- Freeradius-Users - lists.freeradius.org

Line indentation using tabs?
by Dagan McGregor 19 Apr '17

19 Apr '17

Hi, The comments in the 'users' file mentions lines should be indented with a tab when providing options below a user name. Do all the files require configuration lines to use tabs? Or is does it only matter for user entries? Are lines ignored if they are not indented with a tab? I notice most of the configuration files use hard tabs but I am not sure if this is convenient or enforced. Our coding setup uses spaces to replace tabs, so I need to make sure my deployed files are formatting correctly. Cheers, Dagan McGregor

3 2

What attribute to use to send custom info.
by Kenroy 19 Apr '17

19 Apr '17

Hi everyone, What attribute can i use to put custom information (e.g such as a token string generated by an application) when I sent an Access-Accept and have that attribute and value be returned in the accounting packets. Kenroy

2 2

multiple instances of pam module
by Lars Hillebrand 18 Apr '17

18 Apr '17

Hello everybody, Is there a way to include multiple instances of the pam module in the radius? We are currently using a freeradius 2.2.8 with several virtual servers. Two services are to be secured by a 2-factor authentication (Google Authenticator). 1. Login VMware HorizonView (desktop-virtualization) 2. IPsec VPN connection VMware Horizon expects a login with username and passcode with a subsequent query of the password. For the login of the VPN connection the password + passcode is expected together in a field. Attempts to integrate several instances (similar to the file or ldap module) within the pam module do not work. I am thankful for every hint. Thanks in advance. Best regards Lars Hillebrand - Content of /etc/freeradius/modules/pam pam { pam_auth = radiusd } pam 2facaut_pam { pam_auth = 2facaut_pam } pam horizon_pam { pam_auth = horizon_pam } - Contents of the individual pam files from /etc/pam.d/ # /etc/pam.d/horizon_pam - PAM configuration for FreeRADIUS auth requisite pam_google_authenticator.so forward_pass try_first_pass auth [success=2 default=ignore] pam_unix.so nullok_secure auth [success=1 default=ignore] pam_ldap.so use_first_pass # /etc/pam.d/2facaut_pam - PAM configuration for FreeRADIUS auth required pam_google_authenticator.so forward_pass auth required pam_ldap.so use_first_pass - Here the debug log with separate horizon_pam configuration in the radius Tue Apr 18 12:08:41 2017 : Debug: server horizon { Tue Apr 18 12:08:41 2017 : Debug: # Executing section authorize from file /etc/freeradius/sites-enabled/horizon Tue Apr 18 12:08:41 2017 : Debug: +group authorize { Tue Apr 18 12:08:41 2017 : Debug: ++policy filter_username { Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ / /) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ / /) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ / /) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@.*@/ ) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /@.*@/) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /@.*@/ ) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.\\./ ) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /\\.\\./) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.\\./ ) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.$/) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /\\.$/) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /\\.$/) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /(a)\\./) Tue Apr 18 12:08:41 2017 : Debug: ? Evaluating (User-Name =~ /(a)\\./) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: +++? if (User-Name =~ /(a)\\./) -> FALSE Tue Apr 18 12:08:41 2017 : Debug: ++} # policy filter_username = notfound Tue Apr 18 12:08:41 2017 : Debug: ++[preprocess] = ok Tue Apr 18 12:08:41 2017 : Debug: [horizon_log] expand: /var/log/freeradius/radacct/horizon-auth-detail-%Y%m%d -> /var/log/freeradius/radacct/horizon-auth-detail-20170418 Tue Apr 18 12:08:41 2017 : Debug: [horizon_log] /var/log/freeradius/radacct/horizon-auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/horizon-auth-detail-20170418 Tue Apr 18 12:08:41 2017 : Debug: [horizon_log] expand: %t -> Tue Apr 18 12:08:41 2017 Tue Apr 18 12:08:41 2017 : Debug: ++[horizon_log] = ok Tue Apr 18 12:08:41 2017 : Debug: ++[chap] = noop Tue Apr 18 12:08:41 2017 : Debug: ++[mschap] = noop Tue Apr 18 12:08:41 2017 : Debug: [suffix] No '@' in User-Name = "lahil001", looking up realm NULL Tue Apr 18 12:08:41 2017 : Debug: [suffix] Found realm "NULL" Tue Apr 18 12:08:41 2017 : Debug: [suffix] Adding Stripped-User-Name = "lahil001" Tue Apr 18 12:08:41 2017 : Debug: [suffix] Adding Realm = "NULL" Tue Apr 18 12:08:41 2017 : Debug: [suffix] Authentication realm is LOCAL. Tue Apr 18 12:08:41 2017 : Debug: ++[suffix] = ok Tue Apr 18 12:08:41 2017 : Debug: [eap] No EAP-Message, not doing EAP Tue Apr 18 12:08:41 2017 : Debug: ++[eap] = noop Tue Apr 18 12:08:41 2017 : Debug: [horizon_files] users: Matched entry DEFAULT at line 190 Tue Apr 18 12:08:41 2017 : Debug: ++[horizon_files] = ok Tue Apr 18 12:08:41 2017 : Debug: ++[expiration] = noop Tue Apr 18 12:08:41 2017 : Debug: ++[logintime] = noop Tue Apr 18 12:08:41 2017 : Debug: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Apr 18 12:08:41 2017 : Debug: ++[pap] = noop Tue Apr 18 12:08:41 2017 : Debug: +} # group authorize = ok Tue Apr 18 12:08:41 2017 : Debug: Found Auth-Type = PAM Tue Apr 18 12:08:41 2017 : Debug: WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Tue Apr 18 12:08:41 2017 : Debug: # Executing group from file /etc/freeradius/sites-enabled/horizon Tue Apr 18 12:08:41 2017 : Debug: Failed to authenticate the user. Tue Apr 18 12:08:41 2017 : Debug: } # server horizon __ Fachhochschule Dortmund University of Applied Sciences and Arts Dipl.-Ing. (FH) Lars Hillebrand Dez. VI, IT-Basisdienste Sonnenstraße 100 - 44139 Dortmund Raum SON D 008 Tel 0231 9112-253 Fax 0231 9112-338 lars.hillebrand(a)fh-dortmund.de <mailto:lars.hillebrand@fh-dortmund.de> www.fh-dortmund.de <http://www.fh-dortmund.de/>

2 6

Problem with log and PEAP/MS-CHAPv2
by Andrea Gabellini 18 Apr '17

18 Apr '17

Hi, I'm trying to setup a PEAP-MS-CHAPv2 tunnel with FR 3.0.13. It works fine but I have a little problem with the log. When a user logs in correctly I have the usual Login OK. But if the user uses a wrong password or if the username doesn't exist, I don't have any logs of it. Testing the inner tunnel with radtest logs correctly. The configuration of the server and the inner tunnel. Users are on "files" module: server wifi_tim { authorize { filter_username auth_log chap mschap eap { ok = return } wifi_tim_files pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap eap } preacct { } accounting { } session { } post-auth { update { &reply: += &session-state: } reply_log remove_reply_message_if_eap Post-Auth-Type REJECT { attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { } } server wifi_tim_inner_tunnel { listen { ipaddr = 127.0.0.1 port = 11812 type = auth } authorize { filter_username chap mschap eap { ok = return } wifi_tim_files pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap eap } session { } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { } } eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} tls-config tls-common { private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh ca_path = ${cadir} cipher_list = "ALL:!LOW:!SSLv2:!EXP:!aNULL" cipher_server_preference = yes ecdh_curve = "prime256v1" cache { enable = no max_entries = 255 } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "wifi_tim_inner_tunnel" } mschapv2 { send_error = yes identity = "Tism Access Server" } } Logs with radtest: Apr 12 10:47:25 radius31 radiusd[28822]: (1) Login OK: [testuser] (from client localhost port 0) Apr 12 10:47:35 radius31 radiusd[28822]: (2) Login incorrect (mschap: MS-CHAP2-Response is incorrect): [testuser] (from client localhost port 0) Apr 12 10:47:35 radius31 radiusd[28822]: (2) Rejected in post-auth: [testuser] (from client localhost port 0) Apr 12 10:55:02 radius31 radiusd[28822]: (16) Login incorrect (mschap: FAILED: No NT/LM-Password. Cannot perform authentication): [testuserx] (from client localhost port 0) Apr 12 10:55:02 radius31 radiusd[28822]: (16) Rejected in post-auth: [testuserx] (from client localhost port 0) Debug with EAP and wrong password: (162) Wed Apr 12 11:30:39 2017: Debug: Received Access-Request Id 7 from 194.183.95.46:55808 to 194.183.95.46:1812 length 276 (162) Wed Apr 12 11:30:39 2017: Debug: User-Name = "testuser" (162) Wed Apr 12 11:30:39 2017: Debug: Calling-Station-Id = "E8-3A-12-EF-30-CE" (162) Wed Apr 12 11:30:39 2017: Debug: Framed-MTU = 1400 (162) Wed Apr 12 11:30:39 2017: Debug: NAS-Port-Type = Wireless-802.11 (162) Wed Apr 12 11:30:39 2017: Debug: Connect-Info = "rad_eap_test + eapol_test" (162) Wed Apr 12 11:30:39 2017: Debug: NAS-IP-Address = 172.16.0.4 (162) Wed Apr 12 11:30:39 2017: Debug: EAP-Message = 0x02070090190017030100207ca8e68f9cc0712a093735da2c9a7a8f8880c35df3bb05407fc2ca022b33575d1703010060960e2f55b1a94c96a4197759099aaafdcabbaa6c6c0583b1c26e354da196fc30abcab796cdf83f4bc110a14559904b992bdfff46e30d60b9d6548342b5ea2fa87d4fbd3392353b (162) Wed Apr 12 11:30:39 2017: Debug: State = 0xe50e637de3097a45c917c73821ab3033 (162) Wed Apr 12 11:30:39 2017: Debug: Message-Authenticator = 0x79e6229a110fd499293f527c2f93be25 (162) Wed Apr 12 11:30:39 2017: Debug: session-state: No cached attributes (162) Wed Apr 12 11:30:39 2017: Debug: # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim (162) Wed Apr 12 11:30:39 2017: Debug: authorize { (162) Wed Apr 12 11:30:39 2017: Debug: policy filter_username { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) -> TRUE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ / /) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ / /) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /@[^@]*@/ ) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /@[^@]*@/ ) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.\./ ) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.\./ ) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (162) Wed Apr 12 11:30:39 2017: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.$/) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.$/) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /(a)\./) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /(a)\./) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: } # if (&User-Name) = notfound (162) Wed Apr 12 11:30:39 2017: Debug: } # policy filter_username = notfound (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: --> /var/log/radius/radacct/194.183.95.46/auth-detail-20170412 (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/194.183.95.46/auth-detail-20170412 (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: EXPAND %t (162) Wed Apr 12 11:30:39 2017: Debug: auth_log: --> Wed Apr 12 11:30:39 2017 (162) Wed Apr 12 11:30:39 2017: Debug: [auth_log] = ok (162) Wed Apr 12 11:30:39 2017: Debug: [chap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: [mschap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: eap: Peer sent EAP Response (code 2) ID 7 length 144 (162) Wed Apr 12 11:30:39 2017: Debug: eap: Continuing tunnel setup (162) Wed Apr 12 11:30:39 2017: Debug: [eap] = ok (162) Wed Apr 12 11:30:39 2017: Debug: } # authorize = ok (162) Wed Apr 12 11:30:39 2017: Debug: Found Auth-Type = eap (162) Wed Apr 12 11:30:39 2017: Debug: # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim (162) Wed Apr 12 11:30:39 2017: Debug: authenticate { (162) Wed Apr 12 11:30:39 2017: Debug: eap: Expiring EAP session with state 0xcb16895fcb11935b (162) Wed Apr 12 11:30:39 2017: Debug: eap: Finished EAP session with state 0xe50e637de3097a45 (162) Wed Apr 12 11:30:39 2017: Debug: eap: Previous EAP request found for state 0xe50e637de3097a45, released from the list (162) Wed Apr 12 11:30:39 2017: Debug: eap: Peer sent packet with method EAP PEAP (25) (162) Wed Apr 12 11:30:39 2017: Debug: eap: Calling submodule eap_peap to process data (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Continuing EAP-TLS (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: [eaptls verify] = ok (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Done initial handshake (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: [eaptls process] = ok (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Session established. Decoding tunneled attributes (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: PEAP state phase2 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: EAP method MSCHAPv2 (26) (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Got tunneled request (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: EAP-Message = 0x020700431a0207003e31b91e9f531a076d578b11807fa0c5e5570000000000000000c26b0fb3fc605a0e49b6dfc821e07a674b6f65c9e16dd07b007465737475736572 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Setting User-Name to testuser (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Sending tunneled request to wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: EAP-Message = 0x020700431a0207003e31b91e9f531a076d578b11807fa0c5e5570000000000000000c26b0fb3fc605a0e49b6dfc821e07a674b6f65c9e16dd07b007465737475736572 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: User-Name = "testuser" (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: State = 0xcb16895fcb11935b1be4d67ff3649f78 (162) Wed Apr 12 11:30:39 2017: Debug: Virtual server wifi_tim_inner_tunnel received request (162) Wed Apr 12 11:30:39 2017: Debug: EAP-Message = 0x020700431a0207003e31b91e9f531a076d578b11807fa0c5e5570000000000000000c26b0fb3fc605a0e49b6dfc821e07a674b6f65c9e16dd07b007465737475736572 (162) Wed Apr 12 11:30:39 2017: Debug: FreeRADIUS-Proxied-To = 127.0.0.1 (162) Wed Apr 12 11:30:39 2017: Debug: User-Name = "testuser" (162) Wed Apr 12 11:30:39 2017: Debug: State = 0xcb16895fcb11935b1be4d67ff3649f78 (162) Wed Apr 12 11:30:39 2017: WARNING: Outer and inner identities are the same. User privacy is compromised. (162) Wed Apr 12 11:30:39 2017: Debug: server wifi_tim_inner_tunnel { (162) Wed Apr 12 11:30:39 2017: Debug: session-state: No cached attributes (162) Wed Apr 12 11:30:39 2017: Debug: # Executing section authorize from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: authorize { (162) Wed Apr 12 11:30:39 2017: Debug: policy filter_username { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) -> TRUE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ / /) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ / /) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /@[^@]*@/ ) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /@[^@]*@/ ) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.\./ ) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.\./ ) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (162) Wed Apr 12 11:30:39 2017: Debug: if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.$/) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /\.$/) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /(a)\./) { (162) Wed Apr 12 11:30:39 2017: Debug: if (&User-Name =~ /(a)\./) -> FALSE (162) Wed Apr 12 11:30:39 2017: Debug: } # if (&User-Name) = notfound (162) Wed Apr 12 11:30:39 2017: Debug: } # policy filter_username = notfound (162) Wed Apr 12 11:30:39 2017: Debug: [chap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: [mschap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: eap: Peer sent EAP Response (code 2) ID 7 length 67 (162) Wed Apr 12 11:30:39 2017: Debug: eap: No EAP Start, assuming it's an on-going EAP conversation (162) Wed Apr 12 11:30:39 2017: Debug: [eap] = updated (162) Wed Apr 12 11:30:39 2017: Debug: wifi_tim_files: users: Matched entry testuser at line 13 (162) Wed Apr 12 11:30:39 2017: Debug: [wifi_tim_files] = ok (162) Wed Apr 12 11:30:39 2017: WARNING: pap: Auth-Type already set. Not setting to PAP (162) Wed Apr 12 11:30:39 2017: Debug: [pap] = noop (162) Wed Apr 12 11:30:39 2017: Debug: } # authorize = updated (162) Wed Apr 12 11:30:39 2017: Debug: Found Auth-Type = eap (162) Wed Apr 12 11:30:39 2017: Debug: # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: authenticate { (162) Wed Apr 12 11:30:39 2017: Debug: eap: Expiring EAP session with state 0xcb16895fcb11935b (162) Wed Apr 12 11:30:39 2017: Debug: eap: Finished EAP session with state 0xcb16895fcb11935b (162) Wed Apr 12 11:30:39 2017: Debug: eap: Previous EAP request found for state 0xcb16895fcb11935b, released from the list (162) Wed Apr 12 11:30:39 2017: Debug: eap: Peer sent packet with method EAP MSCHAPv2 (26) (162) Wed Apr 12 11:30:39 2017: Debug: eap: Calling submodule eap_mschapv2 to process data (162) Wed Apr 12 11:30:39 2017: Debug: eap_mschapv2: # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: eap_mschapv2: authenticate { (162) Wed Apr 12 11:30:39 2017: Debug: mschap: Found Cleartext-Password, hashing to create NT-Password (162) Wed Apr 12 11:30:39 2017: Debug: mschap: Found Cleartext-Password, hashing to create LM-Password (162) Wed Apr 12 11:30:39 2017: Debug: mschap: Creating challenge hash with username: testuser (162) Wed Apr 12 11:30:39 2017: Debug: mschap: Client is using MS-CHAPv2 (162) Wed Apr 12 11:30:39 2017: ERROR: mschap: MS-CHAP2-Response is incorrect (162) Wed Apr 12 11:30:39 2017: Debug: [mschap] = reject (162) Wed Apr 12 11:30:39 2017: Debug: } # authenticate = reject (162) Wed Apr 12 11:30:39 2017: Debug: MSCHAP-Error: E=691 R=1 C=1474492f8f426051613ac0fd4afe37b8 V=3 M=Authentication failed (162) Wed Apr 12 11:30:39 2017: Debug: Found new challenge from MS-CHAP-Error: err=691 retry=1 challenge=1474492f8f426051613ac0fd4afe37b8 (162) Wed Apr 12 11:30:39 2017: ERROR: MSCHAP Failure (162) Wed Apr 12 11:30:39 2017: Debug: eap: Sending EAP Request (code 1) ID 8 length 81 (162) Wed Apr 12 11:30:39 2017: Debug: eap: EAP session adding &reply:State = 0xcb16895fca1e935b (162) Wed Apr 12 11:30:39 2017: Debug: [eap] = handled (162) Wed Apr 12 11:30:39 2017: Debug: } # authenticate = handled (162) Wed Apr 12 11:30:39 2017: Debug: } # server wifi_tim_inner_tunnel (162) Wed Apr 12 11:30:39 2017: Debug: Virtual server sending reply (162) Wed Apr 12 11:30:39 2017: Debug: EAP-Message = 0x010800511a0407004c453d36393120523d3120433d313437343439326638663432363035313631336163306664346166653337623820563d33204d3d41757468656e7469636174696f6e206661696c6564 (162) Wed Apr 12 11:30:39 2017: Debug: Message-Authenticator = 0x00000000000000000000000000000000 (162) Wed Apr 12 11:30:39 2017: Debug: State = 0xcb16895fca1e935b1be4d67ff3649f78 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Got tunneled reply code 11 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: EAP-Message = 0x010800511a0407004c453d36393120523d3120433d313437343439326638663432363035313631336163306664346166653337623820563d33204d3d41757468656e7469636174696f6e206661696c6564 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: State = 0xcb16895fca1e935b1be4d67ff3649f78 (162) Wed Apr 12 11:30:39 2017: Debug: eap_peap: Got tunneled Access-Challenge (162) Wed Apr 12 11:30:39 2017: Debug: eap: Sending EAP Request (code 1) ID 8 length 123 (162) Wed Apr 12 11:30:39 2017: Debug: eap: EAP session adding &reply:State = 0xe50e637de2067a45 (162) Wed Apr 12 11:30:39 2017: Debug: [eap] = handled (162) Wed Apr 12 11:30:39 2017: Debug: } # authenticate = handled (162) Wed Apr 12 11:30:39 2017: Debug: Using Post-Auth-Type Challenge (162) Wed Apr 12 11:30:39 2017: Debug: # Executing group from file /usr/local/freeradius/etc/raddb/sites-enabled/wifi_tim (162) Wed Apr 12 11:30:39 2017: Debug: Challenge { ... } # empty sub-section is ignored (162) Wed Apr 12 11:30:39 2017: Debug: Sent Access-Challenge Id 7 from 194.183.95.46:1812 to 194.183.95.46:55808 length 0 (162) Wed Apr 12 11:30:39 2017: Debug: EAP-Message = 0x0108007b19001703010070ebc34da12bb045acd32080fe40bc92495c6593a5e40589775105ef0f5c76cffda64ca3039931242118be0db1a39bdd811a876d7bc9e111e9e28ee633e50ceae1b4a66367000e3990c542a0aa3227b3673d58dd69d1b006db31a8859ae1fe63416e1253dec50b6fb4959a4e51 (162) Wed Apr 12 11:30:39 2017: Debug: Message-Authenticator = 0x00000000000000000000000000000000 (162) Wed Apr 12 11:30:39 2017: Debug: State = 0xe50e637de2067a45c917c73821ab3033 (162) Wed Apr 12 11:30:39 2017: Debug: Finished request no more packets are exchanged... Thanks, Andrea -- ---------------------------------------------------------------- Truth hurts... not the searching after but the running from. ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

3 11

Windows 7, wired 802.1x, native EAP-TLS w/o AD, NPS
by Timo Buhrmester 18 Apr '17

18 Apr '17

Hello list, I'm trying to implement 802.1x/EAP-TLS on a wired network. Getting that to work on Linux clients was reasonably straightforward using wpa_supplicant (and freeradius as the back-end). However, we also have Windows (7) clients on the network, and I'm having issues setting that up. It is my understanding that a) EAP-TLS is mandatory for systems that claim to support 802.1x b) Windows claims to support 802.1x. Unfortunately, every resource I could find either assumes there's an Active Directory infrastructure (which, fortunately, we don't use here) and other shady things involved (NPS -- seems to be sort of an ersatz-radius), OR talks about wireless, OR refers to other versions of Windows, OR ... None seems to describe the combination Windows 7, native supplicant, freeradius, no AD/NPS. So my question, although not directly freeradius-related, is: Does anyone have experience setting up EAP-TLS on a wired network on Windows 7 clients? Is AD strictly required? If so, I wonder how Windows could get away claiming to support 802.1x. I.e.: Does anybody know whether this is possible *at all*? I'm already considering trying 3rd party supplicants, but I'd much rather go with the native one. Thanks, Timo

5 13

tip: note about -sql and -ldap
by Alan Buxey 17 Apr '17

17 Apr '17

hi, just to remind people, with version 3 of the FreeRADIUS server, a new feature arrived which was/is called "Conditional modules". TL;DR -sql and -ldap are calls to the SQL and LDAP modules respectively that work if those modules are configured and enabled The conditional modules feature is documented in very few locations , the main reference source in the configuration files being the mods-available/README.rst file (if using a distribution version then I really hope they keep that file present!) this can be found online here: https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai… what this feature means is that as the default server ships, the config files have a lots of features ready for use but not active. all you need to do is configure either sql or ldap modules (or both!), link the mods-available to mods-enabled and then the server will read the module config, note that SQL and/or LDAP are configured and then automatically use them - previously if you wanted to use SQL or LDAP, not only did you have to configure the modules but you then also had to try guessing where to stick the 'sql' or 'ldap' calls into the configuration - a nice game of whack-a-mole that many people failed at, sticking the calls into all kinds of places ;-) note, as it says in the documentation , not very useful for production environments because normally by then you will know what modules/options you want and whether you need/want any of those modules...at which point, you comment out the non needed stuff and can convert (or would convert ) -sql into sql etc as you know its configured and you want it. personally, would like to see many other modules become conditional so the server works out of the box and you just configure the modules/features you want, then go through removing all the modules not needed (flagged in debug yellow with "Ignoring module....." ) rather than guessing if something is needed....a final pass would then convert all remaining -module with module. et voila! :) alan

1 0

RE: Acct-Status-Type = 7 [SOLVED]
by Oscar Jofre 17 Apr '17

17 Apr '17

Hi, [SOLVED] As you told Alan, I did uncomment on accounting if (noop) { ok } And then on production Accounting-on worked with user informed and user not informed. But I wandered why on TEST environment with that lines comment worked. Finally a saw the differences. If you have uncommented details on accounting section then Accounting-on works always, with user informed and not informed --> that’s why on TEST was working, and on production that details are commented the Accounting-on with no user defined was not responding. So: THIS WORKS: accounting { ... detail ... # if (noop) { # ok # } } THIS WORKS: accounting { ... # detail ... if (noop) { ok } } THIS DOESN'T WORKS: accounting { ... # detail ... # if (noop) { # ok # } } All have an explanation for me at the end ! Thanks for the help ! -----Mensaje original----- De: Freeradius-Users [mailto:freeradius-users-bounces+oscar=jofre.com@lists.freeradius.org] En nombre de Alan DeKok Enviado el: lunes, 17 de abril de 2017 19:02 Para: FreeRadius users mailing list Asunto: Re: Acct-Status-Type = 7 On Apr 17, 2017, at 12:41 PM, Oscar Jofre <oscar(a)jofre.com> wrote: > I wish no need to try for hours, but even I'm a developer I don't have the deep knowledge about radius and even linux environment ... can't know about everything...\ The idea is simple: follow the instructions on this list. When I say to post the debug log, I mean for you to post all of it. All of the documentation makes this clear. When you post part of the debug log, you are making it difficult for us to help you. > I wish you to point me to the correct instructions, I've read many pages about radius debugging, I've tried, trust me, to figure out by myself ... but still with no understand where is the difference. Then post the debug log and let *us* help. It's not hard. > I really appreciate you help ! > > The packets should be exactly the same (no username in both requests and different result). I'm sure I missing something ... It doesn't need a User-Name attribute. The NAS is rebooting. There's no "user". > If you need any more detail please let me know and I will the all to give necessary informations. That was enough. The short answer is to go to the file raddb/sites-enabled/default. In the "accounting" section after the "sql" module, add: if (noop) { ok } There should already be code like that in the file, but commented out. > I don’t understand about: It's in the FAQ, "man" pages, web pages, and pretty much daily on this list When I say to post the debug log. It's mentioned EVERYWHERE in the documentation, and daily on this list. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Acct-Status-Type = 7
by Oscar Jofre 17 Apr '17

17 Apr '17

Hi Alan and thanks, About last answer i will check it but the accounting on should response anything ? Thanks. -------- Mensaje original -------- De: Alan DeKok <aland(a)deployingradius.com> Fecha: 14/4/17 1:41 (GMT+01:00) Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Asunto: Re: Acct-Status-Type = 7 On Apr 13, 2017, at 5:56 PM, Oscar Jofre <oscar(a)jofre.com> wrote: > When I reboot a mikrotik with hotspot + radius activated, after reboot the > router sends Acct-Status-Type = 7. Which is "Accounting On". It's best to use names instead of numbers. They're more informative. > What I understand is that with this Acct-Status-Type = 7 the mikrotik tells > radius that router has rebooted and then radius close all connections with > NAS-Reboot. Yes. > What happens in my case is that freeradius is not responding the > Acct-Status-Type = 7 and then mikrotik thinks that and accumulate timeoute > from raiuds. Well, run the server in debugging mode to see what it's doing. As suggested in the FAQ, web pages, "man" pages, and daily on this list. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 9

Matching in VSA
by Noah 14 Apr '17

14 Apr '17

Hi there freeradius list, I need to be able to match a client request with a specific key. I generally do this by matching IPs in the clients.conf file. Is there any way to match to a Vendor specific attribute? For instance if the request comes in from a specific vendor-id in the request I could match based on that and a specific radius secret key is used for the radius authentication session. Cheers, Noah

3 10

Acct-Status-Type = 7
by Oscar Jofre 13 Apr '17

13 Apr '17

Hi, When I reboot a mikrotik with hotspot + radius activated, after reboot the router sends Acct-Status-Type = 7. What I understand is that with this Acct-Status-Type = 7 the mikrotik tells radius that router has rebooted and then radius close all connections with NAS-Reboot. What happens in my case is that freeradius is not responding the Acct-Status-Type = 7 and then mikrotik thinks that and accumulate timeoute from raiuds. Mikroitk keeps trying Acct-Status-Type = 7 and accumulates tiemouts. When the first users connects, then mikrotik sends Access-Request and after Access-Accept starts accounting. But then after that mikrotik sends another and LAST Acct-Status-Type = 7 that makes this firs connection to close with NAS-Reboot. After that everything goes ok but I have a user connected with NAS-Reboot on Radius. I did send this behavior to mikrotik. My question is if it is correct that mikrotik is not reciving response from Acct-Status-Type = 7 or maybe I have some misconfiguration on freeradius. I'm using FreeRADIUS Version 3.0.10 Thanks !

2 1