- Freeradius-Users - lists.freeradius.org

Problem In Freeradius 3.0.11
by تعلم البرمجة 30 Mar '17

30 Mar '17

Hello , Iam using Freeradius 3.0.11 And I am using this code in /etc/raddb/default authorize { .... update control { Auth-Type := `/usr/bin/php /var/www/html/set_auth_type.php %{User-Name} %{User-Password} %{Client-IP-Address} 3` } } } in v2.1.x iam using this code in php if ($username == "Name"){ echo "Reject"; }else{ echo "Ok"; } I am Using Ok To Skip But in v3.0.11 Not Skip But Get Error And When Using Accept user Login Without Check Attributes Sorry For My English

2 1

Loading new clients without a restart
by Clayton Knorr 30 Mar '17

30 Mar '17

Suppose you're loading your clients in from LDAP or SQL, and you need adding new clients to be relatively dynamic. Reloads don't pull in the clients, just restarts. I assume other people have run into this issue and didn’t want to restart Freeradius once a day or more just to load a new client. Are there some clever solutions out there anybody has come up with? Or a super secret feature I don't know about?

3 4

Logging off MS Chapp error messages
by Arnab Roy 29 Mar '17

29 Mar '17

Hi All, I am just trying to figure out if its possible to log the following MS-Chap error messages via linelog mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' (8) mschap: External script failed (8) mschap: ERROR: External script says: Logon failure (0xc000006d) (8) mschap: ERROR: MS-CHAP2-Response is incorrect By using %{reply:MS-CHAP-Error}, I get something like this E=691 R=1 C=3c30753bced696c552fc3c78aeb953b0 V=3 M=Authentication failed But that is not as descriptive of the issue as above. Any suggestions would be great. Many Thanks Arnab

2 2

FreeRadius and multiotp
by Alex Sharaz 29 Mar '17

29 Mar '17

Hi, Anyone using multiotp with freeradius to implement two-factor auth? Their test VM has freeradius 2.x installed, which is fine for testing. I've set this up and have successfully "checked" my userid using an OTP and prefix. However can't find any reference to what to do when trying to pass credentials into multiotp via freeradius. Am I just concatenating normal password with prefix and OTP value? A

2 1

Unstructured Attr-26 in unlang
by Brian Candler 29 Mar '17

29 Mar '17

(FreeRADIUS 3.0.13 under CentOS) I am trying to deal with a broken device (Aten) which requires an unstructured attribute 26 [^1]. Using the 'files' module this works [^2]: bob Cleartext-Password := "hello" # Vendor-Specific = "su/administrator" Attr-26 = 0x73752f61646d696e6973747261746f72 But in unlang, this is not accepted: update reply { # Vendor-Specific = "su/administrator" &Attr-26 = 0x73752f61646d696e6973747261746f72 } Tue Mar 28 14:01:27 2017 : Error: /etc/raddb/policy.d/localpolicy[155]: Invalid vendor name in attribute name "0x73752f61646d696e6973747261746f72" Here's the only bit of source I can find which generates that error message: if (strncasecmp(p, "Attr-", 5) != 0) { if (strncasecmp(p, "Vendor-", 7) == 0) { ... /* must be vendor name */ } else { char buffer[256]; q = strchr(p, '-'); if (!q) { fr_strerror_printf("Invalid vendor name in attribute name \"%s\"", name); return -1; } I don't understand why it thinks the attribute *name* is "0x73752f61"... rather than "Attr-26" And if I try this: update reply { &Attr-26 = "su/administrator" } Tue Mar 28 14:25:56 2017 : Error: /etc/raddb/policy.d/localpolicy[154]: Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...' That's an even stranger error: I *am* using Attr-26 like it says!! Any suggestions how I can get this to work, other than switching from unlang to files module? Thanks, Brian. [^1] It is so broken that it doesn't even use a vendor ID in the first four bytes. But I am happy to define a fake vendor which has the correct four bytes. And RFC 2865 *does* permit unstructured data after the 4 bytes of vendor ID. [^2] tcpdump confirms it's as expected: 0x0050: .... 1a12 7375 2f61 646d 696e 6973 7472 ....su/administr 0x0060: 6174 6f72 ator

3 4

3.0.13 crash
by Stefan Winter 28 Mar '17

28 Mar '17

Hi, updating from 3.0.12 to 3.0.13, I see that the servers starts up fine, starts processing packets for a few seconds, and then: Wed Mar 15 09:27:55 2017 : ERROR: (579) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xecf67dfde9f1649a Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value CAUGHT SIGNAL: Aborted Backtrace of last 23 frames: /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f63d355e461] /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(+0xd79c)[0x7f63d355e79c] /lib64/libtalloc.so.2(_talloc_get_type_abort+0xea)[0x7f63d2ae214a] /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(fr_pair_verify+0x85)[0x7f63d356f84b] /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(fr_cursor_init+0x6f)[0x7f63d355d028] /usr/local/freeradius/3.0.13/lib/libfreeradius-eap.so(eaptls_process+0x4c3)[0x7f63d334a1ca] /usr/local/freeradius/3.0.13/lib/rlm_eap_peap.so(+0x1f9c)[0x7f63cd089f9c] /usr/local/freeradius/3.0.13/lib/rlm_eap.so(+0x40f5)[0x7f63cdec00f5] /usr/local/freeradius/3.0.13/lib/rlm_eap.so(eap_method_select+0x431)[0x7f63cdec0add] /usr/local/freeradius/3.0.13/lib/rlm_eap.so(+0x2d01)[0x7f63cdebed01] /usr/local/freeradius/current/sbin/radiusd[0x428c82] /usr/local/freeradius/current/sbin/radiusd[0x42932f] /usr/local/freeradius/current/sbin/radiusd[0x428e43] /usr/local/freeradius/current/sbin/radiusd[0x429d63] /usr/local/freeradius/current/sbin/radiusd(modcall+0xa2)[0x42aaa8] /usr/local/freeradius/current/sbin/radiusd(indexed_modcall+0x363)[0x4262ba] /usr/local/freeradius/current/sbin/radiusd(process_authenticate+0x22)[0x42857f] /usr/local/freeradius/current/sbin/radiusd[0x40f74d] /usr/local/freeradius/current/sbin/radiusd(rad_authenticate+0x51e)[0x410078] /usr/local/freeradius/current/sbin/radiusd[0x43d692] /usr/local/freeradius/current/sbin/radiusd[0x4392c8] /lib64/libpthread.so.0(+0x7dc5)[0x7f63d1e28dc5] /lib64/libc.so.6(clone+0x6d)[0x7f63d192073d] Calling: gdb -silent -x /usr/local/freeradius/config/raddb/panic.gdb /usr/local/freeradius/current/sbin/radiusd 11265 2>&1 | tee /var/log/radius/gdb-radiusd-11265.log Panic action exited with 0 _EXIT(0) CALLED src/lib/debug.c[743] The initial error is fine; it was restarted and lost state on its EAP sessions, so it's confused when half a session comes in. Its reaction to crash on that is not quite so fine :-/ Anyone with ideas? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 2

shared secret (general question)
by Janis Heller 28 Mar '17

28 Mar '17

Because I prepare a small presentation about freeradius, how exactly is the process of sending passwords from a station to the radius server itself? All I know is the shared secret is used and md5 algo, but how exactly is this kind of sensitive data obfuscated? For my example /presentation I use default radius setup (no radsec). All the best;

4 4

Problems with "virtual_server" for EAP-pwd
by Christian Strauf 27 Mar '17

27 Mar '17

Hi all! For our eduroam setup we use FreeRADIUS to authenticate EAP-TTLS, PEAP as well as EAP-pwd requests. For each of these EAP types you have to configure the "virtual_server" which deals with the tunneled authentication (which is a little odd with respect to EAP-pwd because it isn't a tunneled method). Within the "inner-tunnel*" virtual servers we connect to an LDAP server to get the user credentials and RADIUS attributes that are associated with a specific user. Furthermore, we call a policy in the authorize section that is defined in policy.d/ that simply checks whether a certain attribute is set to "yes" or "no". The check basically looks like this: if ( ...<some check>... ) { reject } This works nicely with the inner-tunnel virtual servers that are used for EAP-TTLS and PEAP. It basically looks like this if the check yields a reject: 11) if (...<some check>...) { (11) [reject] = reject (11) } # if (...<some check>...) = reject (11) } # policy XXXX = reject (11) } # authorize = reject (11) Using Post-Auth-Type Reject (11) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (11) Post-Auth-Type REJECT { ... (11) } # Post-Auth-Type REJECT = updated (11) } # server inner-tunnel (11) Virtual server sending reply This reject is forwarded to the outer session and this works as expected. However, it doesn't work with the inner-tunnel virtual server that we use for EAP-pwd. Please note that the configuration is virtually identical (except that you obviously don't need inner authentications methods for EAP-pwd). You basically get debugging output that looks like this: (2) if (...<some check>...) { (2) [reject] = reject (2) } # if (...<some check>...) = reject (2) } # policy XXXX = reject (2) } # authorize = reject (2) eap_pwd: } # server inner-tunnel-eap-pwd (2) eap_pwd: Got tunneled reply code 0 It looks like the eap_pwd module doesn't receive the reject generated within the authorize section of the inner-tunnel virtual server. Please note that EAP-pwd authentication per se works without any problems. Furthermore, I perfectly understand that only the authorize section of the inner-tunnel virtual server is used by EAP-pwd anyhow (it's simply used to retrieve credentials). However, it's not clear to me why the exact same configuration works for EAP-TTLS / PEAP but not for EAP-pwd because other things that we do within the authorize section (like setting RADIUS attributes that are used in the outer session etc.) work. I was thinking about working around the problem by doing something like update outer.session-state { ... } to generate a reject within the outer session. Do you have any suggestions what the right way would be to work around this? Apart from a workaround, do you think this could be a bug in the EAP-pwd module? I tried to read the source code but I'm not a programmer and I couldn't figure out how the EAP-pwd module works differently from the EAP-TTLS and PEAP modules with respect to how it works with inner-tunnel virtual servers. Any help would be highly appreciated. Kind regards, Christian Strauf -- Dipl.-Math. Christian Strauf Clausthal Univ. of Technology E-Mail: strauf(a)rz.tu-clausthal.de Rechenzentrum Web: www.rz.tu-clausthal.de Erzstraße 18 Tel.: +49-5323-72-2086 Fax: -992086 D-38678 Clausthal-Zellerfeld

3 7

iOS mysterious issues on Freeradius 3.0.14
by Igor Sousa 27 Mar '17

27 Mar '17

Hello everyone, I've read a lot messages in Freeradius Forum and I continued misunderstand why iOS devices (iPhone, iPad) doesn't connect in my WPA-Enterprise wifi network. I've installed and configured a freeradius server, version 3.0.14, over openssl 1.1.0e (both have installed from sources on Debian 8). I've tested connect Android devices to my wifi network and everytime they can connect to the network, but iOS devices have mysterious issues. When I try connect iOS device to my wifi in first time, they can connect perfectly. Though, if this same iOS device lost connection (because it's out of range AP signal or air plane mode turn on by the user for 30 minutes or hours) and try connect again the device doesn't connect. When I've saw the debug mode, I've noticed that EAP-PEAP tunnel athentication was successful and server sent Access-Challenge, but device doesn't answer this challenge. I don't understand why the android devices doesn't this issues. Glad, Igor Sousa Wed Mar 22 07:33:50 2017 : Debug: Waking up in 1.1 seconds. Wed Mar 22 07:33:50 2017 : Debug: (17) Received Access-Request Id 8 from 10.41.17.64:1042 to 10.41.110.86:1812 length 255 Wed Mar 22 07:33:50 2017 : Debug: (17) Message-Authenticator = 0x50eb8b4ea5bffe022eda2db1d905b40e Wed Mar 22 07:33:50 2017 : Debug: (17) Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) State = 0x541acf3e5312d64e560d7f91490adef3 Wed Mar 22 07:33:50 2017 : Debug: (17) Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) EAP-Message = 0x0208002b19001703010020b525f058fa80f3f09e827ff6899bf36e4cab 3f5023d51a927e3e3accc04d61bd Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) session-state: No cached attributes Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:50 2017 : Debug: (17) authorize { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Mar 22 07:33:50 2017 : Debug: (17) [preprocess] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent EAP Response (code 2) ID 8 length 43 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Continuing tunnel setup Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) [eap] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) } # authorize = ok Wed Mar 22 07:33:50 2017 : Debug: (17) Found Auth-Type = eap Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:50 2017 : Debug: (17) authenticate { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authenticate]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Expiring EAP session with state 0xb44ea59dbc47bc85 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Finished EAP session with state 0x541acf3e5312d64e Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Previous EAP request found for state 0x541acf3e5312d64e, released from the list Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent packet with method EAP PEAP (25) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Calling submodule eap_peap to process data Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Continuing EAP-TLS Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Peer sent flags --- Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: [eaptls verify] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Done initial handshake Wed Mar 22 07:33:50 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: [eaptls process] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Session established. Decoding tunneled attributes Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: PEAP state phase2 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP method MSCHAPv2 (26) Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Got tunneled request Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Setting User-Name to userTest Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Sending tunneled request to inner-tunnel Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: State = 0x1c722cc11d7a36d74beb044945cb21bf Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Event-Timestamp = "Mar 22 2017 07:33:50 -03" Wed Mar 22 07:33:50 2017 : Debug: (17) Virtual server inner-tunnel received request Wed Mar 22 07:33:50 2017 : Debug: (17) EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) FreeRADIUS-Proxied-To = 127.0.0.1 Wed Mar 22 07:33:50 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) State = 0x1c722cc11d7a36d74beb044945cb21bf Wed Mar 22 07:33:50 2017 : Debug: (17) Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) Event-Timestamp = "Mar 22 2017 07:33:50 -03" Wed Mar 22 07:33:50 2017 : WARNING: (17) Outer and inner identities are the same. User privacy is compromised. Wed Mar 22 07:33:50 2017 : Debug: (17) server inner-tunnel { Wed Mar 22 07:33:50 2017 : Debug: (17) session-state: No cached attributes Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:50 2017 : Debug: (17) authorize { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent EAP Response (code 2) ID 8 length 6 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: No EAP Start, assuming it's an on-going EAP conversation Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) [eap] = updated Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling ldap (rlm_ldap) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL LITERAL Wed Mar 22 07:33:50 2017 : Debug: rlm_ldap (ldap): Reserved connection (3) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL XLAT Wed Mar 22 07:33:50 2017 : Debug: (uid=%{%{Stripped-User-Name}:- %{User-Name}}) Wed Mar 22 07:33:50 2017 : Debug: Parsed xlat tree: Wed Mar 22 07:33:50 2017 : Debug: literal --> (uid= Wed Mar 22 07:33:50 2017 : Debug: XLAT-IF { Wed Mar 22 07:33:50 2017 : Debug: attribute --> Stripped-User-Name Wed Mar 22 07:33:50 2017 : Debug: } Wed Mar 22 07:33:50 2017 : Debug: XLAT-ELSE { Wed Mar 22 07:33:50 2017 : Debug: attribute --> User-Name Wed Mar 22 07:33:50 2017 : Debug: } Wed Mar 22 07:33:50 2017 : Debug: literal --> ) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: --> (uid=userTest) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL LITERAL Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: Performing search in "ou=people,dc=test,dc=br" with filter "(uid=userTest)", scope "sub" Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: Waiting for search result... Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: User object found at DN "uid=userTest,ou=people,dc=test,dc=br" Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: Processing user attributes Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: control:NT-Password := 0x3145333941394139324632423038413045363942344435414441374535333332 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Released connection (3) Wed Mar 22 07:33:53 2017 : Info: Need 2 more connections to reach 10 spares Wed Mar 22 07:33:53 2017 : Info: rlm_ldap (ldap): Opening additional connection (8), 1 of 24 pending slots used Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Connecting to ldap:// 10.0.0.2:389 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): New libldap handle 0x1d2afa0 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Waiting for bind result... Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Bind successful Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from ldap (rlm_ldap) Wed Mar 22 07:33:53 2017 : Debug: (17) [ldap] = updated Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling expiration (rlm_expiration) Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from expiration (rlm_expiration) Wed Mar 22 07:33:53 2017 : Debug: (17) [expiration] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling logintime (rlm_logintime) Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from logintime (rlm_logintime) Wed Mar 22 07:33:53 2017 : Debug: (17) [logintime] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling pap (rlm_pap) Wed Mar 22 07:33:53 2017 : Debug: (17) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes Wed Mar 22 07:33:53 2017 : WARNING: (17) pap: Auth-Type already set. Not setting to PAP Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from pap (rlm_pap) Wed Mar 22 07:33:53 2017 : Debug: (17) [pap] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) } # authorize = updated Wed Mar 22 07:33:53 2017 : Debug: (17) Found Auth-Type = eap Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) authenticate { Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: calling eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Expiring EAP session with state 0xb44ea59dbc47bc85 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Finished EAP session with state 0x1c722cc11d7a36d7 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Previous EAP request found for state 0x1c722cc11d7a36d7, released from the list Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Peer sent packet with method EAP MSCHAPv2 (26) Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Calling submodule eap_mschapv2 to process data Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Sending EAP Success (code 3) ID 8 length 4 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Freeing handler Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: returned from eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) [eap] = ok Wed Mar 22 07:33:53 2017 : Debug: (17) } # authenticate = ok Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) post-auth { ... } # empty sub-section is ignored Wed Mar 22 07:33:53 2017 : Debug: (17) } # server inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) Virtual server sending reply Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Got tunneled reply code 2 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Got tunneled reply RADIUS code 2 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Tunneled authentication was successful Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: SUCCESS Wed Mar 22 07:33:53 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Saving tunneled attributes for later Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Sending EAP Request (code 1) ID 9 length 43 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: EAP session adding &reply:State = 0x541acf3e5c13d64e Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: returned from eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) [eap] = handled Wed Mar 22 07:33:53 2017 : Debug: (17) } # authenticate = handled Wed Mar 22 07:33:53 2017 : Debug: (17) Using Post-Auth-Type Challenge Wed Mar 22 07:33:53 2017 : Debug: (17) Post-Auth-Type sub-section not found. Ignoring. Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:53 2017 : Debug: (17) session-state: Nothing to cache Wed Mar 22 07:33:53 2017 : Debug: (17) Sent Access-Challenge Id 8 from 10.41.110.86:1812 to 10.41.17.64:1042 length 0 Wed Mar 22 07:33:53 2017 : Debug: (17) EAP-Message = 0x0109002b1900170301002040009148da66c66e92399186be36b8b9bfb2 dd86e5e250997e63aa0d31227eff Wed Mar 22 07:33:53 2017 : Debug: (17) Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) State = 0x541acf3e5c13d64e560d7f91490adef3 Wed Mar 22 07:33:53 2017 : Debug: (17) Finished request Wed Mar 22 07:33:53 2017 : Debug: (8) Cleaning up request packet ID 8 with timestamp +7 Wed Mar 22 07:33:53 2017 : Debug: (9) Cleaning up request packet ID 0 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (10) Cleaning up request packet ID 1 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (11) Cleaning up request packet ID 2 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (12) Cleaning up request packet ID 3 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (13) Cleaning up request packet ID 4 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (14) Cleaning up request packet ID 5 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (15) Cleaning up request packet ID 6 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (7) Cleaning up request packet ID 7 with timestamp +3 Wed Mar 22 07:33:53 2017 : Debug: Waking up in 4.9 seconds. Wed Mar 22 07:33:58 2017 : Debug: (17) Cleaning up request packet ID 8 with timestamp +14 Wed Mar 22 07:33:58 2017 : Debug: Waking up in 1.8 seconds. Wed Mar 22 07:34:00 2017 : Debug: (16) Cleaning up request packet ID 7 with timestamp +10 Wed Mar 22 07:34:00 2017 : Info: Ready to process requests

6 15

How to log Request
by Andrés Gómez 27 Mar '17

27 Mar '17

Hi dear list. I need to log when there is an authentication request using an incorrect Radius secret. This is my radiusd.conf: log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } So, I can log all good or bad requests made with the correct secret, but I can't see when is made a request using an incorrect secret. How Can I do it? Best regards -- *C. Andrés Gómez R.*

3 3