- Freeradius-Users - lists.freeradius.org

Problems with "virtual_server" for EAP-pwd
by Christian Strauf 27 Mar '17

27 Mar '17

Hi all! For our eduroam setup we use FreeRADIUS to authenticate EAP-TTLS, PEAP as well as EAP-pwd requests. For each of these EAP types you have to configure the "virtual_server" which deals with the tunneled authentication (which is a little odd with respect to EAP-pwd because it isn't a tunneled method). Within the "inner-tunnel*" virtual servers we connect to an LDAP server to get the user credentials and RADIUS attributes that are associated with a specific user. Furthermore, we call a policy in the authorize section that is defined in policy.d/ that simply checks whether a certain attribute is set to "yes" or "no". The check basically looks like this: if ( ...<some check>... ) { reject } This works nicely with the inner-tunnel virtual servers that are used for EAP-TTLS and PEAP. It basically looks like this if the check yields a reject: 11) if (...<some check>...) { (11) [reject] = reject (11) } # if (...<some check>...) = reject (11) } # policy XXXX = reject (11) } # authorize = reject (11) Using Post-Auth-Type Reject (11) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (11) Post-Auth-Type REJECT { ... (11) } # Post-Auth-Type REJECT = updated (11) } # server inner-tunnel (11) Virtual server sending reply This reject is forwarded to the outer session and this works as expected. However, it doesn't work with the inner-tunnel virtual server that we use for EAP-pwd. Please note that the configuration is virtually identical (except that you obviously don't need inner authentications methods for EAP-pwd). You basically get debugging output that looks like this: (2) if (...<some check>...) { (2) [reject] = reject (2) } # if (...<some check>...) = reject (2) } # policy XXXX = reject (2) } # authorize = reject (2) eap_pwd: } # server inner-tunnel-eap-pwd (2) eap_pwd: Got tunneled reply code 0 It looks like the eap_pwd module doesn't receive the reject generated within the authorize section of the inner-tunnel virtual server. Please note that EAP-pwd authentication per se works without any problems. Furthermore, I perfectly understand that only the authorize section of the inner-tunnel virtual server is used by EAP-pwd anyhow (it's simply used to retrieve credentials). However, it's not clear to me why the exact same configuration works for EAP-TTLS / PEAP but not for EAP-pwd because other things that we do within the authorize section (like setting RADIUS attributes that are used in the outer session etc.) work. I was thinking about working around the problem by doing something like update outer.session-state { ... } to generate a reject within the outer session. Do you have any suggestions what the right way would be to work around this? Apart from a workaround, do you think this could be a bug in the EAP-pwd module? I tried to read the source code but I'm not a programmer and I couldn't figure out how the EAP-pwd module works differently from the EAP-TTLS and PEAP modules with respect to how it works with inner-tunnel virtual servers. Any help would be highly appreciated. Kind regards, Christian Strauf -- Dipl.-Math. Christian Strauf Clausthal Univ. of Technology E-Mail: strauf(a)rz.tu-clausthal.de Rechenzentrum Web: www.rz.tu-clausthal.de Erzstraße 18 Tel.: +49-5323-72-2086 Fax: -992086 D-38678 Clausthal-Zellerfeld

3 7

iOS mysterious issues on Freeradius 3.0.14
by Igor Sousa 27 Mar '17

27 Mar '17

Hello everyone, I've read a lot messages in Freeradius Forum and I continued misunderstand why iOS devices (iPhone, iPad) doesn't connect in my WPA-Enterprise wifi network. I've installed and configured a freeradius server, version 3.0.14, over openssl 1.1.0e (both have installed from sources on Debian 8). I've tested connect Android devices to my wifi network and everytime they can connect to the network, but iOS devices have mysterious issues. When I try connect iOS device to my wifi in first time, they can connect perfectly. Though, if this same iOS device lost connection (because it's out of range AP signal or air plane mode turn on by the user for 30 minutes or hours) and try connect again the device doesn't connect. When I've saw the debug mode, I've noticed that EAP-PEAP tunnel athentication was successful and server sent Access-Challenge, but device doesn't answer this challenge. I don't understand why the android devices doesn't this issues. Glad, Igor Sousa Wed Mar 22 07:33:50 2017 : Debug: Waking up in 1.1 seconds. Wed Mar 22 07:33:50 2017 : Debug: (17) Received Access-Request Id 8 from 10.41.17.64:1042 to 10.41.110.86:1812 length 255 Wed Mar 22 07:33:50 2017 : Debug: (17) Message-Authenticator = 0x50eb8b4ea5bffe022eda2db1d905b40e Wed Mar 22 07:33:50 2017 : Debug: (17) Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) State = 0x541acf3e5312d64e560d7f91490adef3 Wed Mar 22 07:33:50 2017 : Debug: (17) Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) EAP-Message = 0x0208002b19001703010020b525f058fa80f3f09e827ff6899bf36e4cab 3f5023d51a927e3e3accc04d61bd Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) session-state: No cached attributes Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:50 2017 : Debug: (17) authorize { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Mar 22 07:33:50 2017 : Debug: (17) [preprocess] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent EAP Response (code 2) ID 8 length 43 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Continuing tunnel setup Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) [eap] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) } # authorize = ok Wed Mar 22 07:33:50 2017 : Debug: (17) Found Auth-Type = eap Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:50 2017 : Debug: (17) authenticate { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authenticate]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Expiring EAP session with state 0xb44ea59dbc47bc85 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Finished EAP session with state 0x541acf3e5312d64e Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Previous EAP request found for state 0x541acf3e5312d64e, released from the list Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent packet with method EAP PEAP (25) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Calling submodule eap_peap to process data Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Continuing EAP-TLS Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Peer sent flags --- Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: [eaptls verify] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Done initial handshake Wed Mar 22 07:33:50 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: [eaptls process] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Session established. Decoding tunneled attributes Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: PEAP state phase2 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP method MSCHAPv2 (26) Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Got tunneled request Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Setting User-Name to userTest Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Sending tunneled request to inner-tunnel Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: State = 0x1c722cc11d7a36d74beb044945cb21bf Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Event-Timestamp = "Mar 22 2017 07:33:50 -03" Wed Mar 22 07:33:50 2017 : Debug: (17) Virtual server inner-tunnel received request Wed Mar 22 07:33:50 2017 : Debug: (17) EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) FreeRADIUS-Proxied-To = 127.0.0.1 Wed Mar 22 07:33:50 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) State = 0x1c722cc11d7a36d74beb044945cb21bf Wed Mar 22 07:33:50 2017 : Debug: (17) Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) Event-Timestamp = "Mar 22 2017 07:33:50 -03" Wed Mar 22 07:33:50 2017 : WARNING: (17) Outer and inner identities are the same. User privacy is compromised. Wed Mar 22 07:33:50 2017 : Debug: (17) server inner-tunnel { Wed Mar 22 07:33:50 2017 : Debug: (17) session-state: No cached attributes Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:50 2017 : Debug: (17) authorize { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent EAP Response (code 2) ID 8 length 6 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: No EAP Start, assuming it's an on-going EAP conversation Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) [eap] = updated Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling ldap (rlm_ldap) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL LITERAL Wed Mar 22 07:33:50 2017 : Debug: rlm_ldap (ldap): Reserved connection (3) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL XLAT Wed Mar 22 07:33:50 2017 : Debug: (uid=%{%{Stripped-User-Name}:- %{User-Name}}) Wed Mar 22 07:33:50 2017 : Debug: Parsed xlat tree: Wed Mar 22 07:33:50 2017 : Debug: literal --> (uid= Wed Mar 22 07:33:50 2017 : Debug: XLAT-IF { Wed Mar 22 07:33:50 2017 : Debug: attribute --> Stripped-User-Name Wed Mar 22 07:33:50 2017 : Debug: } Wed Mar 22 07:33:50 2017 : Debug: XLAT-ELSE { Wed Mar 22 07:33:50 2017 : Debug: attribute --> User-Name Wed Mar 22 07:33:50 2017 : Debug: } Wed Mar 22 07:33:50 2017 : Debug: literal --> ) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: --> (uid=userTest) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL LITERAL Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: Performing search in "ou=people,dc=test,dc=br" with filter "(uid=userTest)", scope "sub" Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: Waiting for search result... Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: User object found at DN "uid=userTest,ou=people,dc=test,dc=br" Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: Processing user attributes Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: control:NT-Password := 0x3145333941394139324632423038413045363942344435414441374535333332 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Released connection (3) Wed Mar 22 07:33:53 2017 : Info: Need 2 more connections to reach 10 spares Wed Mar 22 07:33:53 2017 : Info: rlm_ldap (ldap): Opening additional connection (8), 1 of 24 pending slots used Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Connecting to ldap:// 10.0.0.2:389 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): New libldap handle 0x1d2afa0 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Waiting for bind result... Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Bind successful Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from ldap (rlm_ldap) Wed Mar 22 07:33:53 2017 : Debug: (17) [ldap] = updated Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling expiration (rlm_expiration) Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from expiration (rlm_expiration) Wed Mar 22 07:33:53 2017 : Debug: (17) [expiration] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling logintime (rlm_logintime) Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from logintime (rlm_logintime) Wed Mar 22 07:33:53 2017 : Debug: (17) [logintime] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling pap (rlm_pap) Wed Mar 22 07:33:53 2017 : Debug: (17) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes Wed Mar 22 07:33:53 2017 : WARNING: (17) pap: Auth-Type already set. Not setting to PAP Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from pap (rlm_pap) Wed Mar 22 07:33:53 2017 : Debug: (17) [pap] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) } # authorize = updated Wed Mar 22 07:33:53 2017 : Debug: (17) Found Auth-Type = eap Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) authenticate { Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: calling eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Expiring EAP session with state 0xb44ea59dbc47bc85 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Finished EAP session with state 0x1c722cc11d7a36d7 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Previous EAP request found for state 0x1c722cc11d7a36d7, released from the list Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Peer sent packet with method EAP MSCHAPv2 (26) Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Calling submodule eap_mschapv2 to process data Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Sending EAP Success (code 3) ID 8 length 4 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Freeing handler Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: returned from eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) [eap] = ok Wed Mar 22 07:33:53 2017 : Debug: (17) } # authenticate = ok Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) post-auth { ... } # empty sub-section is ignored Wed Mar 22 07:33:53 2017 : Debug: (17) } # server inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) Virtual server sending reply Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Got tunneled reply code 2 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Got tunneled reply RADIUS code 2 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Tunneled authentication was successful Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: SUCCESS Wed Mar 22 07:33:53 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Saving tunneled attributes for later Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Sending EAP Request (code 1) ID 9 length 43 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: EAP session adding &reply:State = 0x541acf3e5c13d64e Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: returned from eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) [eap] = handled Wed Mar 22 07:33:53 2017 : Debug: (17) } # authenticate = handled Wed Mar 22 07:33:53 2017 : Debug: (17) Using Post-Auth-Type Challenge Wed Mar 22 07:33:53 2017 : Debug: (17) Post-Auth-Type sub-section not found. Ignoring. Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:53 2017 : Debug: (17) session-state: Nothing to cache Wed Mar 22 07:33:53 2017 : Debug: (17) Sent Access-Challenge Id 8 from 10.41.110.86:1812 to 10.41.17.64:1042 length 0 Wed Mar 22 07:33:53 2017 : Debug: (17) EAP-Message = 0x0109002b1900170301002040009148da66c66e92399186be36b8b9bfb2 dd86e5e250997e63aa0d31227eff Wed Mar 22 07:33:53 2017 : Debug: (17) Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) State = 0x541acf3e5c13d64e560d7f91490adef3 Wed Mar 22 07:33:53 2017 : Debug: (17) Finished request Wed Mar 22 07:33:53 2017 : Debug: (8) Cleaning up request packet ID 8 with timestamp +7 Wed Mar 22 07:33:53 2017 : Debug: (9) Cleaning up request packet ID 0 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (10) Cleaning up request packet ID 1 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (11) Cleaning up request packet ID 2 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (12) Cleaning up request packet ID 3 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (13) Cleaning up request packet ID 4 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (14) Cleaning up request packet ID 5 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (15) Cleaning up request packet ID 6 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (7) Cleaning up request packet ID 7 with timestamp +3 Wed Mar 22 07:33:53 2017 : Debug: Waking up in 4.9 seconds. Wed Mar 22 07:33:58 2017 : Debug: (17) Cleaning up request packet ID 8 with timestamp +14 Wed Mar 22 07:33:58 2017 : Debug: Waking up in 1.8 seconds. Wed Mar 22 07:34:00 2017 : Debug: (16) Cleaning up request packet ID 7 with timestamp +10 Wed Mar 22 07:34:00 2017 : Info: Ready to process requests

6 15

How to log Request
by Andrés Gómez 27 Mar '17

27 Mar '17

Hi dear list. I need to log when there is an authentication request using an incorrect Radius secret. This is my radiusd.conf: log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } So, I can log all good or bad requests made with the correct secret, but I can't see when is made a request using an incorrect secret. How Can I do it? Best regards -- *C. Andrés Gómez R.*

3 3

acct_unique with more than one Class attribute
by Andrea Gabellini 27 Mar '17

27 Mar '17

Hi, I'm trying to use acct_unique from the default accounting policy with FR 3.0.13: acct_unique { update request { &Tmp-String-9 := "${policy.class_value_prefix}" } if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && \ ("%{string:&Class}" =~ /^${policy.class_value_prefix}([0-9a-f]{32})/i)) { update request { &Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}" } } else { update request { &Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID}, %{NAS-Port}}" } } } Currently I already use the Class attribute to deliver some QoS, and so this policy doesn't work. Any hint to modify it to manage multi value Class atttibute? Thanks, Andrea -- ---------------------------------------------------------------- Hit any user to continue. ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

2 8

(5) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
by jaseywang 27 Mar '17

27 Mar '17

I need to use radius as the backend of pptp vpn for auth/login/accounting etc. and I try to figure it out with the help of this doc: http://www.sajithpn.com/2016/08/centos-7-installing-pptp-freeradius.html freeradius: # rpm -qa | grep radius freeradius-3.0.4-7.el7_3.x86_64 radiusclient-ng-0.5.6-9.el7.x86_64 freeradius-utils-3.0.4-7.el7_3.x86_64 freeradius-mysql-3.0.4-7.el7_3.x86_64 with daloradius-0.9.9 as the web interface, both running on localhost, the system is centos 7.2. I use daloradius to add a new user wyx1(cleartext-password), and it passed "test user connectivity" test, below is the daloradius/radtest and radiusd -X output: daloradius output: *Executed:* echo "User-Name='wyx1',User-Password='wyx1'" | radclient -c '1' -n '3' -r '3' -t '3' -x '127.0.0.1:1812' 'auth' 'testing123' 2>&1 *Results:* Sending Access-Request Id 12 from 0.0.0.0:33948 to 127.0.0.1:1812 User-Name = 'wyx1' User-Password = 'wyx1' Received Access-Accept Id 12 from 127.0.0.1:1812 to 127.0.0.1:33948 length 20 radtest output: # radtest wyx1 wyx1 127.0.0.1 0 testing123 Sending Access-Request Id 127 from 0.0.0.0:38206 to 127.0.0.1:1812 User-Name = 'wyx1' User-Password = 'wyx1' NAS-IP-Address = 10.44.55.2 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 127 from 127.0.0.1:1812 to 127.0.0.1:38206 length 20 radius -X output: Received Access-Request Id 32 from 127.0.0.1:46310 to 127.0.0.1:1812 length 44 User-Name = 'wyx1' User-Password = 'wyx1' (6) Received Access-Request packet from host 127.0.0.1 port 46310, id=32, length=44 (6) User-Name = 'wyx1' (6) User-Password = 'wyx1' (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) if (!&User-Name) (6) if (!&User-Name) -> FALSE (6) if (&User-Name =~ / /) (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@.*@/ ) (6) if (&User-Name =~ /@.*@/ ) -> FALSE (6) if (&User-Name =~ /\\.\\./ ) (6) if (&User-Name =~ /\\.\\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\\.$/) (6) if (&User-Name =~ /\\.$/) -> FALSE (6) if (&User-Name =~ /(a)\\./) (6) if (&User-Name =~ /(a)\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [preprocess] = ok (6) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (6) auth_log : --> /var/log/radius/radacct/ 127.0.0.1/auth-detail-20170327 (6) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20170327 (6) auth_log : EXPAND %t (6) auth_log : --> Mon Mar 27 00:53:15 2017 (6) [auth_log] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : Checking for suffix after "@" (6) suffix : No '@' in User-Name = "wyx1", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : No EAP-Message, not doing EAP (6) [eap] = noop (6) sql : EXPAND %{User-Name} (6) sql : --> wyx1 (6) sql : SQL-User-Name set to 'wyx1' rlm_sql (sql): Reserved connection (7) (6) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (6) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wyx1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wyx1' ORDER BY id' (6) sql : User found in radcheck table (6) sql : Check items matched (6) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (6) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wyx1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wyx1' ORDER BY id' (6) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (6) sql : --> SELECT groupname FROM radusergroup WHERE username = 'wyx1' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'wyx1' ORDER BY priority' (6) sql : User not found in any groups rlm_sql (sql): Released connection (7) rlm_sql (sql): 0 of 3 connections in use. Need more spares rlm_sql (sql): Opening additional connection (8) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (sql): Closing connection (6): Hit idle_timeout, was idle for 933 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 967 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket (6) [sql] = ok (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = updated (6) } # authorize = updated (6) Found Auth-Type = PAP (6) # Executing group from file /etc/raddb/sites-enabled/default (6) Auth-Type PAP { (6) pap : Login attempt with password (6) pap : User authenticated successfully (6) [pap] = ok (6) } # Auth-Type PAP = ok (6) # Executing section post-auth from file /etc/raddb/sites-enabled/default (6) post-auth { (6) reply_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (6) reply_log : --> /var/log/radius/radacct/ 127.0.0.1/reply-detail-20170327 (6) reply_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/reply-detail-20170327 (6) reply_log : EXPAND %t (6) reply_log : --> Mon Mar 27 00:53:15 2017 (6) [reply_log] = ok (6) sql : EXPAND .query (6) sql : --> .query (6) sql : Using query template 'query' rlm_sql (sql): Reserved connection (8) (6) sql : EXPAND %{User-Name} (6) sql : --> wyx1 (6) sql : SQL-User-Name set to 'wyx1' (6) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (6) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wyx1', 'wyx1', 'Access-Accept', '2017-03-27 00:53:15') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wyx1', 'wyx1', 'Access-Accept', '2017-03-27 00:53:15')' rlm_sql (sql): Released connection (8) (6) [sql] = ok (6) [exec] = noop (6) remove_reply_message_if_eap remove_reply_message_if_eap { (6) if (&reply:EAP-Message && &reply:Reply-Message) (6) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (6) else else { (6) [noop] = noop (6) } # else else = noop (6) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (6) } # post-auth = ok (6) Sending Access-Accept packet to host 127.0.0.1 port 46310, id=32, length=0 Sending Access-Accept Id 32 from 127.0.0.1:1812 to 127.0.0.1:46310 (6) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (6) Cleaning up request packet ID 32 with timestamp +1053 Ready to process requests Now, everything seems fine. But when I use the same account to connect the pptp server, it says Authentication failed: Received Access-Request Id 232 from 127.0.0.1:39104 to 127.0.0.1:1812 length 65 Service-Type = Framed-User Framed-Protocol = PPP User-Name = 'wyx1' Calling-Station-Id = '117.73.147.49' NAS-IP-Address = 10.44.55.2 NAS-Port = 0 (7) Received Access-Request packet from host 127.0.0.1 port 39104, id=232, length=65 (7) Service-Type = Framed-User (7) Framed-Protocol = PPP (7) User-Name = 'wyx1' (7) Calling-Station-Id = '117.73.147.49' (7) NAS-IP-Address = 10.44.55.2 (7) NAS-Port = 0 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (!&User-Name) (7) if (!&User-Name) -> FALSE (7) if (&User-Name =~ / /) (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@.*@/ ) (7) if (&User-Name =~ /@.*@/ ) -> FALSE (7) if (&User-Name =~ /\\.\\./ ) (7) if (&User-Name =~ /\\.\\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\\.$/) (7) if (&User-Name =~ /\\.$/) -> FALSE (7) if (&User-Name =~ /(a)\\./) (7) if (&User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [preprocess] = ok (7) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (7) auth_log : --> /var/log/radius/radacct/ 127.0.0.1/auth-detail-20170327 (7) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20170327 (7) auth_log : EXPAND %t (7) auth_log : --> Mon Mar 27 00:56:06 2017 (7) [auth_log] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "wyx1", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : No EAP-Message, not doing EAP (7) [eap] = noop (7) sql : EXPAND %{User-Name} (7) sql : --> wyx1 (7) sql : SQL-User-Name set to 'wyx1' rlm_sql (sql): Reserved connection (8) (7) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (7) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wyx1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wyx1' ORDER BY id' (7) sql : User found in radcheck table (7) sql : Check items matched (7) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (7) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wyx1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wyx1' ORDER BY id' (7) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (7) sql : --> SELECT groupname FROM radusergroup WHERE username = 'wyx1' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'wyx1' ORDER BY priority' (7) sql : User not found in any groups rlm_sql (sql): Released connection (8) rlm_sql (sql): 0 of 2 connections in use. Need more spares rlm_sql (sql): Opening additional connection (9) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 171 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket (7) [sql] = ok (7) [expiration] = noop (7) [logintime] = noop (7) pap : No cleartext password in the request. Not performing PAP (7) [pap] = noop (7) } # authorize = ok (7) WARNING: Please update your configuration, and remove 'Auth-Type = Local' (7) WARNING: Use the PAP or CHAP modules instead (7) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/raddb/sites-enabled/default (7) Post-Auth-Type REJECT { (7) sql : EXPAND .query (7) sql : --> .query (7) sql : Using query template 'query' rlm_sql (sql): Reserved connection (9) (7) sql : EXPAND %{User-Name} (7) sql : --> wyx1 (7) sql : SQL-User-Name set to 'wyx1' (7) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (7) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wyx1', '', 'Access-Reject', '2017-03-27 00:56:06') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wyx1', '', 'Access-Reject', '2017-03-27 00:56:06')' rlm_sql (sql): Released connection (9) (7) [sql] = ok (7) attr_filter.access_reject : EXPAND %{User-Name} (7) attr_filter.access_reject : --> wyx1 (7) attr_filter.access_reject : Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (7) [eap] = noop (7) remove_reply_message_if_eap remove_reply_message_if_eap { (7) if (&reply:EAP-Message && &reply:Reply-Message) (7) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (7) else else { (7) [noop] = noop (7) } # else else = noop (7) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (7) } # Post-Auth-Type REJECT = updated (7) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (7) Sending delayed response (7) Sending Access-Reject packet to host 127.0.0.1 port 39104, id=232, length=0 Sending Access-Reject Id 232 from 127.0.0.1:1812 to 127.0.0.1:39104 Waking up in 3.9 seconds. (7) Cleaning up request packet ID 232 with timestamp +1224 Ready to process requests And the responding pptp log: Mar 27 00:56:06 iZ2597ft3dqZ pptpd[23202]: CTRL: Client control connection started Mar 27 00:56:06 iZ2597ft3dqZ pptpd[23202]: CTRL: Starting call (launching pppd, opening GRE) Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Plugin radius.so loaded. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: RADIUS plugin initialized. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Plugin radattr.so loaded. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: RADATTR plugin initialized. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Plugin /usr/lib64/pptpd/pptpd-logwtmp.so loaded. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: pptpd-logwtmp: $Version$ Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: pppd 2.4.5 started by root, uid 0 Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Using interface ppp0 Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Connect: ppp0 <--> /dev/pts/0 Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: rc_avpair_new: unknown attribute 11 Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: rc_avpair_new: unknown attribute 25 Mar 27 00:56:07 iZ2597ft3dqZ pppd[23203]: Peer wyx1 failed CHAP authentication Mar 27 00:56:07 iZ2597ft3dqZ pptpd[23202]: CTRL: EOF or bad error reading ctrl packet length. Mar 27 00:56:07 iZ2597ft3dqZ pptpd[23202]: CTRL: couldn't read packet header (exit) Mar 27 00:56:07 iZ2597ft3dqZ pptpd[23202]: CTRL: CTRL read failed Mar 27 00:56:07 iZ2597ft3dqZ pppd[23203]: Modem hangup Mar 27 00:56:07 iZ2597ft3dqZ pppd[23203]: Connection terminated. Mar 27 00:56:07 iZ2597ft3dqZ pppd[23203]: Exit. Mar 27 00:56:07 iZ2597ft3dqZ pptpd[23202]: CTRL: Client control connection finished config file: # cat /etc/raddb/clients.conf: client localhost { ipaddr = 127.0.0.1 proto = * secret = testing123 require_message_authenticator = no limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = testing123 } # cat /etc/raddb/radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} db_dir = ${localstatedir}/lib/radiusd libdir = /usr/lib64/freeradius pidfile = ${run_dir}/${name}.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 hostname_lookups = no log { destination = files colourise = yes file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } checkrad = ${sbindir}/checkrad security { user = radiusd group = radiusd allow_core_dumps = no max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 auto_limit_acct = no } modules { $INCLUDE mods-enabled/ } instantiate { } policy { $INCLUDE policy.d/ } $INCLUDE sites-enabled/ cat /etc/raddb/users bob Cleartext-Password := "hello" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP cat /etc/raddb/site-enabled/default server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { filter_username preprocess auth_log chap mschap digest suffix eap { ok = return } sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest eap } preacct { preprocess acct_unique suffix } accounting { detail unix sql exec attr_filter.accounting_response } session { radutmp sql } post-auth { reply_log sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } } pre-proxy { } post-proxy { eap } } # cat /etc/ppp/options.pptpd name pptpd refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 ms-dns 8.8.8.8 ms-dns 8.8.4.4 proxyarp debug lock nobsdcomp novj novjccomp nologfd plugin radius.so plugin radattr.so radius-config-file /etc/radiusclient-ng/radiusclient.conf # cat /usr/share/radiusclient-ng/dictionary # grep -v "#" dictionary | grep -v ^$ ATTRIBUTE User-Name 1 string ATTRIBUTE Password 2 string ATTRIBUTE CHAP-Password 3 string ATTRIBUTE NAS-IP-Address 4 ipaddr ATTRIBUTE NAS-Port-Id 5 integer ATTRIBUTE Service-Type 6 integer ATTRIBUTE Framed-Protocol 7 integer ATTRIBUTE Framed-IP-Address 8 ipaddr ATTRIBUTE Framed-IP-Netmask 9 ipaddr ATTRIBUTE Framed-Routing 10 integer ATTRIBUTE Filter-Id 11 string ATTRIBUTE Framed-MTU 12 integer ATTRIBUTE Framed-Compression 13 integer ATTRIBUTE Login-IP-Host 14 ipaddr ATTRIBUTE Login-Service 15 integer ATTRIBUTE Login-TCP-Port 16 integer ATTRIBUTE Reply-Message 18 string ATTRIBUTE Callback-Number 19 string ATTRIBUTE Callback-Id 20 string ATTRIBUTE Framed-Route 22 string ATTRIBUTE Framed-IPX-Network 23 ipaddr ATTRIBUTE State 24 string ATTRIBUTE Class 25 string ATTRIBUTE Vendor-Specific 26 string ATTRIBUTE Session-Timeout 27 integer ATTRIBUTE Idle-Timeout 28 integer ATTRIBUTE Termination-Action 29 integer ATTRIBUTE Called-Station-Id 30 string ATTRIBUTE Calling-Station-Id 31 string ATTRIBUTE NAS-Identifier 32 string ATTRIBUTE Proxy-State 33 string ATTRIBUTE Login-LAT-Service 34 string ATTRIBUTE Login-LAT-Node 35 string ATTRIBUTE Login-LAT-Group 36 string ATTRIBUTE Framed-AppleTalk-Link 37 integer ATTRIBUTE Framed-AppleTalk-Network 38 integer ATTRIBUTE Framed-AppleTalk-Zone 39 string ATTRIBUTE Acct-Status-Type 40 integer ATTRIBUTE Acct-Delay-Time 41 integer ATTRIBUTE Acct-Input-Octets 42 integer ATTRIBUTE Acct-Output-Octets 43 integer ATTRIBUTE Acct-Session-Id 44 string ATTRIBUTE Acct-Authentic 45 integer ATTRIBUTE Acct-Session-Time 46 integer ATTRIBUTE Acct-Input-Packets 47 integer ATTRIBUTE Acct-Output-Packets 48 integer ATTRIBUTE Acct-Terminate-Cause 49 integer ATTRIBUTE Acct-Multi-Session-Id 50 string ATTRIBUTE Acct-Link-Count 51 integer ATTRIBUTE Event-Timestamp 55 integer ATTRIBUTE CHAP-Challenge 60 string ATTRIBUTE NAS-Port-Type 61 integer ATTRIBUTE Port-Limit 62 integer ATTRIBUTE Login-LAT-Port 63 integer ATTRIBUTE Connect-Info 77 string ATTRIBUTE NAS-IPv6-Address 95 string ATTRIBUTE Framed-Interface-Id 96 string ATTRIBUTE Framed-IPv6-Prefix 97 string ATTRIBUTE Login-IPv6-Host 98 string ATTRIBUTE Framed-IPv6-Route 99 string ATTRIBUTE Framed-IPv6-Pool 100 string ATTRIBUTE Huntgroup-Name 221 string ATTRIBUTE User-Category 1029 string ATTRIBUTE Group-Name 1030 string ATTRIBUTE Simultaneous-Use 1034 integer ATTRIBUTE Strip-User-Name 1035 integer ATTRIBUTE Fall-Through 1036 integer ATTRIBUTE Add-Port-To-IP-Address 1037 integer ATTRIBUTE Exec-Program 1038 string ATTRIBUTE Exec-Program-Wait 1039 string ATTRIBUTE Hint 1040 string ATTRIBUTE Expiration 21 date ATTRIBUTE Auth-Type 1000 integer ATTRIBUTE Menu 1001 string ATTRIBUTE Termination-Menu 1002 string ATTRIBUTE Prefix 1003 string ATTRIBUTE Suffix 1004 string ATTRIBUTE Group 1005 string ATTRIBUTE Crypt-Password 1006 string ATTRIBUTE Connect-Rate 1007 integer VALUE Service-Type Login-User 1 VALUE Service-Type Framed-User 2 VALUE Service-Type Callback-Login-User 3 VALUE Service-Type Callback-Framed-User 4 VALUE Service-Type Outbound-User 5 VALUE Service-Type Administrative-User 6 VALUE Service-Type NAS-Prompt-User 7 VALUE Framed-Protocol PPP 1 VALUE Framed-Protocol SLIP 2 VALUE Framed-Routing None 0 VALUE Framed-Routing Broadcast 1 VALUE Framed-Routing Listen 2 VALUE Framed-Routing Broadcast-Listen 3 VALUE Framed-Compression None 0 VALUE Framed-Compression Van-Jacobson-TCP-IP 1 VALUE Login-Service Telnet 0 VALUE Login-Service Rlogin 1 VALUE Login-Service TCP-Clear 2 VALUE Login-Service PortMaster 3 VALUE Acct-Status-Type Start 1 VALUE Acct-Status-Type Stop 2 VALUE Acct-Status-Type Alive 3 VALUE Acct-Status-Type Accounting-On 7 VALUE Acct-Status-Type Accounting-Off 8 VALUE Acct-Authentic RADIUS 1 VALUE Acct-Authentic Local 2 VALUE Acct-Authentic PowerLink128 100 VALUE Termination-Action Default 0 VALUE Termination-Action RADIUS-Request 1 VALUE NAS-Port-Type Async 0 VALUE NAS-Port-Type Sync 1 VALUE NAS-Port-Type ISDN 2 VALUE NAS-Port-Type ISDN-V120 3 VALUE NAS-Port-Type ISDN-V110 4 VALUE Acct-Terminate-Cause User-Request 1 VALUE Acct-Terminate-Cause Lost-Carrier 2 VALUE Acct-Terminate-Cause Lost-Service 3 VALUE Acct-Terminate-Cause Idle-Timeout 4 VALUE Acct-Terminate-Cause Session-Timeout 5 VALUE Acct-Terminate-Cause Admin-Reset 6 VALUE Acct-Terminate-Cause Admin-Reboot 7 VALUE Acct-Terminate-Cause Port-Error 8 VALUE Acct-Terminate-Cause NAS-Error 9 VALUE Acct-Terminate-Cause NAS-Request 10 VALUE Acct-Terminate-Cause NAS-Reboot 11 VALUE Acct-Terminate-Cause Port-Unneeded 12 VALUE Acct-Terminate-Cause Port-Preempted 13 VALUE Acct-Terminate-Cause Port-Suspended 14 VALUE Acct-Terminate-Cause Service-Unavailable 15 VALUE Acct-Terminate-Cause Callback 16 VALUE Acct-Terminate-Cause User-Error 17 VALUE Acct-Terminate-Cause Host-Request 18 VALUE Auth-Type Local 0 VALUE Auth-Type System 1 VALUE Auth-Type SecurID 2 VALUE Auth-Type Crypt-Local 3 VALUE Auth-Type Reject 4 VALUE Auth-Type Pam 253 VALUE Auth-Type Accept 254 VALUE Fall-Through No 0 VALUE Fall-Through Yes 1 VALUE Add-Port-To-IP-Address No 0 VALUE Add-Port-To-IP-Address Yes 1 INCLUDE /usr/share/radiusclient-ng/dictionary.merit INCLUDE /usr/share/radiusclient-ng/dictionary.microsoft INCLUDE /usr/share/radiusclient-ng/dictionary.ascend INCLUDE /usr/share/radiusclient-ng/dictionary.compat I have googled a lot, but no big progress, any help is appreciated.

2 2

Re: iOS mysterious issues on Freeradius 3.0.14
by Igor Sousa 24 Mar '17

24 Mar '17

Hi, iOS issues in my network aren't related with certs. I think it because TLS tunnel was established successful. I don' understand why it happens only iOS devices. Alan DeKok-2 <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=user…> wrote if I turned off session resumption. I've search in eap config about "session resumption" and I've find in "cache" block. To disable session resumption is only change attribute on "enable" field to "no" like example below? In my case this field "enable" is "yes". cache { # # Enable it. The default is "no". Deleting the entire "cache" # subsection also disables caching. # # You can disallow resumption for a particular user by adding the # following attribute to the control item list: # # Allow-Session-Resumption = No # # If "enable = no" below, you CANNOT enable resumption for just one # user by setting the above attribute to "yes". # #enable = yes enable = no Glad to your help,

1 0

RE: iOS mysterious issues on Freeradius 3.0.14
by Peter Hutchison 24 Mar '17

24 Mar '17

>I've read a lot messages in Freeradius Forum and I continued misunderstand why iOS devices (iPhone, iPad) doesn't connect in my >WPA-Enterprise wifi network. I've installed and configured a freeradius server, version 3.0.14, over openssl 1.1.0e (both have >installed from sources on Debian 8). I've tested connect Android devices to my wifi network and everytime they can connect to >the network, but iOS devices have mysterious issues. With PEAP you should *always* use Publicly recognised TLS/SSL certificates, preferably with a well-known CA source or one that your University supports. Also it should be at least 2048 bits and uses the SHA256 hash algorithm, SHA1 should be phased out. For example, we use JISC service which uses Quo Vadis CA. Do not use self-signed or internal CA certificates. >When I try connect iOS device to my wifi in first time, they can connect perfectly. Though, if this same iOS device lost >connection (because it's out of range AP signal or air plane mode turn on by the user for 30 minutes or hours) and try connect >again the device doesn't connect. When I've saw the debug mode, I've noticed that EAP-PEAP tunnel athentication was successful >and server sent Access-Challenge, but device doesn't answer this challenge. I don't understand why the android devices doesn't >this issues. > Maybe it's related to session resumption? Have you turned that off? When switched between Aps, session resumption should be enabled to provide seemless connections. The APS should be using the same SSIDs and Peter Hutchison MCP Senior Network Systems SpecialistS S 01484 473716 Networks Team University of Huddersfield | Queensgate | Huddersfield | HD1 3DH University of Huddersfield inspiring tomorrow's professionals. [http://marketing.hud.ac.uk/_HOSTED/EmailSig2014/EmailSigFooter.jpg] This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

8 22

Certificates issue in android terminals (EAP-TLS)
by Daniel Lopez 24 Mar '17

24 Mar '17

Hello. This problem is not specifically of freeradius but maybe someone can help me. After a painful process I finally got my Freeradius 2.2.8 server to run with only EAP-TLS authentication (my experience with freeradius is still short). But I've found a problem: when I install ca and user certificates in an antroid terminal all goes well first time i connect, but if I restart the device, or even if I switch from a wifi conection to another, or i set "forget" the conection, my device loses the certificates, so i have to install it again in order to access the network, it happens me with various devices of different models and brands, after i google it a little i've found some people with the same problem, but no solution. Could anyone help me with this issue? What is causing this behaviour? Has anyone a succesfull experience with eap-tls and android devices? Any help will be appretiated. Thanks in advance.

4 5

Re: RadPerf '-A delay,lifetime' arg does not copy the 'Calling-Station-Id' from Accept-Request
by Jay Cedrone (jcedrone) 24 Mar '17

24 Mar '17

Do you have any information on how to have radperf send a calling station ID? Attribute 31. Thanks a lot, - Jay

1 0

3.0.4: binary LDAP attributes
by Nikolai Kondrashov 24 Mar '17

24 Mar '17

Hi everyone, Our (Red Hat) QA was testing the effect of this entry in 3.0.4 ChangeLog: * Modify pairparsevalue to deal with embedded NULLs better, and use the binary versions of attribute values in rlm_ldap. They have noticed that binary LDAP values get truncated on embedded zero characters (\0) in RADIUS replies, in radiusReplyMessage in particular. I.e. for radiusReplyMessage:: cmVwbHkgd2l0aCBhAGI= The response output by radtest was Reply-Message = 'reply with a' The network capture also showed that RADIUS reply packets contained truncated values. Is this intended, or was there a fix for this? In related discoveries, it seems that backslashes get removed from LDAP attribute values in RADIUS replies, so radiusReplyMessage: reply with a\0b becomes Reply-Message = 'reply with a0b' in radtest output. Is this intended? Thank you. Nick

4 12