- Freeradius-Users - lists.freeradius.org

A general question about the downsides or gotchas of rlm_rest.
by work vlpl 16 Aug '24

16 Aug '24

I used to use rlm_python3 and now want to give rlm_rest a try. On GitHub, I see the example for module configuration, but some references, like the recv_coa function/section, are missing. I haven't tried using it yet, but I suspect this might be due to outdated documentation. So, I want to ask: does rlm_rest have any downsides compared to rlm_python3? Maybe something not obvious or critical that I should consider before deciding to use it? Best regards Vladimir

2 1

assignment of vendor specific attributes in the tacacs server
by Simon N 16 Aug '24

16 Aug '24

Hello everyone, i am currently testing Version 4. I have already successfully connected the ldap module to an Active Directory server. Now I want to use the Tacacs server to authenticate and authorize users. I have already tested the authentication and it works without any problems. To assign certain authorizations to the user, I want to use the user's groups on the AD. I could already test it successfully by adding the following in the sites-available/tacacs file under send Authorization-Pass-Add: if (%ldap.memberof(“Admin”)) { &reply.Viptela.Viptela-Group-Name = “netadmin” } Now I wonder if I can also use the module files to assign vendor specific attributes. For example if the service == ppp, protocol == ip and the user has a specific LDAP group. Or is the top variant the only one I can use? Thanks in advance for any help, Simon

1 0

assignment of vendor specific attributes in the tacacs server
by Simon N 16 Aug '24

16 Aug '24

Hello everyone, i am currently testing Version 4. I have already successfully connected the ldap module to an Active Directory server. Now I want to use the Tacacs server to authenticate and authorize users. I have already tested the authentication and it works without any problems. To assign certain authorizations to the user, I want to use the user's groups on the AD. I could already test it successfully by adding the following in the sites-available/tacacs file under send Authorization-Pass-Add: if (%ldap.memberof(“Admin”)) { &reply.Viptela.Viptela-Group-Name = “netadmin” } Now I wonder if I can also use the module files to assign vendor specific attributes. For example if the service == ppp, protocol == ip and the user has a specific LDAP group. Or is the top variant the only one I can use? Thanks in advance for any help, Simon

2 1

Mailing list outage
by Matthew Newton 16 Aug '24

16 Aug '24

We're doing some work to improve some of the infrastructure, which involves moving servers and networking around. The mailing list decided this was the perfect time to get a message stuck in the queue and stop delivering anything. All's running again, but it's possible there may be the odd outage here or there over the coming weeks as we continue to shuffle things around. -- Matthew

1 0

dot1x/radius not working for a Windows PC
by Elizabeth.Merritt＠L3Harris.com 16 Aug '24

16 Aug '24

We edited the hints file to remove the host/ from the prefix. Added: DEFAULT Prefix == "host/", Strip-User-Name = Yes Service-Type = Framed-User This works fine with 2 Windows workstation, but we cannot get it to work on this one workstation. We don't have access to fiddle with it in a lab to change a bunch of settings. I had the end user tech add the certs, turn on 802.1x and change some settings that I know work on the other 2 workstations. This is the debug output from the non-working workstation, included 3 packets with somewhat different information, they are not exactly the same. The main thing I noticed is this message: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session with state 0xdce90442ddea0923ee04c7b3a63d3e39 did not finish! !! !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! I read some info in there but didn't really know what I could change on the Windows 10 side. They have TLS1.2 enabled only, that part I did check. But not sure what else to look for. Received Access-Request Id 142 from 10.2.212.121:1645 to 10.2.212.41:1645 length 307 (28) Received Access-Request Id 141 from 10.2.212.121:1645 to 10.2.212.41:1645 length 289 (28) User-Name = "host/wsk-emewks451a-swfo-san.ssd.goes" (28) Service-Type = Framed-User (28) Cisco-AVPair = "service-type=Framed" (28) Framed-MTU = 1500 (28) Called-Station-Id = "50-57-A8-37-CF-08" (28) Calling-Station-Id = "08-92-04-DA-BB-CE" (28) EAP-Message = 0x02020006030d (28) Message-Authenticator = 0xbfc6b4ff2d8b0c824ebbe97f4c29ee0d (28) Cisco-AVPair = "audit-session-id=0000000000000393B2CBD69D" (28) Cisco-AVPair = "method=dot1x" (28) NAS-IP-Address = 10.2.183.68 (28) NAS-Port-Id = "GigabitEthernet0/8" (28) NAS-Port-Type = Ethernet (28) NAS-Port = 50108 (28) State = 0xdce90442dceb0023ee04c7b3a63d3e39 (28) session-state: No cached attributes (28) # Executing section authorize from file /etc/raddb/sites-enabled/default.noldap (28) authorize { (28) preprocess: hints: Matched DEFAULT at 87 (28) [preprocess] = ok (28) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (28) auth_log: --> /var/log/radius/radacct/10.2.212.121/auth-detail-20240725 (28) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.2.212.121/auth-detail-20240725 (28) auth_log: EXPAND %t (28) auth_log: --> Thu Jul 25 20:03:51 2024 (28) [auth_log] = ok (28) [chap] = noop (28) [mschap] = noop (28) suffix: Checking for suffix after "@" (28) suffix: No '@' in User-Name = "wsk-emewks451a-swfo-san.ssd.goes", looking up realm NULL (28) suffix: No such realm "NULL" (28) [suffix] = noop (28) if (!EAP-Message) { (28) if (!EAP-Message) -> FALSE (28) else { (28) eap: Peer sent EAP Response (code 2) ID 2 length 6 (28) eap: No EAP Start, assuming it's an on-going EAP conversation (28) [eap] = updated (28) } # else = updated (28) files: users: Matched entry wsk-emewks451a-swfo-san.ssd.goes at line 83414 (28) [files] = ok (28) [expiration] = noop (28) [logintime] = noop Not doing PAP as Auth-Type is already set. (28) [pap] = noop (28) } # authorize = updated (28) Found Auth-Type = eap (28) # Executing group from file /etc/raddb/sites-enabled/default.noldap (28) authenticate { (28) eap: Expiring EAP session with state 0xdce90442dceb0023 (28) eap: Finished EAP session with state 0xdce90442dceb0023 (28) eap: Previous EAP request found for state 0xdce90442dceb0023, released from the list (28) eap: Peer sent packet with method EAP NAK (3) (28) eap: Found mutually acceptable type TLS (13) (28) eap: Calling submodule eap_tls to process data (28) eap_tls: Initiating new TLS session (28) eap_tls: Setting verify mode to require certificate from client (28) eap_tls: [eaptls start] = request (28) eap: Sending EAP Request (code 1) ID 3 length 6 (28) eap: EAP session adding &reply:State = 0xdce90442ddea0923 (28) [eap] = handled (28) } # authenticate = handled (28) Using Post-Auth-Type Challenge (28) # Executing group from file /etc/raddb/sites-enabled/default.noldap (28) Challenge { ... } # empty sub-section is ignored (28) Sent Access-Challenge Id 141 from 10.2.212.41:1645 to 10.2.212.121:1645 length 0 (28) Service-Type = Framed-User (28) Tunnel-Type = VLAN (28) Tunnel-Medium-Type = IEEE-802 (28) Tunnel-Private-Group-Id = "1620" (28) EAP-Message = 0x010300060d20 (28) Message-Authenticator = 0x00000000000000000000000000000000 (28) State = 0xdce90442ddea0923ee04c7b3a63d3e39 (28) Finished request (59) User-Name = "host/wsk-emewks451a-swfo-san.ssd.goes" (59) Service-Type = Framed-User (59) Cisco-AVPair = "service-type=Framed" (59) Framed-MTU = 1500 (59) Called-Station-Id = "50-57-A8-37-CF-08" (59) Calling-Station-Id = "08-92-04-DA-BB-CE" (59) EAP-Message = 0x0201002a01686f73742f77736b2d656d65776b73343531612d7377666f2d73616e2e7373642e676f6573 (59) Message-Authenticator = 0x201663034ec8fb6c3cee27240d412aa3 (59) Cisco-AVPair = "audit-session-id=0000000000000393B2CBD69D" (59) Cisco-AVPair = "method=dot1x" (59) NAS-IP-Address = 10.2.183.68 (59) NAS-Port-Id = "GigabitEthernet0/8" (59) NAS-Port-Type = Ethernet (59) NAS-Port = 50108 (59) # Executing section authorize from file /etc/raddb/sites-enabled/default.noldap (59) authorize { (59) preprocess: hints: Matched DEFAULT at 87 (59) [preprocess] = ok (59) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (59) auth_log: --> /var/log/radius/radacct/10.2.212.121/auth-detail-20240725 (59) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.2.212.121/auth-detail-20240725 (59) auth_log: EXPAND %t (59) auth_log: --> Thu Jul 25 20:05:30 2024 (59) [auth_log] = ok (59) [chap] = noop (59) [mschap] = noop (59) suffix: Checking for suffix after "@" (59) suffix: No '@' in User-Name = "wsk-emewks451a-swfo-san.ssd.goes", looking up realm NULL (59) suffix: No such realm "NULL" (59) [suffix] = noop (59) if (!EAP-Message) { (59) if (!EAP-Message) -> FALSE (59) else { (59) eap: Peer sent EAP Response (code 2) ID 1 length 42 (59) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (59) [eap] = ok (59) } # else = ok (59) files: users: Matched entry wsk-emewks451a-swfo-san.ssd.goes at line 83414 (59) [files] = ok (59) [expiration] = noop (59) [logintime] = noop Not doing PAP as Auth-Type is already set. (59) [pap] = noop (59) } # authorize = ok (59) Found Auth-Type = eap (59) # Executing group from file /etc/raddb/sites-enabled/default.noldap (59) authenticate { (59) eap: Peer sent packet with method EAP Identity (1) (59) eap: Calling submodule eap_md5 to process data (59) eap_md5: Issuing MD5 Challenge (59) eap: Sending EAP Request (code 1) ID 2 length 22 (59) eap: EAP session adding &reply:State = 0x4df4b28d4df6b6ab (59) [eap] = handled (59) } # authenticate = handled (59) Using Post-Auth-Type Challenge (59) # Executing group from file /etc/raddb/sites-enabled/default.noldap (59) Challenge { ... } # empty sub-section is ignored (59) Sent Access-Challenge Id 142 from 10.2.212.41:1645 to 10.2.212.121:1645 length 0 (59) Service-Type = Framed-User (59) Tunnel-Type = VLAN (59) Tunnel-Medium-Type = IEEE-802 (59) Tunnel-Private-Group-Id = "1620" (59) EAP-Message = 0x0102001604105a03bf3188ae1cb382b11678274d4e0d (59) Message-Authenticator = 0x00000000000000000000000000000000 (59) State = 0x4df4b28d4df6b6ab7f4b542af5a75661 (59) Finished request (60) Received Access-Request Id 143 from 10.2.212.121:1645 to 10.2.212.41:1645 length 289 (60) User-Name = "host/wsk-emewks451a-swfo-san.ssd.goes" (60) Service-Type = Framed-User (60) Cisco-AVPair = "service-type=Framed" (60) Framed-MTU = 1500 (60) Called-Station-Id = "50-57-A8-37-CF-08" (60) Calling-Station-Id = "08-92-04-DA-BB-CE" (60) EAP-Message = 0x02020006030d (60) Message-Authenticator = 0x06853883925b90c1f0fe77538b0b5a14 (60) Cisco-AVPair = "audit-session-id=0000000000000393B2CBD69D" (60) Cisco-AVPair = "method=dot1x" (60) NAS-IP-Address = 10.2.183.68 (60) NAS-Port-Id = "GigabitEthernet0/8" (60) NAS-Port-Type = Ethernet (60) NAS-Port = 50108 (60) State = 0x4df4b28d4df6b6ab7f4b542af5a75661 (60) session-state: No cached attributes (60) # Executing section authorize from file /etc/raddb/sites-enabled/default.noldap (60) authorize { (60) preprocess: hints: Matched DEFAULT at 87 (60) [preprocess] = ok (60) auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (60) auth_log: --> /var/log/radius/radacct/10.2.212.121/auth-detail-20240725 (60) auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.2.212.121/auth-detail-20240725 (60) auth_log: EXPAND %t (60) auth_log: --> Thu Jul 25 20:05:30 2024 (60) [auth_log] = ok (60) [chap] = noop (60) [mschap] = noop (60) suffix: Checking for suffix after "@" (60) suffix: No '@' in User-Name = "wsk-emewks451a-swfo-san.ssd.goes", looking up realm NULL (60) suffix: No such realm "NULL" (60) [suffix] = noop (60) if (!EAP-Message) { (60) if (!EAP-Message) -> FALSE (60) else { (60) eap: Peer sent EAP Response (code 2) ID 2 length 6 (60) eap: No EAP Start, assuming it's an on-going EAP conversation (60) [eap] = updated (60) } # else = updated (60) files: users: Matched entry wsk-emewks451a-swfo-san.ssd.goes at line 83414 (60) [files] = ok (60) [expiration] = noop (60) [logintime] = noop Not doing PAP as Auth-Type is already set. (60) [pap] = noop (60) } # authorize = updated (60) Found Auth-Type = eap (60) # Executing group from file /etc/raddb/sites-enabled/default.noldap (60) authenticate { (60) eap: Expiring EAP session with state 0xdce90442ddea0923 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session with state 0xdce90442ddea0923ee04c7b3a63d3e39 did not finish! !! !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (60) eap: Expiring EAP session with state 0x4df4b28d4df6b6ab (60) eap: Finished EAP session with state 0x4df4b28d4df6b6ab (60) eap: Previous EAP request found for state 0x4df4b28d4df6b6ab, released from the list (60) eap: Peer sent packet with method EAP NAK (3) (60) eap: Found mutually acceptable type TLS (13) (60) eap: Calling submodule eap_tls to process data (60) eap_tls: Initiating new TLS session (60) eap_tls: Setting verify mode to require certificate from client (60) eap_tls: [eaptls start] = request (60) eap: Sending EAP Request (code 1) ID 3 length 6 (60) eap: EAP session adding &reply:State = 0x4df4b28d4cf7bfab (60) [eap] = handled (60) } # authenticate = handled (60) Using Post-Auth-Type Challenge (60) # Executing group from file /etc/raddb/sites-enabled/default.noldap (60) Challenge { ... } # empty sub-section is ignored (60) Sent Access-Challenge Id 143 from 10.2.212.41:1645 to 10.2.212.121:1645 length 0 (60) Service-Type = Framed-User (60) Tunnel-Type = VLAN (60) Tunnel-Medium-Type = IEEE-802 (60) Tunnel-Private-Group-Id = "1620" (60) EAP-Message = 0x010300060d20 (60) Message-Authenticator = 0x00000000000000000000000000000000 (60) State = 0x4df4b28d4cf7bfab7f4b542af5a75661 (60) Finished request ================= Now in this debug below is from a working Win10 workstation with 802.1x/Radius: (60) Received Accounting-Request Id 124 from 10.3.212.121:1646 to 10.3.212.41:1813 length 276 (60) User-Name = "host/rsk-emewks453a-swfo-san.ssd.goes" (60) Cisco-AVPair = "audit-session-id=0000000000000518207A94C4" (60) Cisco-AVPair = "vlan-id=1620" (60) Cisco-AVPair = "method=dot1x" (60) Called-Station-Id = "50-57-A8-88-C1-87" (60) Calling-Station-Id = "08-92-04-DA-BB-BD" (60) NAS-IP-Address = 10.3.183.229 (60) NAS-Port-Id = "GigabitEthernet0/7" (60) NAS-Port-Type = Ethernet (60) NAS-Port = 50107 (60) Acct-Session-Id = "000004CA" (60) Acct-Status-Type = Interim-Update (60) Event-Timestamp = "Jul 30 2024 19:17:40 GMT" (60) Acct-Input-Octets = 1009574 (60) Acct-Output-Octets = 3036209 (60) Acct-Input-Packets = 7042 (60) Acct-Output-Packets = 14554 (60) Acct-Delay-Time = 0 (60) # Executing section preacct from file /etc/raddb/sites-enabled/default (60) preacct { (60) preprocess: hints: Matched DEFAULT at 87 (60) [preprocess] = ok (60) policy acct_unique { (60) update request { (60) &Tmp-String-9 := "ai:" (60) } # update request = noop (60) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (60) EXPAND %{hex:&Class} (60) --> (60) EXPAND ^%{hex:&Tmp-String-9} (60) --> ^61693a (60) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (60) else { (60) update request { (60) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (60) --> 9472f67aac4cf716dab6f08893e32145 (60) &Acct-Unique-Session-Id := 9472f67aac4cf716dab6f08893e32145 (60) } # update request = noop (60) } # else = noop (60) } # policy acct_unique = noop (60) suffix: Checking for suffix after "@" (60) suffix: No '@' in User-Name = "rsk-emewks453a-swfo-san.ssd.goes", looking up realm NULL (60) suffix: No such realm "NULL" (60) [suffix] = noop (60) [files] = noop (60) } # preacct = ok (60) # Executing section accounting from file /etc/raddb/sites-enabled/default (60) accounting { (60) detail: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (60) detail: --> /var/log/radius/radacct/10.3.212.121/detail-20240730 (60) detail: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/10.3.212.121/detail-20240730 (60) detail: EXPAND %t (60) detail: --> Tue Jul 30 19:17:39 2024 (60) [detail] = ok (60) [unix] = noop (60) [exec] = noop (60) attr_filter.accounting_response: EXPAND %{User-Name} (60) attr_filter.accounting_response: --> host/rsk-emewks453a-swfo-san.ssd.goes (60) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (60) [attr_filter.accounting_response] = updated (60) } # accounting = updated (60) Sent Accounting-Response Id 124 from 10.3.212.41:1813 to 10.3.212.121:1646 length 0 (60) Finished request (60) Cleaning up request packet ID 124 with timestamp +93 (61) Received Accounting-Request Id 125 from 10.3.212.121:1646 to 10.3.212.41:1813 length 282 (61) User-Name = "host/rsk-emewks453a-swfo-san.ssd.goes" (61) Cisco-AVPair = "audit-session-id=0000000000000518207A94C4" (61) Cisco-AVPair = "vlan-id=1620" (61) Cisco-AVPair = "method=dot1x" (61) Called-Station-Id = "50-57-A8-88-C1-87" (61) Calling-Station-Id = "08-92-04-DA-BB-BD" (61) NAS-IP-Address = 10.3.183.229 (61) NAS-Port-Id = "GigabitEthernet0/7" (61) NAS-Port-Type = Ethernet (61) NAS-Port = 50107 (61) Acct-Session-Id = "000004CA" (61) Framed-IP-Address = 10.13.143.197 (61) Acct-Status-Type = Interim-Update (61) Event-Timestamp = "Jul 30 2024 19:17:40 GMT" (61) Acct-Input-Octets = 1009574 (61) Acct-Output-Octets = 3036209 (61) Acct-Input-Packets = 7042 (61) Acct-Output-Packets = 14554 (61) Acct-Delay-Time = 0 (61) # Executing section preacct from file /etc/raddb/sites-enabled/default (61) preacct { (61) preprocess: hints: Matched DEFAULT at 87 (61) [preprocess] = ok (61) policy acct_unique { (61) update request { (61) &Tmp-String-9 := "ai:" (61) } # update request = noop (61) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (61) EXPAND %{hex:&Class} (61) --> (61) EXPAND ^%{hex:&Tmp-String-9} (61) --> ^61693a (61) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (61) else { (61) update request { (61) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (61) --> 9472f67aac4cf716dab6f08893e32145 (61) &Acct-Unique-Session-Id := 9472f67aac4cf716dab6f08893e32145 (61) } # update request = noop (61) } # else = noop (61) } # policy acct_unique = noop (61) suffix: Checking for suffix after "@" (61) suffix: No '@' in User-Name = "rsk-emewks453a-swfo-san.ssd.goes", looking up realm NULL (61) suffix: No such realm "NULL" (61) [suffix] = noop (61) [files] = noop (61) } # preacct = ok (61) # Executing section accounting from file /etc/raddb/sites-enabled/default (61) accounting { (61) detail: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (61) detail: --> /var/log/radius/radacct/10.3.212.121/detail-20240730 (61) detail: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/10.3.212.121/detail-20240730 (61) detail: EXPAND %t (61) detail: --> Tue Jul 30 19:17:39 2024 (61) [detail] = ok (61) [unix] = noop (61) [exec] = noop (61) attr_filter.accounting_response: EXPAND %{User-Name} (61) attr_filter.accounting_response: --> host/rsk-emewks453a-swfo-san.ssd.goes (61) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (61) [attr_filter.accounting_response] = updated (61) } # accounting = updated (61) Sent Accounting-Response Id 125 from 10.3.212.41:1813 to 10.3.212.121:1646 length 0 (61) Finished request (61) Cleaning up request packet ID 125 with timestamp +93 Cordially, Elizabeth Merritt Network Planning Engineer V | GGSS/GOES-R EI Network Sustainment Space & airborne systems | L3HARRIS TECHNOLOGIES Primary: m +1.321.408.0911 L3Harris.com<mailto:L3Harris.com> | Elizabeth.Merritt(a)L3Harris.com<mailto:Elizabeth.Merritt@L3Harris.com> 407 N John Rodes Blvd, Office # G136 | Melbourne, FL 32934 | USA [L3Harris_Lockup_TM]<http://www.l3harris.com/> CONFIDENTIALITY NOTICE: This email and any attachments are for the sole use of the intended recipient and may contain material that is proprietary, confidential, privileged or otherwise legally protected or restricted under applicable government laws. Any review, disclosure, distributing or other use without expressed permission of the sender is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies without reading, printing, or saving.

2 1

EAP-TLS, untrusted certificate in client chain
by Rolf Harald Holmvik 16 Aug '24

16 Aug '24

Hello, I'm testing EAP-TLS for WPA3 Enterprise Wi-Fi authentication, and I'm having trouble getting FreeRADIUS to trust the intermediate certificate in the client chain. Hopefully someone on this mailing list can point me in the right direction to get it working. I'd like to eventually set "reject_unknown_intermediate_ca = yes", but can't until I get FreeRADIUS to trust the legitimate intermediate certificate. Running FreeRADIUS in debug mode (freeradius -X), the relevant error messages are these (full debug output at the end of this e-mail): Certificate chain - 1 intermediate CA cert(s) untrusted To forbid these certificates see 'reject_unknown_intermediate_ca' (TLS) untrusted certificate with depth [1] subject name /CN=Intune-Test-CA-Intermediate (TLS) untrusted certificate with depth [0] subject name /CN=bb1dc43c-a3fd-4f52-aa81-75efd0924933 The full certificate chain for the client certificate looks like this: Intune-Test-CA-Root --> Intune-Test-CA-Intermediate --> Client certificate (with CN= bb1dc43c-a3fd-4f52-aa81-75efd0924933) FreeRADIUS is version 3.2.5, running on Ubuntu 24.04. I installed FreeRADIUS using the NetworkRADIUS PPA for Ubuntu 24.04. The FreeRADIUS configuration is very close to the default configuration from the NetworkRADIUS PPA packages. I have only made changes to /etc/freeradius/clients.conf and /etc/freeradius/mods-available/eap, and I have tried to only make the bare minimum of changes needed to get EAP-TLS working. /etc/freeradius/clients.conf: I added my wireless controller as a client (homelab-wlc in the configuration file). /etc/freeradius/mods-available/eap I changed the default EAP method to TLS, replaced the server certificate and key with new ones that I copied into the directory /etc/freeradius/server-certs, commented out ca_file and set ca_path to /etc/freeradius-ca-certs. The /etc/freeradius-ca-certs directory contains Test-CA-Intermediate and Test-CA-Root in PEM format. After placing the certificates in the directory, I rehashed them using the command " c_rehash /etc/freeradius-ca-certs". root@testradius:~# ls -hal /etc/freeradius-ca-certs/ total 16K drwxr-xr-x 2 root root 4.0K Aug 4 20:13 . drwxr-xr-x 113 root root 4.0K Aug 4 20:05 .. lrwxrwxrwx 1 root root 28 Aug 4 20:13 0a42c71a.0 -> Intune-Test-CA-Root.cert.pem lrwxrwxrwx 1 root root 36 Aug 4 20:13 6bf2f1f2.0 -> Intune-Test-CA-Intermediate.cert.pem lrwxrwxrwx 1 root root 28 Aug 4 20:13 9ddf9d2a.0 -> Intune-Test-CA-Root.cert.pem lrwxrwxrwx 1 root root 36 Aug 4 20:13 e1989cca.0 -> Intune-Test-CA-Intermediate.cert.pem -rw-r--r-- 1 root root 2.7K Aug 4 20:12 Intune-Test-CA-Intermediate.cert.pem -rw-r--r-- 1 root root 1.9K Aug 4 20:12 Intune-Test-CA-Root.cert.pem I can validate the client certificate (copied to /bb1dc43c-a3fd-4f52-aa81-75efd0924933.pem) with OpenSSL using /etc/freeradius-ca-certs as the CApath, so the certificates and the rehashing appear to be OK. root@testradius:~# openssl version OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024) root@testradius:~# /usr/bin/openssl verify -CApath /etc/freeradius-ca-certs /bb1dc43c-a3fd-4f52-aa81-75efd0924933.pem /bb1dc43c-a3fd-4f52-aa81-75efd0924933.pem: OK root@testradius:~# /usr/bin/openssl verify -CApath /etc/freeradius-ca-certs -crl_download -crl_check /bb1dc43c-a3fd-4f52-aa81-75efd0924933.pem /bb1dc43c-a3fd-4f52-aa81-75efd0924933.pem: OK While the client chain and certificate that I'm showing here are from Microsoft's Cloud PKI service, I got the exact same results when I manually created a root CA, intermediate CA and client certificate with OpenSSL. Other things I have tried: -- Setting "auto_chain = no" in the tls-common section of /etc/freeradius/mods-available/eap. This made no difference. -- Using ca_file instead of ca_path, with Intune-Test-CA-Root and Intune-Test-CA-Intermediate concatenated into one file. This made no difference. -- Using strace to see if FreeRADIUS read any files from /etc/freeradius-ca-certs. It does appear to read /etc/freeradius-ca-certs/e1989cca.0 (successfully) and then /etc/freeradius-ca-certs/e1989cca.1 (unsuccessfully, as it does not exist), but I can't see that that it ever tries to read the root certificate. Full output from freeradius -X: FreeRADIUS Version 3.2.5 Copyright (C) 1999-2023 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/totp including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/pap including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/rfc7542 including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/control including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 proxy_dedup_window = 1 cleanup_delay = 5 max_requests = 16384 max_fds = 512 postauth_client_lost = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes require_message_authenticator = "auto" limit_proxy_state = "auto" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client homelab-wlc { ipaddr = 172.19.4.1 secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "tls" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 dedup_key = "" } # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no dates_as_integer = no escape_filenames = no log_packet_header = no } # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_totp # Loading module "totp" from file /etc/freeradius/mods-enabled/totp totp { time_step = 30 otp_length = 6 lookback_steps = 1 lookback_interval = 30 lookforward_steps = 0 } # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } instantiate { } # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius-ca-certs" pem_file_type = yes private_key_file = "/etc/freeradius/server-certs/privkey.pem" certificate_file = "/etc/freeradius/server-certs/fullchain.pem" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no reject_unknown_intermediate_ca = no ecdh_curve = "" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/coa # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "totp" from file /etc/freeradius/mods-enabled/totp # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type } # server default server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:366 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 53555 Listening on proxy address :: port 47514 Ready to process requests (0) Received Access-Request Id 23 from 172.19.4.1:19061 to 172.19.4.25:1812 length 365 (0) User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933" (0) NAS-IP-Address = 172.19.4.1 (0) NAS-Identifier = "172.19.10.22/5246-Test-SSID" (0) Called-Station-Id = "94-F3-92-34-F9-10:Test-SSID" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) NAS-Port = 1 (0) Fortinet-SSID = "Test-SSID" (0) Fortinet-AP-Name = "FortiAP-231G" (0) Calling-Station-Id = "04-7B-CB-B2-B0-C8" (0) Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11AX_5G" (0) Acct-Session-Id = "665F7372000010D6" (0) Acct-Multi-Session-Id = "C181680EA09EB2BE" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027076 (0) WLAN-AKM-Suite = 1027077 (0) WLAN-Group-Mgmt-Cipher = 1027078 (0) Framed-MTU = 1400 (0) EAP-Message = 0x02c8002e01686f73742f62623164633433632d613366642d346635322d616138312d373565666430393234393333 (0) Message-Authenticator = 0x9969eefd4b927c5242056739d04bc561 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 200 length 46 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_tls to process data (0) eap_tls: (TLS) TLS -Initiating new session (0) eap_tls: (TLS) TLS - Setting verify mode to require certificate from client (0) eap: Sending EAP Request (code 1) ID 201 length 10 (0) eap: EAP session adding &reply:State = 0x43d8de594311d3a3 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) session-state: Saving cached attributes (0) Framed-MTU = 994 (0) Sent Access-Challenge Id 23 from 172.19.4.25:1812 to 172.19.4.1:19061 length 68 (0) EAP-Message = 0x01c9000a0da000000000 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x43d8de594311d3a3db92dc32dd4b50d3 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 24 from 172.19.4.1:19061 to 172.19.4.25:1812 length 600 (1) User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933" (1) NAS-IP-Address = 172.19.4.1 (1) NAS-Identifier = "172.19.10.22/5246-Test-SSID" (1) Called-Station-Id = "94-F3-92-34-F9-10:Test-SSID" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) NAS-Port = 1 (1) Fortinet-SSID = "Test-SSID" (1) Fortinet-AP-Name = "FortiAP-231G" (1) Calling-Station-Id = "04-7B-CB-B2-B0-C8" (1) Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11AX_5G" (1) Acct-Session-Id = "665F7372000010D6" (1) Acct-Multi-Session-Id = "C181680EA09EB2BE" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027076 (1) WLAN-AKM-Suite = 1027077 (1) WLAN-Group-Mgmt-Cipher = 1027078 (1) Framed-MTU = 1400 (1) EAP-Message = 0x02c901050d80000000fb16030100f6010000f203034a6ce269227e5ea83dd127b627c5f0bfd45bc6dab7367da222739feed32addb92065361a90c8ce5d1f9e391fdbe188c938187614a8a186a275ced632aa7ff37e51002813021301c02cc02bc030c02fc024c023c028c027c00ac009c014c013009d009c003d003c0035002f01000081000500050100000000002b0009080304030303020301000d001a001808040805080604010501020104030503020302020601060300230000000a00080006001d00170018003300260024001d002029e0afd18a1d612267f2d392c07a292be3ce0cd7178b86f11e15a91515bb32380031000000170000ff01000100002d00020101 (1) State = 0x43d8de594311d3a3db92dc32dd4b50d3 (1) Message-Authenticator = 0xff1b0631b0180dd439d9b10c9fafce7d (1) Restoring &session-state (1) &session-state:Framed-MTU = 994 (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 201 length 261 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) authenticate { (1) eap: Removing EAP session with state 0x43d8de594311d3a3 (1) eap: Previous EAP request found for state 0x43d8de594311d3a3, released from the list (1) eap: Peer sent packet with method EAP TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: (TLS) EAP Peer says that the final record size will be 251 bytes (1) eap_tls: (TLS) EAP Got all data (251 bytes) (1) eap_tls: (TLS) TLS - Handshake state - before SSL initialization (1) eap_tls: (TLS) TLS - Handshake state - Server before SSL initialization (1) eap_tls: (TLS) TLS - Handshake state - Server before SSL initialization (1) eap_tls: (TLS) TLS - recv TLS 1.3 Handshake, ClientHello (1) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS read client hello (1) eap_tls: (TLS) TLS - send TLS 1.2 Handshake, ServerHello (1) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS write server hello (1) eap_tls: (TLS) TLS - send TLS 1.2 Handshake, Certificate (1) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS write certificate (1) eap_tls: (TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange (1) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS write key exchange (1) eap_tls: (TLS) TLS - send TLS 1.2 Handshake, CertificateRequest (1) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS write certificate request (1) eap_tls: (TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone (1) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS write server done (1) eap_tls: (TLS) TLS - Server : Need to read more data: SSLv3/TLS write server done (1) eap_tls: (TLS) TLS - In Handshake Phase (1) eap: Sending EAP Request (code 1) ID 202 length 1000 (1) eap: EAP session adding &reply:State = 0x43d8de594212d3a3 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) session-state: Saving cached attributes (1) Framed-MTU = 994 (1) TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (1) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (1) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (1) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (1) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (1) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (1) Sent Access-Challenge Id 24 from 172.19.4.25:1812 to 172.19.4.1:19061 length 1064 (1) EAP-Message = 0x01ca03e80dc0000008f116030300350200003103035e757afad19653a8f0f05469f865189bf8a6068ac8d75e5e9d859f27c3f9bcf400c02c000009ff010001000017000016030307f70b0007f30007f000038f3082038b30820312a003020102021203a84d360770f7c3ffbd7c0e3787a4ccffec300a06082a8648ce3d0403033032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b3009060355040313024536301e170d3234303830343136353132385a170d3234313130323136353132375a3020311e301c06035504031315746573747261646975732e64657261696c2e77696e3059301306072a8648ce3d020106082a8648ce3d03010703420004a11a332bb73ef885a71b4d346bbfa638efa9af3a2acf4fa57b6a61f4d19eb0fa2cb1516214c13443a295568d9883ebbb3a29f71f56b397e674e953626985949ba382021830820214300e0603551d0f0101ff040403020780301d0603551d250416301406082b (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x43d8de594212d3a3db92dc32dd4b50d3 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 25 from 172.19.4.1:19061 to 172.19.4.25:1812 length 343 (2) User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933" (2) NAS-IP-Address = 172.19.4.1 (2) NAS-Identifier = "172.19.10.22/5246-Test-SSID" (2) Called-Station-Id = "94-F3-92-34-F9-10:Test-SSID" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) NAS-Port = 1 (2) Fortinet-SSID = "Test-SSID" (2) Fortinet-AP-Name = "FortiAP-231G" (2) Calling-Station-Id = "04-7B-CB-B2-B0-C8" (2) Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11AX_5G" (2) Acct-Session-Id = "665F7372000010D6" (2) Acct-Multi-Session-Id = "C181680EA09EB2BE" (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027076 (2) WLAN-AKM-Suite = 1027077 (2) WLAN-Group-Mgmt-Cipher = 1027078 (2) Framed-MTU = 1400 (2) EAP-Message = 0x02ca00060d00 (2) State = 0x43d8de594212d3a3db92dc32dd4b50d3 (2) Message-Authenticator = 0x0d980ebddd60d53411a5ef4da589002f (2) Restoring &session-state (2) &session-state:Framed-MTU = 994 (2) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (2) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (2) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (2) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (2) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (2) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (2) # Executing section authorize from file /etc/freeradius/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 202 length 6 (2) eap: No EAP Start, assuming it's an on-going EAP conversation (2) [eap] = updated (2) [files] = noop (2) [expiration] = noop (2) [logintime] = noop (2) [pap] = noop (2) } # authorize = updated (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) authenticate { (2) eap: Removing EAP session with state 0x43d8de594212d3a3 (2) eap: Previous EAP request found for state 0x43d8de594212d3a3, released from the list (2) eap: Peer sent packet with method EAP TLS (13) (2) eap: Calling submodule eap_tls to process data (2) eap_tls: (TLS) Peer ACKed our handshake fragment (2) eap: Sending EAP Request (code 1) ID 203 length 1000 (2) eap: EAP session adding &reply:State = 0x43d8de594113d3a3 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) session-state: Saving cached attributes (2) Framed-MTU = 994 (2) TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (2) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (2) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (2) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (2) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (2) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (2) Sent Access-Challenge Id 25 from 172.19.4.25:1812 to 172.19.4.1:19061 length 1064 (2) EAP-Message = 0x01cb03e80dc0000008f1573082023fa003020102021100b0573e9173972770dbb487cb3a452b38300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3234303331333030303030305a170d3237303331323233353935395a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b30090603550403130245363076301006072a8648ce3d020106052b8104002203620004d9f19e4687f8217160a826eba3fab9eada1db912a7d426d95114b1617c7596bf220b391fd5bed10a46aa2d3c4a09842ebe409555e91940376675ed324e770449f8707bc318e7cef77110feac74d800d4ed6d1c731633109c3ab2ea6c62f4bdb8a381f83081f5300e0603551d0f0101ff040403020186301d0603551d250416301406082b (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x43d8de594113d3a3db92dc32dd4b50d3 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 26 from 172.19.4.1:19061 to 172.19.4.25:1812 length 343 (3) User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933" (3) NAS-IP-Address = 172.19.4.1 (3) NAS-Identifier = "172.19.10.22/5246-Test-SSID" (3) Called-Station-Id = "94-F3-92-34-F9-10:Test-SSID" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) NAS-Port = 1 (3) Fortinet-SSID = "Test-SSID" (3) Fortinet-AP-Name = "FortiAP-231G" (3) Calling-Station-Id = "04-7B-CB-B2-B0-C8" (3) Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11AX_5G" (3) Acct-Session-Id = "665F7372000010D6" (3) Acct-Multi-Session-Id = "C181680EA09EB2BE" (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027076 (3) WLAN-AKM-Suite = 1027077 (3) WLAN-Group-Mgmt-Cipher = 1027078 (3) Framed-MTU = 1400 (3) EAP-Message = 0x02cb00060d00 (3) State = 0x43d8de594113d3a3db92dc32dd4b50d3 (3) Message-Authenticator = 0x8797122c439101ab885ae12fc81b2fb4 (3) Restoring &session-state (3) &session-state:Framed-MTU = 994 (3) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (3) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (3) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (3) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (3) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (3) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (3) # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 203 length 6 (3) eap: No EAP Start, assuming it's an on-going EAP conversation (3) [eap] = updated (3) [files] = noop (3) [expiration] = noop (3) [logintime] = noop (3) [pap] = noop (3) } # authorize = updated (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) authenticate { (3) eap: Removing EAP session with state 0x43d8de594113d3a3 (3) eap: Previous EAP request found for state 0x43d8de594113d3a3, released from the list (3) eap: Peer sent packet with method EAP TLS (13) (3) eap: Calling submodule eap_tls to process data (3) eap_tls: (TLS) Peer ACKed our handshake fragment (3) eap: Sending EAP Request (code 1) ID 204 length 319 (3) eap: EAP session adding &reply:State = 0x43d8de594014d3a3 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) session-state: Saving cached attributes (3) Framed-MTU = 994 (3) TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (3) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (3) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (3) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (3) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (3) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (3) Sent Access-Challenge Id 26 from 172.19.4.25:1812 to 172.19.4.1:19061 length 379 (3) EAP-Message = 0x01cc013f0d80000008f1b17f7d1cfebd5767da3727a0a1d4342f24c0a6bfef4f4d583c4e3abcdb032e02bee1c2fa4ebcc2fdae1672617949127ddfccebbff76e2472d740892ee6fd3e1303b2e7d1dd9b43d3fc4afff387435740928dd47fd97b99337929cac48a2e00f570a88303e21182e3830b17cef5cc98220e3abfd985981bf21f4e16030300740c00007003001d20193ecf5b501aa45af9479f3578cfb718a42b572eb96a91520a050cbd83b44d3c040300483046022100913f8befffa3f0ce6d63180cba2d1a5c84e8e05686a106f84f068777190e0fac022100ed9c9566eabf3b7f44a1accecf67159bb8d49c933d72660b7469f58c9e7aacdd16030300340d000030030102400028040305030603080708080809080a080b080408050806040105010601030303010302040205020602000016030300040e000000 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x43d8de594014d3a3db92dc32dd4b50d3 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 27 from 172.19.4.1:19061 to 172.19.4.25:1812 length 1839 (4) User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933" (4) NAS-IP-Address = 172.19.4.1 (4) NAS-Identifier = "172.19.10.22/5246-Test-SSID" (4) Called-Station-Id = "94-F3-92-34-F9-10:Test-SSID" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) NAS-Port = 1 (4) Fortinet-SSID = "Test-SSID" (4) Fortinet-AP-Name = "FortiAP-231G" (4) Calling-Station-Id = "04-7B-CB-B2-B0-C8" (4) Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11AX_5G" (4) Acct-Session-Id = "665F7372000010D6" (4) Acct-Multi-Session-Id = "C181680EA09EB2BE" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027076 (4) WLAN-AKM-Suite = 1027077 (4) WLAN-Group-Mgmt-Cipher = 1027078 (4) Framed-MTU = 1400 (4) EAP-Message = 0x02cc05d40dc0000010ce16030310960b000f65000f6200078f3082078b30820573a003020102021026db175fb53a5c22c10135ab64383e3b300d06092a864886f70d01010d050030263124302206035504030c1b496e74756e652d546573742d43412d496e7465726d656469617465301e170d3234303830343137313231335a170d3234303930333137323231335a302f312d302b0603550403132462623164633433632d613366642d346635322d616138312d37356566643039323439333330820122300d06092a864886f70d01010105000382010f003082010a0282010100d57e8c2ba8a9e02d748a88b70c39255c5fbe6d3c3e99cb82f5fff6799c7e4b87ff1738b49c1e77149399c002c26d1b82465a1c22ee19d480f72d2123745643314d128b3d05655f8fa1298c42a81f33836888b95404e9e821a6cd24d487e4c27e7f5187a23b5d226235c574eb14d8146620c9b6122de81ec4d30f4d5854b656f982c8de05bc6310760ccf226a452f6101ee0d1204e7fe (4) State = 0x43d8de594014d3a3db92dc32dd4b50d3 (4) Message-Authenticator = 0x516c74e679c9f5d068b520a730504de6 (4) Restoring &session-state (4) &session-state:Framed-MTU = 994 (4) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (4) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (4) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (4) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (4) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (4) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (4) # Executing section authorize from file /etc/freeradius/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 204 length 1492 (4) eap: No EAP Start, assuming it's an on-going EAP conversation (4) [eap] = updated (4) [files] = noop (4) [expiration] = noop (4) [logintime] = noop (4) [pap] = noop (4) } # authorize = updated (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) authenticate { (4) eap: Removing EAP session with state 0x43d8de594014d3a3 (4) eap: Previous EAP request found for state 0x43d8de594014d3a3, released from the list (4) eap: Peer sent packet with method EAP TLS (13) (4) eap: Calling submodule eap_tls to process data (4) eap_tls: (TLS) EAP Peer says that the final record size will be 4302 bytes (4) eap_tls: (TLS) EAP Expecting 3 fragments (4) eap_tls: (TLS) EAP Got first TLS fragment (1482 bytes). Peer says more fragments will follow (4) eap_tls: (TLS) EAP ACKing fragment, the peer should send more data. (4) eap: Sending EAP Request (code 1) ID 205 length 6 (4) eap: EAP session adding &reply:State = 0x43d8de594715d3a3 (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) session-state: Saving cached attributes (4) Framed-MTU = 994 (4) TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (4) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (4) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (4) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (4) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (4) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (4) Sent Access-Challenge Id 27 from 172.19.4.25:1812 to 172.19.4.1:19061 length 64 (4) EAP-Message = 0x01cd00060d00 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x43d8de594715d3a3db92dc32dd4b50d3 (4) Finished request Waking up in 4.7 seconds. (5) Received Access-Request Id 28 from 172.19.4.1:19061 to 172.19.4.25:1812 length 1839 (5) User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933" (5) NAS-IP-Address = 172.19.4.1 (5) NAS-Identifier = "172.19.10.22/5246-Test-SSID" (5) Called-Station-Id = "94-F3-92-34-F9-10:Test-SSID" (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) NAS-Port = 1 (5) Fortinet-SSID = "Test-SSID" (5) Fortinet-AP-Name = "FortiAP-231G" (5) Calling-Station-Id = "04-7B-CB-B2-B0-C8" (5) Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11AX_5G" (5) Acct-Session-Id = "665F7372000010D6" (5) Acct-Multi-Session-Id = "C181680EA09EB2BE" (5) WLAN-Pairwise-Cipher = 1027076 (5) WLAN-Group-Cipher = 1027076 (5) WLAN-AKM-Suite = 1027077 (5) WLAN-Group-Mgmt-Cipher = 1027078 (5) Framed-MTU = 1400 (5) EAP-Message = 0x02cd05d40d4026e5a0d3a7552607c7af8a6964f6f43096c07acf4934f1a4420d3d84f35aa5694c625b5bb9d6f48ed6635f02ca74d09155cb808f35e028aa25fe8a340ba8d96a5214d72babf9adcdc9776f6e1b65d852837f152f2116964ea02994fdc6de6c5b28b89c9b3217eb589df803915201f036e312776592f7d6deccd54320209adf5be41f0dc5738c1f6a9ec8fbcfb39a9e14188bc927ba73e24e54f36ebe7866d20794ebe59402300c8710564d340aaddbbf0aa9951784e5119c5db43163edd63f68cc0820f2bfbecc7765ba0749bde50892465d337f111f142aa90e4a09475c51fdc50ee1516cfca379a17094125bb3e8f7533541443f6dbf855da738b342c08a07644462ea9268c2d1eae2245198b04036ebff8f1bc337f1d37360dba4a9c04906ad668fa55772b18c959ccba7155a4f4ad686025d4053856d3833eac7b9b95f4f2ec9b29a93fb734f85acf23bb6360cf3d9556383a0b7a334461293369029d051c81b017bee6c21f0ba9d4387d7d019676d (5) State = 0x43d8de594715d3a3db92dc32dd4b50d3 (5) Message-Authenticator = 0xa650f7cf121ecc0a8fa9d10a0152467a (5) Restoring &session-state (5) &session-state:Framed-MTU = 994 (5) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (5) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (5) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (5) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (5) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (5) # Executing section authorize from file /etc/freeradius/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 205 length 1492 (5) eap: No EAP Start, assuming it's an on-going EAP conversation (5) [eap] = updated (5) [files] = noop (5) [expiration] = noop (5) [logintime] = noop (5) [pap] = noop (5) } # authorize = updated (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) authenticate { (5) eap: Removing EAP session with state 0x43d8de594715d3a3 (5) eap: Previous EAP request found for state 0x43d8de594715d3a3, released from the list (5) eap: Peer sent packet with method EAP TLS (13) (5) eap: Calling submodule eap_tls to process data (5) eap_tls: (TLS) EAP Got additional fragment (1486 bytes). Peer says more fragments will follow (5) eap_tls: (TLS) EAP ACKing fragment, the peer should send more data. (5) eap: Sending EAP Request (code 1) ID 206 length 6 (5) eap: EAP session adding &reply:State = 0x43d8de594616d3a3 (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) session-state: Saving cached attributes (5) Framed-MTU = 994 (5) TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (5) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (5) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (5) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (5) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (5) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (5) Sent Access-Challenge Id 28 from 172.19.4.25:1812 to 172.19.4.1:19061 length 64 (5) EAP-Message = 0x01ce00060d00 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x43d8de594616d3a3db92dc32dd4b50d3 (5) Finished request Waking up in 4.7 seconds. (6) Received Access-Request Id 29 from 172.19.4.1:19061 to 172.19.4.25:1812 length 1687 (6) User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933" (6) NAS-IP-Address = 172.19.4.1 (6) NAS-Identifier = "172.19.10.22/5246-Test-SSID" (6) Called-Station-Id = "94-F3-92-34-F9-10:Test-SSID" (6) NAS-Port-Type = Wireless-802.11 (6) Service-Type = Framed-User (6) NAS-Port = 1 (6) Fortinet-SSID = "Test-SSID" (6) Fortinet-AP-Name = "FortiAP-231G" (6) Calling-Station-Id = "04-7B-CB-B2-B0-C8" (6) Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11AX_5G" (6) Acct-Session-Id = "665F7372000010D6" (6) Acct-Multi-Session-Id = "C181680EA09EB2BE" (6) WLAN-Pairwise-Cipher = 1027076 (6) WLAN-Group-Cipher = 1027076 (6) WLAN-AKM-Suite = 1027077 (6) WLAN-Group-Mgmt-Cipher = 1027078 (6) Framed-MTU = 1400 (6) EAP-Message = 0x02ce053c0d0074703a2f2f31373030353833333335396634303230383030313965663937323934623463332e776573746575726f70652e706b692e617a7572652e6e65742f6365727469666963617465417574686f7269746965732f30623332613064302d376136362d343331632d386535332d6233643061623166646332305f76312f63757272656e742e63726c3082013506082b06010505070101048201273082012330819206082b06010505073002868185687474703a2f2f7072696d6172792d63646e2e706b692e617a7572652e6e65742f776573746575726f70652f636163657274732f31373030353833333335396634303230383030313965663937323934623463332f30623332613064302d376136362d343331632d386535332d6233643061623166646332305f76312f636572742e63657230818b06082b06010505073002867f687474703a2f2f31373030353833333335396634303230383030313965663937323934623463332e776573746575 (6) State = 0x43d8de594616d3a3db92dc32dd4b50d3 (6) Message-Authenticator = 0x64ed72ddf554c44cf76c28adf74abb11 (6) Restoring &session-state (6) &session-state:Framed-MTU = 994 (6) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (6) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (6) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (6) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (6) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (6) # Executing section authorize from file /etc/freeradius/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 206 length 1340 (6) eap: No EAP Start, assuming it's an on-going EAP conversation (6) [eap] = updated (6) [files] = noop (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = noop (6) } # authorize = updated (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/sites-enabled/default (6) authenticate { (6) eap: Removing EAP session with state 0x43d8de594616d3a3 (6) eap: Previous EAP request found for state 0x43d8de594616d3a3, released from the list (6) eap: Peer sent packet with method EAP TLS (13) (6) eap: Calling submodule eap_tls to process data (6) eap_tls: (TLS) EAP Got final fragment (1334 bytes) (6) eap_tls: (TLS) EAP Done initial handshake (6) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS write server done (6) eap_tls: (TLS) TLS - recv TLS 1.2 Handshake, Certificate (6) eap_tls: (TLS) TLS - Creating attributes from 2 certificate in chain (6) eap_tls: TLS-Cert-Serial := "0ac7e70ba67739917f8c5677ba2c77ad" (6) eap_tls: TLS-Cert-Expiration := "320804170841Z" (6) eap_tls: TLS-Cert-Valid-Since := "240804170841Z" (6) eap_tls: TLS-Cert-Subject := "/CN=Intune-Test-CA-Intermediate" (6) eap_tls: TLS-Cert-Issuer := "/CN=Intune-Test-CA-Root" (6) eap_tls: TLS-Cert-Common-Name := "Intune-Test-CA-Intermediate" (6) eap_tls: (TLS) TLS - Creating attributes from 1 certificate in chain (6) eap_tls: TLS-Client-Cert-Serial := "26db175fb53a5c22c10135ab64383e3b" (6) eap_tls: TLS-Client-Cert-Expiration := "240903172213Z" (6) eap_tls: TLS-Client-Cert-Valid-Since := "240804171213Z" (6) eap_tls: TLS-Client-Cert-Subject := "/CN=bb1dc43c-a3fd-4f52-aa81-75efd0924933" (6) eap_tls: TLS-Client-Cert-Issuer := "/CN=Intune-Test-CA-Intermediate" (6) eap_tls: TLS-Client-Cert-Common-Name := "bb1dc43c-a3fd-4f52-aa81-75efd0924933" (6) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Dns := "bb1dc43c-a3fd-4f52-aa81-75efd0924933" (6) eap_tls: TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" (6) eap_tls: TLS-Client-Cert-X509v3-Subject-Key-Identifier += "A7:63:31:72:8C:59:13:19:6D:3D:18:49:E4:B8:CA:B7:FD:CA:53:10" (6) eap_tls: TLS-Client-Cert-X509v3-Authority-Key-Identifier += "41:66:F7:B6:51:B4:0B:2A:6B:2B:E9:34:50:25:28:B8:99:7A:BB:B7" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" Certificate chain - 1 intermediate CA cert(s) untrusted To forbid these certificates see 'reject_unknown_intermediate_ca' (TLS) untrusted certificate with depth [1] subject name /CN=Intune-Test-CA-Intermediate (TLS) untrusted certificate with depth [0] subject name /CN=bb1dc43c-a3fd-4f52-aa81-75efd0924933 (6) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS read client certificate (6) eap_tls: (TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange (6) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS read client key exchange (6) eap_tls: (TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify (6) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS read certificate verify (6) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS read change cipher spec (6) eap_tls: (TLS) TLS - recv TLS 1.2 Handshake, Finished (6) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS read finished (6) eap_tls: (TLS) TLS - send TLS 1.2 ChangeCipherSpec (6) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS write change cipher spec (6) eap_tls: (TLS) TLS - send TLS 1.2 Handshake, Finished (6) eap_tls: (TLS) TLS - Handshake state - Server SSLv3/TLS write finished (6) eap_tls: (TLS) TLS - Handshake state - SSL negotiation finished successfully (6) eap_tls: (TLS) TLS - Connection Established (6) eap_tls: TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES256-GCM-SHA384" (6) eap_tls: TLS-Session-Version = "TLS 1.2" (6) eap: Sending EAP Request (code 1) ID 207 length 61 (6) eap: EAP session adding &reply:State = 0x43d8de594517d3a3 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/freeradius/sites-enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) session-state: Saving cached attributes (6) Framed-MTU = 994 (6) TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (6) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (6) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (6) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (6) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (6) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (6) TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Certificate" (6) TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange" (6) TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify" (6) TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Finished" (6) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 ChangeCipherSpec" (6) TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Finished" (6) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES256-GCM-SHA384" (6) TLS-Session-Version = "TLS 1.2" (6) Sent Access-Challenge Id 29 from 172.19.4.25:1812 to 172.19.4.1:19061 length 119 (6) EAP-Message = 0x01cf003d0d8000000033140303000101160303002885c19373a7e99ca92f9bddb73d0b4684f17f8603b8b0e38bd94697d77aaa3ff3f13cf6fe0b38fe5f (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x43d8de594517d3a3db92dc32dd4b50d3 (6) Finished request Waking up in 4.6 seconds. (7) Received Access-Request Id 30 from 172.19.4.1:19061 to 172.19.4.25:1812 length 343 (7) User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933" (7) NAS-IP-Address = 172.19.4.1 (7) NAS-Identifier = "172.19.10.22/5246-Test-SSID" (7) Called-Station-Id = "94-F3-92-34-F9-10:Test-SSID" (7) NAS-Port-Type = Wireless-802.11 (7) Service-Type = Framed-User (7) NAS-Port = 1 (7) Fortinet-SSID = "Test-SSID" (7) Fortinet-AP-Name = "FortiAP-231G" (7) Calling-Station-Id = "04-7B-CB-B2-B0-C8" (7) Connect-Info = "CONNECT 0/0Mbps(Tx/Rx) 11AX_5G" (7) Acct-Session-Id = "665F7372000010D6" (7) Acct-Multi-Session-Id = "C181680EA09EB2BE" (7) WLAN-Pairwise-Cipher = 1027076 (7) WLAN-Group-Cipher = 1027076 (7) WLAN-AKM-Suite = 1027077 (7) WLAN-Group-Mgmt-Cipher = 1027078 (7) Framed-MTU = 1400 (7) EAP-Message = 0x02cf00060d00 (7) State = 0x43d8de594517d3a3db92dc32dd4b50d3 (7) Message-Authenticator = 0x2b8832a36bf6a661eb3edf2012a9cd61 (7) Restoring &session-state (7) &session-state:Framed-MTU = 994 (7) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (7) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (7) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (7) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (7) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (7) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Certificate" (7) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify" (7) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 ChangeCipherSpec" (7) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES256-GCM-SHA384" (7) &session-state:TLS-Session-Version = "TLS 1.2" (7) # Executing section authorize from file /etc/freeradius/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) eap: Peer sent EAP Response (code 2) ID 207 length 6 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [files] = noop (7) [expiration] = noop (7) [logintime] = noop (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/sites-enabled/default (7) authenticate { (7) eap: Removing EAP session with state 0x43d8de594517d3a3 (7) eap: Previous EAP request found for state 0x43d8de594517d3a3, released from the list (7) eap: Peer sent packet with method EAP TLS (13) (7) eap: Calling submodule eap_tls to process data (7) eap_tls: (TLS) Peer ACKed our handshake fragment. handshake is finished (7) eap: Sending EAP Success (code 3) ID 207 length 4 (7) eap: Freeing handler (7) [eap] = ok (7) } # authenticate = ok (7) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (7) post-auth { (7) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (7) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (7) update { (7) &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 994 (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, ClientHello' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerHello' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, Certificate' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, Certificate' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, Finished' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 ChangeCipherSpec' (7) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, Finished' (7) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-ECDSA-AES256-GCM-SHA384' (7) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2' (7) } # update = noop (7) [exec] = noop (7) policy remove_reply_message_if_eap { (7) if (&reply:EAP-Message && &reply:Reply-Message) { (7) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (7) else { (7) [noop] = noop (7) } # else = noop (7) } # policy remove_reply_message_if_eap = noop (7) if (EAP-Key-Name && &reply:EAP-Session-Id) { (7) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (7) } # post-auth = noop (7) Sent Access-Accept Id 30 from 172.19.4.25:1812 to 172.19.4.1:19061 length 209 (7) MS-MPPE-Recv-Key = 0xc7c98aade897c8b8b9681688ddc2c07717439319dad715860c7577e87ba237f0 (7) MS-MPPE-Send-Key = 0x254025f480756bf49a6a01a8b3215185c324ea0da22cda202551d11ea40bdc6d (7) EAP-Message = 0x03cf0004 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) User-Name = "host/bb1dc43c-a3fd-4f52-aa81-75efd0924933" (7) Framed-MTU += 994 (7) Finished request Waking up in 4.6 seconds. (0) Cleaning up request packet ID 23 with timestamp +6 due to cleanup_delay was reached (1) Cleaning up request packet ID 24 with timestamp +6 due to cleanup_delay was reached (2) Cleaning up request packet ID 25 with timestamp +6 due to cleanup_delay was reached (3) Cleaning up request packet ID 26 with timestamp +6 due to cleanup_delay was reached Waking up in 0.2 seconds. (4) Cleaning up request packet ID 27 with timestamp +6 due to cleanup_delay was reached (5) Cleaning up request packet ID 28 with timestamp +6 due to cleanup_delay was reached (6) Cleaning up request packet ID 29 with timestamp +6 due to cleanup_delay was reached (7) Cleaning up request packet ID 30 with timestamp +6 due to cleanup_delay was reached Ready to process requests Regards, Rolf Harald Holmvik

2 1

Using rest with sending post request
by Çağlar Karahan 12 Aug '24

12 Aug '24

Dear all, I want to use the rest module to send post authentication to the server. Related config files are shown below. *default: * authorize { if ("%{Service-Type}" == "Login") { if (&Message-Authenticator) { rest } } } *rest:* rest { connect_uri = "https://127.0.0.1:4433/" tls { client_cert = /path/to/client/cert.pem client_key = /path/to/client/key.key disable_verify_peer = yes check_cert = no check_cert_cn = no } authorize { uri = "${..connect_uri}api/v1/login" method = 'post' body = 'json' tls = ${..tls} data = '{"user": {"name":"%{User-Name}", "passwd": "%{User-Password}"}, "attributes": {"messageAuthenticator": "%{Message-Authenticator}", "clientIP":"%{Packet-Src-IP-Address}"}}' header = 'Content-Type: application/json' connect_timeout = 30 recv_timeout = 30 } } To test it I am using radclient with below command: echo "Service-Type=1, User-Name=caglar,User-Password=caglar, Message-Authenticator=0x00" | ./radclient -s -x -P udp a.b.c.d:1812 auth shared_secret When running freeradius in debug mode, I am seeing that below error: *(0) rest: ERROR: Request failed: 56 - Failure when receiving data from the peer(0) rest: ERROR: Server returned no data* I am also testing server with curl command. And it works properly. curl -v -k -H 'Content-Type: application/json' -d '{ "user": { "passwd":"caglar", "name":"caglar"}, "attributes": { "messageAuthenticator":"0x00", "clientIp": "a.b.c.d"}}' -X POST https://127.0.0.1:4433/api/v1/login --cert /path/to/client/cert.pem --key /path/to/client/key.key Thanks for your support, Caglar

1 0

Re: xfs filesystem being remounted
by Alan DeKok 09 Aug '24

09 Aug '24

Please do not CC me on messages to the list. In case you hadn't noticed, I subscribe to the list. It doesn't help to get duplicate messages. > On Aug 9, 2024, at 12:46 AM, (null) (null) <kckong1(a)yahoo.com> wrote: > > This issue may not be related to the FreeRADIUS service but rather to the operating system (RHEL 7.9). > > I would appreciate any advice or clues regarding why, after restarting FreeRADIUS, messages below the XFS filesystem being remounted appear in dmesg. These messages are being produced by the OS, and have nothing to do with FreeRADIUS. There's probably a local service script to restart FreeRAIDUS. That script does a number of things when it runs, including file system things. If the message doesn't appear in the FreeRADIUS log, then it wasn't created by FreeRADIUS, and it has nothing to do with FreeRADIUS. Alan DeKok.

1 0

We have released version 3.0.0 of the pam_radius module
by Alan DeKok 09 Aug '24

09 Aug '24

This release has a number of fixes, including mitigations for the BlastRADIUS attack. > Begin forwarded message: > > From: Matthew Newton <notifications(a)github.com> > Subject: [FreeRADIUS/pam_radius] Release release_3_0_0 - 3.0.0 > Date: August 9, 2024 at 5:37:04 AM EDT > To: FreeRADIUS/pam_radius <pam_radius(a)noreply.github.com> > Cc: Subscribed <subscribed(a)noreply.github.com> > Reply-To: FreeRADIUS/pam_radius <noreply(a)github.com> > > > 3.0.0 <https://github.com/FreeRADIUS/pam_radius/releases/tag/release_3_0_0> > Repository: FreeRADIUS/pam_radius <https://github.com/FreeRADIUS/pam_radius> · Tag: release_3_0_0 <https://github.com/FreeRADIUS/pam_radius/tree/release_3_0_0> · Commit: b6442c3 <https://github.com/FreeRADIUS/pam_radius/commit/b6442c3e0147f1019990520483f…> · Released by: mcnewton <https://github.com/mcnewton> > Feature improvements > > RPM and DEB packages can be built from the source. Just do "make rpm" or "make deb". > Add continuous integration (CI) tests > Configuration is now in /etc/pam_radius_auth.conf > BlastRADIUS attack mitigations (add Message-Authenticator to Access-Request packets, new require_message_authenticator config flag) > Bug fixes > > All known and reported bugs have been fixed. > Ignore packets from unknown sources. Based on patches from Alex Malowany. > Remove obsolete functionality (Old-Password support, workarounds for Livingston RADIUS server, password change support, etc) > — > This release has 6 assets: > > pam_radius-3.0.0.tar.bz2 > pam_radius-3.0.0.tar.bz2.sig > pam_radius-3.0.0.tar.gz > pam_radius-3.0.0.tar.gz.sig > Source code (zip) > Source code (tar.gz) > Visit the release page <https://github.com/FreeRADIUS/pam_radius/releases/tag/release_3_0_0> to download them. > > — > You are receiving this because you are watching this repository. > View it on GitHub <https://github.com/FreeRADIUS/pam_radius/releases/tag/release_3_0_0> or unsubscribe <https://github.com/FreeRADIUS/pam_radius/unsubscribe_via_email/AAAEJTE3WYHD…> from all notifications for this repository. >

1 0

rlm_rest: Parsing the response attributes
by Michael Schwartzkopff 24 Jul '24

24 Jul '24

Hi, My REST API service returns something like: { "count": 1, "next": null, "previous": null, "results": [ ... ] } The rest module of FR tells me: rest: Failed parsing attribute: Invalid vendor name in attribute name "count", skipping Is there any possibility to map the return attributes from my REST service to FR attributes? Michael Schwartzkopff

2 2