- Freeradius-Users - lists.freeradius.org

(802.1X) PEAPv0/EAP-MSCHAPv2 : duplicate access-request
by 3＠D4rkn3ss DuMb 21 Feb '17

21 Feb '17

Dear list, After sucessfuly deploying FreeRADIUS v.3.0.11 against an Active Directory 2008, everything seemed to be fine during the test (wired), but when something weird started to happen when I put the server in production. In fact, we noticted that some station (windows machine) just got kicked out randomnly and suddenly. We fired a packet analyzer and found out that the station got an access-reject from the radius server after a duplicate "access request". The following diagram describes a little bit what happened __________________________________________________________________________________________________________________________________________________________ *+-------------+ +------------+ +--------------+ +---------+| station + | | | | | AD 2008 || | cisco switch | freeradius| | || | | | | | | |+-------------+ +------------+ +--------------+ +---------+ <------------eap req-id----------------+ + +---------------eap resp-id------------> +---------------radius access-req------> <-------------eap request/eap-type + challenge <--------------radius access-challenge-+ + +-------------?-------------------------> +----radius access-req (duplicate)-----> radius access-reject <------------------------------------+* ____________________________________________________________________________________________________________________________________________________________ and the corresponding trace _____________________________________________________________________________________________________________________________________________________________ *No. Time Source Destination Protocol Length Info* * 4379 24010.421900 10.100.100.111 192.168.0.13 RADIUS 223 Access-Request(1) (id=120, l=181)* *Frame 4379: 223 bytes on wire (1784 bits), 223 bytes captured (1784 bits)* * Encapsulation type: Ethernet (1)* * Arrival Time: Feb 20, 2017 14:31:42.767734000 Afrique de l’Est* * [Time shift for this packet: 0.000000000 seconds]* * Epoch Time: 1487590302.767734000 seconds* * [Time delta from previous captured frame: 0.015441000 seconds]* * [Time delta from previous displayed frame: 0.015441000 seconds]* * [Time since reference or first frame: 24010.421900000 seconds]* * Frame Number: 4379* * Frame Length: 223 bytes (1784 bits)* * Capture Length: 223 bytes (1784 bits)* * [Frame is marked: False]* * [Frame is ignored: False]* * [Protocols in frame: eth:ethertype:ip:udp:radius:eap]* * [Coloring Rule Name: UDP]* * [Coloring Rule String: udp]* *Ethernet II, Src: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1), Dst: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Destination: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Address: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Source: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1)* * Address: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Type: IPv4 (0x0800)* *Internet Protocol Version 4, Src: 10.100.100.111, Dst: 192.168.0.13* * 0100 .... = Version: 4* * .... 0101 = Header Length: 20 bytes (5)* * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)* * 0000 00.. = Differentiated Services Codepoint: Default (0)* * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)* * Total Length: 209* * Identification: 0x6f80 (28544)* * Flags: 0x00* * 0... .... = Reserved bit: Not set* * .0.. .... = Don't fragment: Not set* * ..0. .... = More fragments: Not set* * Fragment offset: 0* * Time to live: 254* * Protocol: UDP (17)* * Header checksum: 0x1d13 [validation disabled]* * [Good: False]* * [Bad: False]* * Source: 10.100.100.111* * Destination: 192.168.0.13* * [Source GeoIP: Unknown]* * [Destination GeoIP: Unknown]* *User Datagram Protocol, Src Port: 1645 (1645), Dst Port: 1812 (1812)* * Source Port: 1645* * Destination Port: 1812* * Length: 189* * Checksum: 0xcad9 [validation disabled]* * [Good Checksum: False]* * [Bad Checksum: False]* * [Stream index: 0]* *RADIUS Protocol* * Code: Access-Request (1)* * Packet identifier: 0x78 (120)* * Length: 181* * Authenticator: 8e1e0033348fcf333cf84a46404d7d73* * [The response to this request is in frame 4380]* * Attribute Value Pairs* * AVP: l=24 t=User-Name(1): host/adminlp.aros.lan* * User-Name: host/adminlp.aros.lan* * AVP: l=6 t=Service-Type(6): Framed(2)* * Service-Type: Framed (2)* * AVP: l=6 t=Framed-MTU(12): 1500* * Framed-MTU: 1500* * AVP: l=19 t=Called-Station-Id(30): AC-7E-8A-7B-7B-A0* * Called-Station-Id: AC-7E-8A-7B-7B-A0* * AVP: l=19 t=Calling-Station-Id(31): C4-34-6B-54-C0-2C* * Calling-Station-Id: C4-34-6B-54-C0-2C* * AVP: l=8 t=EAP-Message(79) Last Segment[1]* * EAP fragment: 020800061900* * Extensible Authentication Protocol* * Code: Response (2)* * Id: 8* * Length: 6* * Type: Protected EAP (EAP-PEAP) (25)* * EAP-TLS Flags: 0x00* * 0... .... = Length Included: False* * .0.. .... = More Fragments: False* * ..0. .... = Start: False* * .... .000 = Version: 0* * AVP: l=18 t=Message-Authenticator(80): 5563952a01377f93d4e4a02c0dfa30f8* * Message-Authenticator: 5563952a01377f93d4e4a02c0dfa30f8* * AVP: l=2 t=EAP-Key-Name(102): * * EAP-Key-Name: * * AVP: l=6 t=NAS-Port-Type(61): Ethernet(15)* * NAS-Port-Type: Ethernet (15)* * AVP: l=6 t=NAS-Port(5): 50132* * NAS-Port: 50132* * AVP: l=23 t=NAS-Port-Id(87): GigabitEthernet1/0/32* * NAS-Port-Id: GigabitEthernet1/0/32* * AVP: l=18 t=State(24): 3a9592963b9d8bd01b3c353177f2a183* * State: 3a9592963b9d8bd01b3c353177f2a183* * AVP: l=6 t=NAS-IP-Address(4): 10.100.100.111* * NAS-IP-Address: 10.100.100.111* * No. Time Source Destination Protocol Length Info* * 4380 24010.423040 192.168.0.13 10.100.100.111 RADIUS 1116 Access-Challenge(11) (id=120, l=1074)* *Frame 4380: 1116 bytes on wire (8928 bits), 1116 bytes captured (8928 bits)* * Encapsulation type: Ethernet (1)* * Arrival Time: Feb 20, 2017 14:31:42.768874000 Afrique de l’Est* * [Time shift for this packet: 0.000000000 seconds]* * Epoch Time: 1487590302.768874000 seconds* * [Time delta from previous captured frame: 0.001140000 seconds]* * [Time delta from previous displayed frame: 0.001140000 seconds]* * [Time since reference or first frame: 24010.423040000 seconds]* * Frame Number: 4380* * Frame Length: 1116 bytes (8928 bits)* * Capture Length: 1116 bytes (8928 bits)* * [Frame is marked: False]* * [Frame is ignored: False]* * [Protocols in frame: eth:ethertype:ip:udp:radius:eap]* * [Coloring Rule Name: UDP]* * [Coloring Rule String: udp]* *Ethernet II, Src: Vmware_c9:f4:da (00:0c:29:c9:f4:da), Dst: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * Destination: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * Address: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Source: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Address: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Type: IPv4 (0x0800)* *Internet Protocol Version 4, Src: 192.168.0.13, Dst: 10.100.100.111* * 0100 .... = Version: 4* * .... 0101 = Header Length: 20 bytes (5)* * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)* * 0000 00.. = Differentiated Services Codepoint: Default (0)* * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)* * Total Length: 1102* * Identification: 0x2e00 (11776)* * Flags: 0x00* * 0... .... = Reserved bit: Not set* * .0.. .... = Don't fragment: Not set* * ..0. .... = More fragments: Not set* * Fragment offset: 0* * Time to live: 64* * Protocol: UDP (17)* * Header checksum: 0x1917 [validation disabled]* * [Good: False]* * [Bad: False]* * Source: 192.168.0.13* * Destination: 10.100.100.111* * [Source GeoIP: Unknown]* * [Destination GeoIP: Unknown]* *User Datagram Protocol, Src Port: 1812 (1812), Dst Port: 1645 (1645)* * Source Port: 1812* * Destination Port: 1645* * Length: 1082* * Checksum: 0x33d4 [validation disabled]* * [Good Checksum: False]* * [Bad Checksum: False]* * [Stream index: 0]* *RADIUS Protocol* * Code: Access-Challenge (11)* * Packet identifier: 0x78 (120)* * Length: 1074* * Authenticator: c5909ec6bdb68f7077967c825cf2fe9d* * [This is a response to a request in frame 4379]* * [Time from request: 0.001140000 seconds]* * Attribute Value Pairs* * AVP: l=255 t=EAP-Message(79) Segment[1]* * EAP fragment: 010903f21940c9ebbb122fd0040cc7a2836a3d5a9474629f...* * AVP: l=255 t=EAP-Message(79) Segment[2]* * EAP fragment: 864886f70d010901160f61646d696e7379734062666d2e6d...* * AVP: l=255 t=EAP-Message(79) Segment[3]* * EAP fragment: 82010a0282010100cd45365d93a25c082074dd513a1ce5a9...* * AVP: l=253 t=EAP-Message(79) Last Segment[4]* * EAP fragment: b87acae3d07134cf02c67b0203010001a382013830820134...* * Extensible Authentication Protocol* * Code: Request (1)* * Id: 9* * Length: 1010* * Type: Protected EAP (EAP-PEAP) (25)* * EAP-TLS Flags: 0x40* * 0... .... = Length Included: False* * .1.. .... = More Fragments: True* * ..0. .... = Start: False* * .... .000 = Version: 0* * AVP: l=18 t=Message-Authenticator(80): 4def88d7c7f2e5a286d7e0b3d96670e9* * Message-Authenticator: 4def88d7c7f2e5a286d7e0b3d96670e9* * AVP: l=18 t=State(24): 3a959296389c8bd01b3c353177f2a183* * State: 3a959296389c8bd01b3c353177f2a183* * No. Time Source Destination Protocol Length Info* * 4381 24015.471825 10.100.100.111 192.168.0.13 RADIUS 223 Access-Request(1) (id=120, l=181), Duplicate Request ID:120* *Frame 4381: 223 bytes on wire (1784 bits), 223 bytes captured (1784 bits)* * Encapsulation type: Ethernet (1)* * Arrival Time: Feb 20, 2017 14:31:47.817659000 Afrique de l’Est* * [Time shift for this packet: 0.000000000 seconds]* * Epoch Time: 1487590307.817659000 seconds* * [Time delta from previous captured frame: 5.048785000 seconds]* * [Time delta from previous displayed frame: 5.048785000 seconds]* * [Time since reference or first frame: 24015.471825000 seconds]* * Frame Number: 4381* * Frame Length: 223 bytes (1784 bits)* * Capture Length: 223 bytes (1784 bits)* * [Frame is marked: False]* * [Frame is ignored: False]* * [Protocols in frame: eth:ethertype:ip:udp:radius:eap]* * [Coloring Rule Name: UDP]* * [Coloring Rule String: udp]* *Ethernet II, Src: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1), Dst: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Destination: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Address: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Source: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1)* * Address: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Type: IPv4 (0x0800)* *Internet Protocol Version 4, Src: 10.100.100.111, Dst: 192.168.0.13* * 0100 .... = Version: 4* * .... 0101 = Header Length: 20 bytes (5)* * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)* * 0000 00.. = Differentiated Services Codepoint: Default (0)* * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)* * Total Length: 209* * Identification: 0x6f83 (28547)* * Flags: 0x00* * 0... .... = Reserved bit: Not set* * .0.. .... = Don't fragment: Not set* * ..0. .... = More fragments: Not set* * Fragment offset: 0* * Time to live: 254* * Protocol: UDP (17)* * Header checksum: 0x1d10 [validation disabled]* * [Good: False]* * [Bad: False]* * Source: 10.100.100.111* * Destination: 192.168.0.13* * [Source GeoIP: Unknown]* * [Destination GeoIP: Unknown]* *User Datagram Protocol, Src Port: 1645 (1645), Dst Port: 1812 (1812)* * Source Port: 1645* * Destination Port: 1812* * Length: 189* * Checksum: 0xcad9 [validation disabled]* * [Good Checksum: False]* * [Bad Checksum: False]* * [Stream index: 0]* *RADIUS Protocol* * Code: Access-Request (1)* * Packet identifier: 0x78 (120)* * Length: 181* * Authenticator: 8e1e0033348fcf333cf84a46404d7d73* * [Duplicate Request: 120]* * [The response to this request is in frame 4380]* * Attribute Value Pairs* * AVP: l=24 t=User-Name(1): host/adminlp.aros.lan* * User-Name: host/adminlp.aros.lan* * AVP: l=6 t=Service-Type(6): Framed(2)* * Service-Type: Framed (2)* * AVP: l=6 t=Framed-MTU(12): 1500* * Framed-MTU: 1500* * AVP: l=19 t=Called-Station-Id(30): AC-7E-8A-7B-7B-A0* * Called-Station-Id: AC-7E-8A-7B-7B-A0* * AVP: l=19 t=Calling-Station-Id(31): C4-34-6B-54-C0-2C* * Calling-Station-Id: C4-34-6B-54-C0-2C* * AVP: l=8 t=EAP-Message(79) Last Segment[1]* * EAP fragment: 020800061900* * Extensible Authentication Protocol* * Code: Response (2)* * Id: 8* * Length: 6* * Type: Protected EAP (EAP-PEAP) (25)* * EAP-TLS Flags: 0x00* * 0... .... = Length Included: False* * .0.. .... = More Fragments: False* * ..0. .... = Start: False* * .... .000 = Version: 0* * AVP: l=18 t=Message-Authenticator(80): 5563952a01377f93d4e4a02c0dfa30f8* * Message-Authenticator: 5563952a01377f93d4e4a02c0dfa30f8* * AVP: l=2 t=EAP-Key-Name(102): * * EAP-Key-Name: * * AVP: l=6 t=NAS-Port-Type(61): Ethernet(15)* * NAS-Port-Type: Ethernet (15)* * AVP: l=6 t=NAS-Port(5): 50132* * NAS-Port: 50132* * AVP: l=23 t=NAS-Port-Id(87): GigabitEthernet1/0/32* * NAS-Port-Id: GigabitEthernet1/0/32* * AVP: l=18 t=State(24): 3a9592963b9d8bd01b3c353177f2a183* * State: 3a9592963b9d8bd01b3c353177f2a183* * AVP: l=6 t=NAS-IP-Address(4): 10.100.100.111* * NAS-IP-Address: 10.100.100.111* * No. Time Source Destination Protocol Length Info* * 4382 24016.478317 192.168.0.13 10.100.100.111 RADIUS 62 Access-Reject(3) (id=120, l=20)* *Frame 4382: 62 bytes on wire (496 bits), 62 bytes captured (496 bits)* * Encapsulation type: Ethernet (1)* * Arrival Time: Feb 20, 2017 14:31:48.824151000 Afrique de l’Est* * [Time shift for this packet: 0.000000000 seconds]* * Epoch Time: 1487590308.824151000 seconds* * [Time delta from previous captured frame: 1.006492000 seconds]* * [Time delta from previous displayed frame: 1.006492000 seconds]* * [Time since reference or first frame: 24016.478317000 seconds]* * Frame Number: 4382* * Frame Length: 62 bytes (496 bits)* * Capture Length: 62 bytes (496 bits)* * [Frame is marked: False]* * [Frame is ignored: False]* * [Protocols in frame: eth:ethertype:ip:udp:radius]* * [Coloring Rule Name: UDP]* * [Coloring Rule String: udp]* *Ethernet II, Src: Vmware_c9:f4:da (00:0c:29:c9:f4:da), Dst: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * Destination: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * Address: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Source: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Address: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Type: IPv4 (0x0800)* *Internet Protocol Version 4, Src: 192.168.0.13, Dst: 10.100.100.111* * 0100 .... = Version: 4* * .... 0101 = Header Length: 20 bytes (5)* * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)* * 0000 00.. = Differentiated Services Codepoint: Default (0)* * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)* * Total Length: 48* * Identification: 0x32b3 (12979)* * Flags: 0x00* * 0... .... = Reserved bit: Not set* * .0.. .... = Don't fragment: Not set* * ..0. .... = More fragments: Not set* * Fragment offset: 0* * Time to live: 64* * Protocol: UDP (17)* * Header checksum: 0x1882 [validation disabled]* * [Good: False]* * [Bad: False]* * Source: 192.168.0.13* * Destination: 10.100.100.111* * [Source GeoIP: Unknown]* * [Destination GeoIP: Unknown]* *User Datagram Protocol, Src Port: 1812 (1812), Dst Port: 1645 (1645)* * Source Port: 1812* * Destination Port: 1645* * Length: 28* * Checksum: 0x2fb6 [validation disabled]* * [Good Checksum: False]* * [Bad Checksum: False]* * [Stream index: 0]* *RADIUS Protocol* * Code: Access-Reject (3)* * Packet identifier: 0x78 (120)* * Length: 20* * Authenticator: 47a65c80d6517f720b429b3084dfd86e* Sometimes, FreeRADIUS is also complaining about: *Mon Feb 20 20:58:56 2017 : Error: rlm_eap (EAP): No EAP session matching state 0x01194816005c5102* _____________________________________________________________________________________________________________________________________________________________________ We thought it might have something to do with some hotfixes/patch missing on the windows environment. We deployed the recommended ones by the vendor, but the issue persist! Any hints would really be appreciated. Thank you. Regards

2 1

Re: Multiple shared secret per IP?
by Peter Lambrechtsen 20 Feb '17

20 Feb '17

On 14/02/2017 05:52, "Brian Candler" <b.candler(a)pobox.com> wrote: On 13/02/2017 14:47, Chris Taylor (chtaylo2) wrote: > user: monitor > > source IP: 64.0.0.1 > > secret: MonitorAgent > > > ^ - That’s easy. To complicate, I need to also authenticate real users > from the same source server, using a different shared secret. (anyone can > view the one above, so not secure) Ideally, I’d like to also lockdown the > above secret key, to the single user. > > > Could you add a second IP address to the server (i.e. an alias), and bind to that when sending your test queries? I was just wondering about to reply and say exactly the same thing. On my development server I have bound 6 secondary IP addresses to it and use Packet-Src-IP-Address In the first line of the request. http://lists.freeradius.org/pipermail/freeradius-devel/2012-October/007185.… The other option as suggested is to add multiple IP addresses on the server or a listen statement in the configuration with a new port and use a per port clients to specify the shared secret. In the end after various different ways of achieving it I created my own custom VSA and include that in the request to determine the NAS type. Then for normal NASes I use client shortname and make decisions in code. And for my development server I don't define client shortname and pass it in as an additional VSA.

2 2

Authenticate only through Username
by Muhammad Usman 20 Feb '17

20 Feb '17

Hi, I am using currently using FreeRADIUS to authenticate customers of hotspot. But I want FR to authenticate only based on username and ignores the password. So if the username exists in radcheck table, it should send Accept, even if the password mismatches. How can I do that? Thanks

3 3

Error: Failed switching up to euid 0: No such file or directory
by André Carini 17 Feb '17

17 Feb '17

Hello everyone, I'm trying to configure FreeRADIUS 3.0.11 on LEDE (SNAPSHOT, r3157-2ef3810) to run chrooted, under a non-root user and a specific directory with the required files mounted. The problem I'm currently facing is "Error: Failed switching up to euid 0: No such file or directory" when running the server as a daemon with the chroot option enabled. The file log isn't very helpful: >root@OpenWRT-R1CL:/tmp/log# cat radius.log >Wed Feb 1 04:54:14 2017 : Info: Debugger not attached >Wed Feb 1 04:54:14 2017 : Warning: [/etc/freeradius3/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". >Wed Feb 1 04:54:14 2017 : Warning: [/etc/freeradius3/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". >Wed Feb 1 04:54:14 2017 : Info: Loaded virtual server <default> >Wed Feb 1 04:54:14 2017 : Info: Loaded virtual server default >Wed Feb 1 04:54:14 2017 : Info: Loaded virtual server inner-tunnel >Wed Feb 1 04:54:14 2017 : Error: Failed switching up to euid 0: No such file or directory However, when I run radiusd -X I face no issues. (Full -X log at the end of the email). Interestingly, when I run the daemon with user = root defined under radiusd.conf I also do not receive any errors (but that would defeat my objective of running FreeRADIUS with limited privileges). I do not know how to interpret the error message "Error: Failed switching up to euid 0: No such file or directory". I have defined the chroot destination, directory mounts and user/group definitions to the best of my ability. Please let me know if further troubleshooting and information is required. - André Carini hello(a)silkerdax.com ====================================================================== root@OpenWRT-R1CL:~# radiusd -X Server was built with: accounting : yes authentication : yes ascend-binary-attributes : yes coa : yes control-socket : yes detail : yes dhcp : yes dynamic-clients : yes osfc2 : no proxy : yes regex-pcre : yes regex-posix : no regex-posix-extended : no session-management : yes stats : yes tcp : yes threads : yes tls : yes unlang : yes vmps : yes developer : no Server core libs: freeradius-server : 3.0.11 talloc : 2.0.* ssl : 1.0.2j release pcre : 8.40 2017-01-11 Endianness: little Compilation flags: cppflags : -isystem /data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/include/ -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/include -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/include -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/usr/include -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/include/fortify -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/include cflags : -I/data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11 -I/data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src -include /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src/freeradius-devel/autoconf.h -include /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src/freeradius-devel/build.h -include /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src/freeradius-devel/features.h -include /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src/freeradius-devel/radpaths.h -fno-strict-aliasing -Os -pipe -mno-branch-likely -mips32r2 -mtune=24kc -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -msoft-float -mips16 -minterlink-mips16 -iremap /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11:freeradius-server-release_3_0_11 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro -Wall -std=c99 -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG -DIS_MODULE=1 ldflags : -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/lib -Wl,-rpath,/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/lib -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/lib -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/lib -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/usr/lib -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/lib -znow -zrelro libs : -lcrypto -lssl -ltalloc -lpcre -lcap -lresolv -ldl -lpthread -lcrypto -lssl -lcrypto -lssl -lcrypto -lssl -lreadline -lncurses Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius3/dictionary including dictionary file /etc/freeradius3/dictionary including configuration file /etc/freeradius3/radiusd.conf including configuration file /etc/freeradius3/clients.conf including files in directory /etc/freeradius3/mods-enabled/ including configuration file /etc/freeradius3/mods-enabled/eap including configuration file /etc/freeradius3/mods-enabled/radutmp including configuration file /etc/freeradius3/mods-enabled/files including configuration file /etc/freeradius3/mods-enabled/sradutmp including configuration file /etc/freeradius3/mods-enabled/preprocess including configuration file /etc/freeradius3/mods-enabled/attr_filter including configuration file /etc/freeradius3/mods-enabled/always including configuration file /etc/freeradius3/mods-enabled/mschap including files in directory /etc/freeradius3/policy.d/ including configuration file /etc/freeradius3/policy.d/eap including configuration file /etc/freeradius3/policy.d/accounting including configuration file /etc/freeradius3/policy.d/filter including files in directory /etc/freeradius3/sites-enabled/ including configuration file /etc/freeradius3/sites-enabled/default including configuration file /etc/freeradius3/sites-enabled/inner-tunnel main { security { user = "radius" group = "radius" chroot = "/var/lib/freeradius3" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var/lib/freeradius3" logdir = "/var/log" run_dir = "/var/lib/freeradius3/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var/lib/freeradius3" sbindir = "/usr/sbin" logdir = "/var/log" run_dir = "/var/lib/freeradius3/run/radiusd" libdir = "/usr/lib/freeradius3" radacctdir = "/var/db/radacct" hostname_lookups = no max_request_time = 10 cleanup_delay = 5 max_requests = 5120 pidfile = "/var/lib/freeradius3/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = off log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.500000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client openwrt { ipaddr = 192.168.42.1 require_message_authenticator = yes secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = yes secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = yes secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = MS-CHAP # Creating Auth-Type = eap radiusd: #### Instantiating modules #### modules { # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius3/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 5120 } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius3/mods-enabled/radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = no check_with_nas = no permissions = 384 caller_id = yes } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius3/mods-enabled/files files { filename = "/etc/freeradius3/mods-config/files/authorize" acctusersfile = "/etc/freeradius3/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius3/mods-config/files/pre-proxy" } # Loading module "sradutmp" from file /etc/freeradius3/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius3/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius3/mods-config/preprocess/huntgroups" hints = "/etc/freeradius3/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius3/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius3/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius3/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius3/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius3/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius3/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius3/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius3/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius3/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius3/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius3/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius3/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius3/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius3/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius3/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } instantiate { } # Instantiating module "eap" from file /etc/freeradius3/mods-enabled/eap # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius3/certs" pem_file_type = yes private_key_file = "/etc/freeradius3/certs/server.key" certificate_file = "/etc/freeradius3/certs/server.pem" ca_file = "/etc/freeradius3/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius3/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "files" from file /etc/freeradius3/mods-enabled/files reading pairlist file /etc/freeradius3/mods-config/files/authorize reading pairlist file /etc/freeradius3/mods-config/files/accounting reading pairlist file /etc/freeradius3/mods-config/files/pre-proxy # Instantiating module "preprocess" from file /etc/freeradius3/mods-enabled/preprocess reading pairlist file /etc/freeradius3/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius3/mods-config/preprocess/hints # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/access_reject [/etc/freeradius3/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius3/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/accounting_response # Instantiating module "reject" from file /etc/freeradius3/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius3/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius3/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius3/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius3/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius3/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius3/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius3/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius3/mods-enabled/always # Instantiating module "mschap" from file /etc/freeradius3/mods-enabled/mschap rlm_mschap (mschap): using internal authentication } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius3/radiusd.conf } # server server default { # from file /etc/freeradius3/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/freeradius3/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 1813 limit { max_pps = 3000 max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 1813 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Ready to process requests

2 2

Trying to Authorize Users based on AD Groups and SSIDs
by Misbah Hussaini 17 Feb '17

17 Feb '17

Dear, I'm trying to configure PEAP Authentication with AD backend on my FR Server which is running version 3.0.4 on Centos 7. So far, I'm able to authenticate against AD but group membership checking is not working, appreciate if some help can be provided. I want to map my SSIDs - SSID02362, SSID02363 etc to AD groups so that users in specific groups can access that particular SSID. As mentioned in man page of rlm_ldap I have configured group membership check in post-auth by adding below configuration in default and inner-tunnel config files but my users are getting access-reject messages. If I remove the ldap-group check config then all users are able to authenticate and access SSID, off course without any control. post-auth { if (LDAP-Group == "FR-TEST") { noop } else { reject } } if group membership works then I can go ahead and add below config to test SSID with Group membership. (this is not one yet). post-auth { if (LDAP-Group == "FR-TEST" && Calling-Station-SSID == "SSID02362") { noop } else { reject } } Where am I going wrong? Debug can be found here -> http://pastebin.com/zSptQPaa Regards Misbah

3 9

Maximum number of virtual servers?
by Clayton Knorr 16 Feb '17

16 Feb '17

Any opinions (or hard facts) about the upper limit of virtual servers are advisable? Potentially more than 1,000 if we decide to go the virtual server route. Thanks, Clayton

5 8

Update on 3.0, 3.1, and 3.2.
by Alan DeKok 16 Feb '17

16 Feb '17

We plan on releasing 3.0.12 on Monday. it's stable, and there no new issues being reported for it. This will ideally be the last release of the 3.0 series. Version 3.0 was released almost three years ago, and it's time for a new major version of the server. 3.1 supports a "map" keyword, redis cluster, and many other useful features. Many people have been using the 3.1 branch in production, so we're confident that it is stable and functional. To keep things simple, we don't release an official 3.1 version. Instead, we will call 3.1 a "development / experimental" branch. Once we're ready (later this summer), we'll release an official 3.2 release. The v3.1.x branch will then be frozen, and no further development will occur on it. All new development will then start with a 3.3 branch, which will likely turn into version 4.0. There are enough architecture changes needed that it warrants a 4.0. In summary: 2.1 and earlier: dead. Don't use them. 2.2: Only critical security fixes. We expect this won't happen. 3.0: stable. New installations can use 3.0. 3.1: development. Use it only if you know what you're doing. 3.2: (future stable). Mid 2016 on, new installations should use this. 3.3. (future development), more changes, with a goal of increasing performance substantially.

4 6

Using multiple databases on the same freeRadius instance
by Gabriel Marais 15 Feb '17

15 Feb '17

Hi Guys, I am wondering if there are any way to use two different databases within the same freeRadius instance? Currently, I am using the default MySQL schema for AAA. I am inserting additional attributes in the pre-proxy configuration of my site. The attribute information comes from the same database. This works perfectly. I now have a site where I need to do the same but the additional attribute information needs to come from a different database (existing database on the client side), other than the AAA database. Is there a way to do this? Regards Gabriel

4 10

Active directory integration and grant access base on AD group membership
by Luc Paulin 15 Feb '17

15 Feb '17

Hi, I am trying to setup a radius server on centos6.8. I succeeded to setup the active directory integration by following the guide at http://wiki.freeradius.org/guide/freeradius-active-directory-integration-ho… . So I can get my user authentificate through the active directory. Now I would like grant system access base on group membership from active directory. How can this be done. I have tried by configuring the users and huntgroup files, but look like it grant access to everyone if username/password is good. -- !!!!! ( o o ) --------------oOO----(_)----OOo-------------- Luc Paulin email: paulinster(at)gmail.com Skype: paulinster

3 6

v3.0.11 Radmin problem
by LABAT, Xavier 15 Feb '17

15 Feb '17

Hi, I have some problems with radmin since version 3.0.10 (the first version in 3.0 tried) that I don't encountered in previous versions (2.1.6 and 2.2.6) . The main problem is when I try to launch the tool. The command < radmin > work correctly at first start but then I have to add options to start again as below : [proxyRadius /usr/local/etc/raddb]# radmin radmin version 3.0.11, built on Mar 31 2016 at 10:41:17 - FreeRADIUS Server administration tool. ... radmin> [proxyRadius/usr/local/etc/raddb]# radmin radmin: Error in socket: Broken pipe [proxyRadius/usr/local/etc/raddb]# radmin radmin: Error in socket: No such file or directory [proxyRadius/usr/local/etc/raddb]# ls /usr/local/var/run/radiusd/ radiusd.pid radiusd.sock [proxyRadius/usr/local/etc/raddb]# radmin -d /usr/local/etc/raddb/ radmin: Error in socket: No such file or directory [proxyRadius/usr/local/etc/raddb]# radmin -n radiusd radmin: Error in socket: No such file or directory [proxyRadius/usr/local/etc/raddb]# radmin -f /usr/local/var/run/radiusd/radiusd.sock radmin version 3.0.11, built on Mar 31 2016 at 10:41:17 - FreeRADIUS Server administration tool. ... radmin> [proxyRadius/usr/local/etc/raddb]# radmin radmin: Error in socket: No such file or directory The second problem is when I use a condition in Radmin. Previously we set a condition in order to capture only requests based on it, but since version 3.0.10, radmin log all requests received by server. I can see a < & > before the condition that I didn't have with previous versions : radmin> debug condition User-Name == "toto@foo" radmin> show debug condition &User-Name == "toto@foo" Can anyone tell me if it's better with version 3.0.12 or if there is a problem with my utilisation of the tool ? Here the configuration of my solution : radiusd.conf ... localstatedir = /usr/local/var name = radiusd run_dir = ${localstatedir}/run/${name} ... sites-enabled/control-socket listen { type = control socket = ${run_dir}/${name}.sock mode = rw } Thanks you. Regards. Xavier LABAT STN2 Axione -- Les donnees et renseignements contenus dans ce message sont personnels, confidentiels et secrets. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee. Si vous n'etes pas le bon destinataire, nous vous demandons de ne pas lire, copier, utiliser ou divulguer cette communication. Nous vous prions de notifier cette erreur a l'expediteur et d'effacer immediatement cette communication de votre systeme. Any data and information contained in this electronic mail is personal, confidential and secret. Any total or partial publication, use or distribution must be authorized. If you are not the right addressee, we ask you not to read, copy, use or disclose this communication. Please notify this error to the sender and erase at once this communication from your system.

3 12