- Freeradius-Users - lists.freeradius.org

eap_peap: fatal access_denied error
by mustafa mujahid 11 Mar '17

11 Mar '17

Hello all, I've been trying to authentication LAN on Cisco 2960 Switch. I've done configurations with PAP but this is the first time working with EAP. I have run into a bit of an issue. I receive a 'fatal :access denied error' in the debug log while testing with a single client. Radius version is 3.0.12 Please find full debug log attached as it was quite long, along with my defaults file , eap module file and inner tunnel. the Error as shown in debug output : (6) Received Access-Request Id 111 from 10.10.99.5:1645 to 115.186.154.51:1812 length 208 (6) User-Name = "inzamam.shafiq" (6) Service-Type = Framed-User (6) Framed-MTU = 1500 (6) Called-Station-Id = "F4-1F-C2-29-F2-04" (6) Calling-Station-Id = "5C-B9-01-40-7A-51" (6) EAP-Message = 0x0207002f1980000000251503010020c16512711bcb968946945393a285231d100f4ad033f9b228472d29b6fe0f9330 (6) Message-Authenticator = 0xe7d930474f3ffad35c235370b081c91f (6) NAS-Port-Type = Ethernet (6) NAS-Port = 50004 (6) NAS-Port-Id = "FastEthernet0/4" (6) State = 0x83dbc94886dcd087405afa3e400f12a5 (6) NAS-IP-Address = 10.10.99.5 (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) [preprocess] = ok (6) auth_log: EXPAND /var/log/radius/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (6) auth_log: --> /var/log/radius/log/radius/radacct/10.10.99.5/auth-detail-20170308 (6) auth_log: /var/log/radius/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/log/radius/radacct/10.10.99.5/auth-detail-20170308 (6) auth_log: EXPAND %t (6) auth_log: --> Wed Mar 8 11:05:41 2017 (6) [auth_log] = ok (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "inzamam.shafiq", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 7 length 47 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/raddb/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x83dbc94886dcd087 (6) eap: Finished EAP session with state 0x83dbc94886dcd087 (6) eap: Previous EAP request found for state 0x83dbc94886dcd087, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: Peer indicated complete TLS record size will be 37 bytes (6) eap_peap: Got complete TLS record (37 bytes) (6) eap_peap: [eaptls verify] = length included (6) eap_peap: <<< recv TLS 1.0 Alert [length 0002], fatal access_denied (6) eap_peap: ERROR: TLS Alert read:fatal:access denied (6) eap_peap: WARNING: No data inside of the tunnel (6) eap_peap: [eaptls process] = ok (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state ? (6) eap_peap: ERROR: Tunneled data is invalid (6) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (6) eap: Sending EAP Failure (code 4) ID 7 length 4 (6) eap: Failed in EAP select (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user (6) Using Post-Auth-Type Reject (6) # Executing group from file /etc/raddb/sites-enabled/default (6) Post-Auth-Type REJECT { (6) sql: EXPAND .query (6) sql: --> .query (6) sql: WARNING: No such configuration item .query (6) [sql] = noop (6) } # Post-Auth-Type REJECT = noop (6) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (6) Sending delayed response (6) Sent Access-Reject Id 111 from 115.186.154.51:1812 to 10.10.99.5:1645 length 44 (6) EAP-Message = 0x04070004 (6) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 105 with timestamp +9 (1) Cleaning up request packet ID 106 with timestamp +9 (2) Cleaning up request packet ID 107 with timestamp +9 (3) Cleaning up request packet ID 108 with timestamp +10 (4) Cleaning up request packet ID 109 with timestamp +10 (5) Cleaning up request packet ID 110 with timestamp +10 (6) Cleaning up request packet ID 111 with timestamp +10 Ready to process requests I read that radius works with EAP out of the box. I'm sorry I don't have more troubleshooting info as I couldnt figure out how to move forward from here. If I could be pointed in the right direction it would be greatly appreciated. Please let me know if further information is required. BR/Mustafa.

3 8

Issue with 3.0.13 upgrade
by Antoine JOUBERT 10 Mar '17

10 Mar '17

Hi, I've encountered an issue while trying to upgrade one of my freeradius servers from 3.0.12 to 3.0.13. I've done the following to reproduce the issue. I've installed freeradius 3.0.12 on a new server from compiled debian packages : version=3.0.12 dpkg -i freeradius_${version}+git_amd64.deb freeradius-common_${version}+git_all.deb freeradius-config_${version}+git_amd64.deb freeradius-utils_${version}+git_amd64.deb libfreeradius3_${version}+git_amd64.deb After the install, the daemon runs fine : pgrep -alf radius 17866 /usr/sbin/freeradius I've then tried to upgrade it to 3.0.13, from compiled debian packages as well : version=3.0.13 dpkg -i freeradius_${version}+git_amd64.deb freeradius-common_${version}+git_all.deb freeradius-config_${version}+git_amd64.deb freeradius-utils_${version}+git_amd64.deb libfreeradius3_${version}+git_amd64.deb [...] Checking FreeRADIUS daemon configuration...failed (The server is not configured to listen on any ports. Cannot start). [...] After the upgrade, the mods-enabled and sites-enabled folders are empty : ll /etc/freeradius/mods-enabled total 0 ll /etc/freeradius/sites-enabled total 0 Is anybody else having issues upgrading to 3.0.13 ? Any idea what could be causing this ? Thanks ! Regards, Antoine

3 3

Any training sessions available for understanding and configuring radius server
by bbnlradius 10 Mar '17

10 Mar '17

Hi, Can any one please do let me know if there is any good classes available for administration/performance tuning/HA etc. Thanks Arun

2 1

default authentication via windows active directory LDAP instead of /users
by Konstantin Knaab-Hinrichs 09 Mar '17

09 Mar '17

Hi, I sucessfully set up a Debian 8 Server with FreeRadius and radtest can successfully authenticate users with cleartext passwords written into /users. I followed https://ttboa.wordpress.com/2014/09/26/freeradius-on-debian-7/ up to "Basic Authentication" and configured radiusd.conf following this - but without user credentials for the LDAP as the server accepts anonymous queries. https://www.clearos.com/resources/documentation/clearos/ content:en_us:kb_howtos_setting_up_radius_to_use_ldap However radtest still rejects valid LDAP credentials. users contains: "DEFAULT Ldap-Group == "dc=DOMAIN,dc=TLD" to accept the whole LDAP. the basedn entry and the servers IP in modules/ldap have also been customized and the LDAP server replies to a ping. Freeradius currently runs via "radiusd -X" as the service seems not yet ready. Is it possible to first query the LDAP and then secondly ask /users for credentials? Yours, Konstantin

4 13

Problem with certificates on Version 3.0.12
by Rob Rutledge 08 Mar '17

08 Mar '17

Hello all, I have successfully installed and have running FreeRADIUS Version 3.0.12. I have been able to use PAP to authenticate fine with all my network devices, i.e. Cisco. I am however having problems authenticating wireless clients on a Cisco 1142N autonomous access-point. I followed the instructions I found advising to set up open WEP authentication with EAP. The problem I am having is installing the certificates in the /etc/raddb/certs/ directory. The instructions I found advised to install the ca.der and client.p12 certificates on my wireless workstation, Windows 10 Pro. When I try to install the ca certificate I get the following window pops up: When I try to install the client certificate this window pops up: It appeared that the .pem files installed as certificates, but when I try to authenticate to the SSID in question I get the following debug outputs in my Cisco AP: Mar 8 10:49:03.265 CST: (0000.0000.0000): dot11_auth: client is added to the client list for application 0x1 Mar 8 10:49:03.265 CST: (0000.0000.0000): dot11_auth: Created new client for application 0x1 Mar 8 10:49:03.265 CST: (0000.0000.0000): dot11_auth: req->auth_type 0 Mar 8 10:49:03.265 CST: (0000.0000.0000): dot11_auth: auth_methods_inprocess: 2 Mar 8 10:49:03.265 CST: (0000.0000.0000): dot11_auth: eap list name: eap_methods Mar 8 10:49:03.265 CST: (0000.0000.0000): dot11_auth: Start auth method EAP or LEAP Mar 8 10:49:03.265 CST: (0000.0000.0000): dot11_auth_dot1x: in the dot11_auth_dot1x_start Mar 8 10:49:03.265 CST: (0000.0000.0000): dot11_dot1x: Sending identity request to client Mar 8 10:49:03.265 CST: EAPOL pak dump tx Mar 8 10:49:03.265 CST: EAPOL Version: 0x1 type: 0x0 length: 0x003D Mar 8 10:49:03.265 CST: EAP code: 0x1 id: 0x1 length: 0x003D type: 0x1 06021490: 0100003D 0101003D 01006E65 74776F72 ...=...=..networ 060214A0: 6B69643D 42696742 616E675F 322C6E61 kid=BigBang_2,na 060214B0: 7369643D 74787765 61686F6D 78702D61 sid=txweahomxp-a 060214C0: 70313134 32303031 2C706F72 7469643D p1142001,portid= 060214D0: 30 0 Mar 8 10:49:03.266 CST: (0000.0000.0000): dot11_auth: sending data to requestor status 1 txweahomxp-ap1142001# Mar 8 10:49:03.266 CST: (0000.0000.0000): dot11_auth: Sending EAPOL to requestor Mar 8 10:49:03.266 CST: (0000.0000.0000): dot11_dot1x: Client timer started for 30 seconds The timer just keeps timing out and repeats itself until I disconnect the SSID and running FreeRADIUS in the debug mode I never see any activity in the debug outputs. Therefore I am to assume that the wireless client bridging through the ap is never even trying to talk to the FreeRADIUS server. I can however change the encryption methods in the AP for this SSID and it will authenticate. I have to configure the encryption mode ciphers for the SSID VLAN in the radio configuration and then set up for key-management authentication wpa version 2 in the SSID configuration and the wireless client authenticates through the FreeRADIUS server. When I set it up this way though I am requested to enter username/password combination and accept the certificate ( I would assume this is the certificate from the server to be validated) before the connection process completes. What concerns me is that I see two warnings come up in the FreeRADIUS debug logs: (33) WARNING: Outer and inner identities are the same. User privacy is compromised. (33) pap: WARNING: Auth-Type already set. Not setting to PAP Via this method I see that the Outer identity has the username I entered when I connected instead of anonymous. In addition I see that PEAP is being used for the authentication process in the debug logs: (34) eap: Peer sent packet with method EAP PEAP (25) (34) eap: Calling submodule eap_peap to process data (34) eap_peap: Continuing EAP-TLS (34) eap_peap: [eaptls verify] = ok (34) eap_peap: Done initial handshake (34) eap_peap: [eaptls process] = ok (34) eap_peap: Session established. Decoding tunneled attributes (34) eap_peap: PEAP state send tlv success (34) eap_peap: Received EAP-TLV response (34) eap_peap: Success I believe a lot of this information is superfluous for the purposes of this post, but my main question would be why can't I install the certificates from the /certs/ directory? Thanks for any and all help. Rob Rutledge, CCNP CCDP

2 1

Request number (request->number) as internal variable
by Peter Balsianok 08 Mar '17

08 Mar '17

Hi, Don't you plan to add new internal variable for request->number ? It could be used for linelog and also in modules (mod_perl). Better finding log messages belong to some request. Thank you very much

2 2

(rlm_perl ): "has_tag" value missing in debug mode
by Peter Balsianok 08 Mar '17

08 Mar '17

Hi, src/modules/rlm_perl/rlm_perl.c The module doesnt show "has_tag" value in debug mode. Line 712: RDEBUG("$%s{'%s'} = &%s:%s -> '%s'", hash_name, vp->da->name, list_name, vp->da->name, vp->vp_strvalue); change to RDEBUG("$%s{'%s'} = &%s:%s -> '%s'", hash_name, name, list_name, name, vp->vp_strvalue);

1 0

multiple EAP handler faillure | FreeRADIUS Version 3.0.11
by Johnny R 08 Mar '17

08 Mar '17

Dear List, Didn't really want to escalate this to the list and already "tried harder" but didn't find a way around it. Is it a "NAS" issue (a timer may be), or a messed up "client" (windows 7), or just me and my beloved FreeRadius server :D ... Here comes the issue: *Tue Mar 7 08:47:09 2017 : Debug: (145) eap: Expiring EAP session with state 0x4b5adc8a484dc5f7Tue Mar 7 08:47:09 2017 : Error: rlm_eap (EAP): No EAP session matching state 0x46f070be47e96990Tue Mar 7 08:47:09 2017 : Debug: (145) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-requestTue Mar 7 08:47:09 2017 : Debug: (145) eap: Failed in handler* similar log as the above ones are seen many times within the log. I thought that it was related to the timer but already adjusted that one ... and it comes back, bumping my head: *eap { default_eap_type = peap timer_expire = 120 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = ${max_requests} tls-config tls-common { private_key_password = my_ultra_complicated_password_heh private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh* so I tried to find out what is really going on between the NAS and supplicant, and I noticed that the client is not responding to the "Access-Challenge" sent by server, but it looks like it is trying to renew the "Access-Request" it sent earlier. If someone could give a hint or encoutered the same issue ... it would really help! Regards v4s[at]#unrelated | "sh3ll is just the beginning"

2 2

EAP-TLS, session resumption and OCSP
by Stefan Winter 07 Mar '17

07 Mar '17

Hello, we are curently testing a large-scale rollout of EAP-TLS for eduroam purposes. One of the things we observed is that if an authentication uses TLS session resumption, the server does not re-check the OCSP state of the client cert that was used to login initially. So, in a scenario where - cert is valid, user authenticates with a full EAP-TLS handshake - cert gets revoked - user re-authenticates with session resumption then the authentication does NOT fail but succeed. Looking at the TLS-Client-Cert-* attributes which get restored from session cache, it looks like it could be easy to do that though - the serial number of the cert is saved; and the OCSP responder URL maybe isn't but could be. And with both pieces of information, another OCSP check can be run even on a resumed session. A related question: how is the cache lifetime determined? When config sets it to 24 hours, is that 24 hours after the initial, full, authentication, or is that lifetime refreshed with every re-auth, meaning the cache expires after 24 hours of non-use? If the latter, a revoked user could perpetually prolong his account lifetime even if OCSP wouldn't want to let him. Also, something we didn't check but that just now comes to my mind: does the server check the expiry time of the cert on a resumed session? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

4 6

Glitches in the expr engine?
by Stefan Paetow 07 Mar '17

07 Mar '17

So today I had one of my sites deploy the new moonshot-targeted-ids file in the 3.0.x branch. Everything so far, so good. Then I ask him to use a random string as the salt (which contained a closing curly bracket). The output was definitely *not* what was expected. This example below (salt = 'changeme}') illustrates the problem: -- begin -- (13) policy moonshot_host_tid.post-auth { (13) if (&outer.request:GSS-Acceptor-Host-Name) { (13) if (&outer.request:GSS-Acceptor-Host-Name) -> TRUE (13) if (&outer.request:GSS-Acceptor-Host-Name) { (13) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}}" =~ /^([^ ]+)([ ]*)$/) { (13) Executing: /usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 steve(a)example.comchangeme: (13) Program returned code (0) and output '86b8d074-fe42-5dfa-b160-3fb770a96c98' (13) EXPAND %{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}} (13) --> 86b8d074-fe42-5dfa-b160-3fb770a96c98debian8.localdomain} (13) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}}" =~ /^([^ ]+)([ ]*)$/) -> TRUE (13) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}}" =~ /^([^ ]+)([ ]*)$/) { (13) update outer.session-state { (13) EXPAND %{1}@%{tolower:%{request:Realm}} (13) --> 86b8d074-fe42-5dfa-b160-3fb770a96c98debian8.localdomain}(a)example.com (13) Moonshot-Host-TargetedId := "86b8d074-fe42-5dfa-b160-3fb770a96c98debian8.localdomain}(a)example.com" (13) } # update outer.session-state = noop (13) } # if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme}%{tolower:%{outer.request:GSS-Acceptor-Host -Name}}}" =~ /^([^ ]+)([ ]*)$/) = noop (13) } # if (&outer.request:GSS-Acceptor-Host-Name) = noop (13) } # policy moonshot_host_tid.post-auth = noop (13) update { (13) &outer.session-state:EAP-Channel-Binding-Message += &reply:EAP-Channel-Binding-Message -> 0x02001b01a406686f7374a51564656269616e382e6c6f63616c646f6d61696e (13) &outer.session-state:EAP-Message += &reply:EAP-Message -> 0x03010004 (13) &outer.session-state:Message-Authenticator += &reply:Message-Authenticator -> 0x00000000000000000000000000000000 (13) &outer.session-state:Stripped-User-Name += &reply:Stripped-User-Name -> 'steve' (13) } # update = noop -- end -- So... What is the solution to this? Expect people to escape the curly brackets in the salt? If so, I'll update the documentation to say this. The below is the correct output, by the way: -- begin -- (29) post-auth { (29) policy moonshot_host_tid.post-auth { (29) if (&outer.request:GSS-Acceptor-Host-Name) { (29) if (&outer.request:GSS-Acceptor-Host-Name) -> TRUE (29) if (&outer.request:GSS-Acceptor-Host-Name) { (29) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}}" =~ /^([^ ]+)([ ]*)$/) { (29) Executing: /usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 steve(a)example.comchangeme\}debian8.localdomain: (29) Program returned code (0) and output '6467194a-b3f4-56b7-bd30-6f0afac50c65' (29) EXPAND %{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}} (29) --> 6467194a-b3f4-56b7-bd30-6f0afac50c65 (29) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}}" =~ /^([^ ]+)([ ]*)$/) -> TRUE (29) if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}}" =~ /^([^ ]+)([ ]*)$/) { (29) update outer.session-state { (29) EXPAND %{1}@%{tolower:%{request:Realm}} (29) --> 6467194a-b3f4-56b7-bd30-6f0afac50c65(a)example.com (29) Moonshot-Host-TargetedId := "6467194a-b3f4-56b7-bd30-6f0afac50c65(a)example.com" (29) } # update outer.session-state = noop (29) } # if ("%{echo:/usr/bin/uuid -v 5 a574a04e-b7ff-4850-aa24-a8599c7de1c6 %{tolower:%{User-Name}}changeme\}%{tolower:%{outer.request:GSS-Acceptor-Hos t-Name}}}" =~ /^([^ ]+)([ ]*)$/) = noop (29) } # if (&outer.request:GSS-Acceptor-Host-Name) = noop (29) } # policy moonshot_host_tid.post-auth = noop (29) update { (29) &outer.session-state:EAP-Channel-Binding-Message += &reply:EAP-Channel-Binding-Message -> 0x02001b01a406686f7374a51564656269616e382e6c6f63616c646f6d61696e (29) &outer.session-state:EAP-Message += &reply:EAP-Message -> 0x03010004 (29) &outer.session-state:Message-Authenticator += &reply:Message-Authenticator -> 0x00000000000000000000000000000000 (29) &outer.session-state:Stripped-User-Name += &reply:Stripped-User-Name -> 'steve' (29) } # update = noop -- end -- Advice gladly accepted :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

2 4