dec 7 11:02:37 2017 : Info: WARNING: Child is hung for request 0 in component authenticate module pam. Thu Dec 7 11:02:39 2017 : Info: WARNING: Child is hung for request 0 in component authenticate module pam. Thu Dec 7 11:02:42 2017 : Info: WARNING: Child is hung for request 0 in component authenticate module pam. Would you please tell me how to solve the issues? Thank you

3 3

Bring your own CERT for TLS EAP using FreeRadius
by Michael Duckett 07 Dec '17

07 Dec '17

I want to use FreeRadius for 802.1x authentication. I have a cert that's provided by an equipment manufacturer which I need to "install"/import into FR. Can someone point me to documentation to accomplish this? I don't want to generate a cert. I want to import key/cert, etc provided by the equipment manufacturer. Thank you.

2 2

Re: FreeRADIUS 3.0.12 + openLDAP + Apple access point?
by Tobias Balle-Petersen 07 Dec '17

07 Dec '17

It seems like the problem is with my huntgroup. In users: This will allow me to log in from the access point: DEFAULT Ldap-Group == "wifi-cph" With this definition I am rejected: DEFAULT Ldap-Group == "wifi-cph", Huntgroup-Name == "accesspoints-lan" The huntgroup from the huntgroups file # Group of accesspoint. Login from those, and you needi # to be a member of the wifi-copenhagen group (LDAP) accesspoints-lan NAS-IP-Address == 172.22.33.11 accesspoints-lan NAS-IP-Address == 172.22.33.22 accesspoints-lan NAS-IP-Address == 172.22.33.30 accesspoints-lan NAS-IP-Address == 172.22.33.33 accesspoints-lan NAS-IP-Address == 172.22.33.34 This is what I get when the access point connects: Thu Dec 7 09:28:15 2017 : Debug: (11) User-Name = "***" Thu Dec 7 09:28:15 2017 : Debug: (11) NAS-IP-Address = 172.22.33.33 Maybe the NAS-IP-Address is not available in the inner tunnel?

2 4

Re: FreeRADIUS 3.0.12 + openLDAP + Apple access point?
by Tobias Balle-Petersen 07 Dec '17

07 Dec '17

> (18) files: users: Matched entry DEFAULT at line 63 > > What is on line 63 of the users file? > > That is my reject. The user should have been matched earlier, because he's a member of some of the groups mentioned. This works when testing with "radtest -x -t pap ..." which, I assumed, meant that the problem could not be in the "users" file? 52 DEFAULT Ldap-Group == "wifi-cph", Huntgroup-Name == "accesspoints-lan" 53 Reply-Message = "OK, member of wifi-cph." 54 55 DEFAULT Ldap-Group == "wifi-cph-guest", Huntgroup-Name == "accesspoints-guest" 56 Reply-Message = "OK, member og wifii-cph-guest." 57 58 #DEFAULT Ldap-Group == "vpn-copenhagen", Huntgroup-Name == "vpn" 59 DEFAULT Ldap-Group == "kp-vpn-cph", Huntgroup-Name == "kp-vpn" 60 Reply-Message = "OK, member of kp-vpn-cph." 61 62 # Reject everyone (Who did not match above) 63 DEFAULT Auth-Type := Reject 64 Reply-Message = "Sorry, no access for you."

1 0

Matching IP addresses
by Paul Thornton 06 Dec '17

06 Dec '17

Hi all, I currently have some unlang code that looks like this (I've fixed the wrapping to make it legible: if ((&request:NAS-IP-Address =~ /^192.168.0.3[2-9]/) || (&request:NAS-IP-Address =~ /^192.168.0.[45][0-9]/) || (&request:NAS-IP-Address =~ /^192.168.0.6[0-3]/)) { ... do stuff } This is a check for "Is the NAS-IP-Address in 192.168.0.32/27"? Is there a neater way to do this? - the obvious option: if (&request:NAS-IP-Address == 192.168.0.32/27) { doesn't work, and I can't see any anything else in a rummage through the documentation that might work. It isn't a big deal, the regex option works; it just isn't very elegant. Thanks Paul.

5 6

how to add atribute session-timeout in LDAP
by johan firdianto 06 Dec '17

06 Dec '17

I'm newbie in LDAP. I has tested my radius server, and works normally againts SQL database. i could put many attribute like session time out , etc to sql db. and now, how could we get attribute like session time-out from ldap ? I read in many tutorial related authenticating user /password using LDAP. Thanks in Advance Johan

2 1

Huntgroup matching when using PostgreSQL to authenticate users in 3.0.13
by Gianni Costanzi 06 Dec '17

06 Dec '17

Hi, we have a working 3.0.13 Freeradius installation which authenticates users using a PostgreSQL DB and I was wondering where I should add the Huntgroup matching in the sql DB. For example I've put the following configuration within the PostgreSQL database tables (radcheck for the secret, radreply for the returned parameters) c89c.1dd9.ce81 Cleartext-Password := "mysecret" ERX-Virtual-Router-Name = default:vrf-test, ERX-Qos-Set-Name = "XXXX", ERX-CoS-Shaping-Pmt-Type = "T01 SM-xxx", ERX-CoS-Shaping-Pmt-Type += "T02 8M", ERX-CoS-Shaping-Pmt-Type += "T03 1M" With the users file it is easy to implement huntgroup matching, I could return different parameters for the same user depending on the huntgroup with: c89c.1dd9.ce81 Cleartext-Password := "mysecret", Huntgroup-Name == XXX ERX-Virtual-Router-Name = default:vrf-XXX, [...] c89c.1dd9.ce81 Cleartext-Password := "mysecret", Huntgroup-Name == YYY ERX-Virtual-Router-Name = default:vrf-YYY, [...] Maybe it is not possible to implement this behavior with a DB backend, but I would be happy to know at least how to use a single Huntgroup-Name matching for the users contained within the PostgreSQL DB (I want to autenticate users with the data in the DB only if the NAS-IP-Address from where they are authenticated matches a specific huntgroup) Best regards, Gianni Costanzi

1 0