- Freeradius-Users - lists.freeradius.org

Help Interpreting Supplicant Failure
by Matthew West 23 Feb '17

23 Feb '17

Hello FR List, Running into an issue interpreting FR output from an authentication attempt with a Windows7 domain-connected supplicant. Moving from a lab environment to a production one. The lab version of this setup works with both a Macintosh and Windows7 non-domain connected supplicant. Want to do EAP-TLS only AAA, but am seeing what looks to be use of username instead of a certificate. I'm not familiar with using domain-connected Win7 supplicants and may be misunderstanding the FR debug output. I'm happy to troubleshoot further, but want to make sure I'm understanding what's actually happening. Can someone help me interpret this output? Including only request in which a reject happens. If more is needed, I'm happy to include more information. Environment: * CentOS 7.3 * FR 3.0.4 Reject information (domain name changed): Received Access-Request Id 148 from 10.xx.4.205:1645 to 10.xx.130.253:1812 length 274 User-Name = 'ACME\\philip' Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = '00-1B-D5-46-78-EF' Calling-Station-Id = '5C-26-0A-77-B4-CA' EAP-Message = 0x0208006b190017030100603bb7e79c335675f679b1688e85c39720460f055dc0ba7e96eb1c7e7b7b365a9f43bc1e142d183ac41cdf5b08ed8f1566a5f0faf5ac9c121ad26c8e4adbe2e881615e62072569e415039ea28c5a2bba997d67fd9f6d8618850b54b7ec9d01af6e Message-Authenticator = 0x354e667dc313ae3f2c001a1cb013eecb NAS-Port-Type = Ethernet NAS-Port = 50248 NAS-Port-Id = 'GigabitEthernet2/48' State = 0x2021716b262968d531eefb122cb3a198 NAS-IP-Address = 10.xx.4.205 (7) Received Access-Request packet from host 10.xx.4.205 port 1645, id=148, length=274 (7) User-Name = 'ACME\\philip' (7) Service-Type = Framed-User (7) Framed-MTU = 1500 (7) Called-Station-Id = '00-1B-D5-46-78-EF' (7) Calling-Station-Id = '5C-26-0A-77-B4-CA' (7) EAP-Message = 0x0208006b190017030100603bb7e79c335675f679b1688e85c39720460f055dc0ba7e96eb1c7e7b7b365a9f43bc1e142d183ac41cdf5b08ed8f1566a5f0faf5ac9c121ad26c8e4adbe2e881615e62072569e415039ea28c5a2bba997d67fd9f6d8618850b54b7ec9d01af6e (7) Message-Authenticator = 0x354e667dc313ae3f2c001a1cb013eecb (7) NAS-Port-Type = Ethernet (7) NAS-Port = 50248 (7) NAS-Port-Id = 'GigabitEthernet2/48' (7) State = 0x2021716b262968d531eefb122cb3a198 (7) NAS-IP-Address = 10.xx.4.205 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (!&User-Name) (7) if (!&User-Name) -> FALSE (7) if (&User-Name =~ / /) (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@.*@/ ) (7) if (&User-Name =~ /@.*@/ ) -> FALSE (7) if (&User-Name =~ /\\.\\./ ) (7) if (&User-Name =~ /\\.\\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\\.$/) (7) if (&User-Name =~ /\\.$/) -> FALSE (7) if (&User-Name =~ /(a)\\./) (7) if (&User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [preprocess] = ok (7) [digest] = noop (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "ACME\philip", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : Peer sent code Response (2) ID 8 length 107 (7) eap : Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/default (7) authenticate { (7) eap : Expiring EAP session with state 0xf281125af2890830 (7) eap : Finished EAP session with state 0x2021716b262968d5 (7) eap : Previous EAP request found for state 0x2021716b262968d5, released from the list (7) eap : Peer sent method PEAP (25) (7) eap : EAP PEAP (25) (7) eap : Calling eap_peap to process EAP data (7) eap_peap : processing EAP-TLS (7) eap_peap : eaptls_verify returned 7 (7) eap_peap : Done initial handshake (7) eap_peap : eaptls_process returned 7 (7) eap_peap : FR_TLS_OK (7) eap_peap : Session established. Decoding tunneled attributes (7) eap_peap : Peap state phase2 (7) eap_peap : EAP type MSCHAPv2 (26) (7) eap_peap : Got tunneled request EAP-Message = 0x0208004b1a020800463191e6b09be07b605fda54036913080947000000000000000092ef9f3797c75a4e63bf6778433b6dbf51c612d8ef5824c0005941414e41544543485c7068696c6970 server default { (7) eap_peap : Setting User-Name to ACME\philip Sending tunneled request EAP-Message = 0x0208004b1a020800463191e6b09be07b605fda54036913080947000000000000000092ef9f3797c75a4e63bf6778433b6dbf51c612d8ef5824c0005941414e41544543485c7068696c6970 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'ACME\\philip' State = 0xf281125af2890830f60662494a0c8653 server inner-tunnel { (7) server inner-tunnel { (7) Request: EAP-Message = 0x0208004b1a020800463191e6b09be07b605fda54036913080947000000000000000092ef9f3797c75a4e63bf6778433b6dbf51c612d8ef5824c0005941414e41544543485c7068696c6970 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'ACME\\philip' State = 0xf281125af2890830f60662494a0c8653 (7) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (7) authorize { (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "ACME\philip", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) update control { (7) Proxy-To-Realm := 'LOCAL' (7) } # update control = noop (7) eap : Peer sent code Response (2) ID 8 length 75 (7) eap : No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [files] = noop (7) [expiration] = noop (7) [logintime] = noop (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) authenticate { (7) eap : Expiring EAP session with state 0xf281125af2890830 (7) eap : Finished EAP session with state 0xf281125af2890830 (7) eap : Previous EAP request found for state 0xf281125af2890830, released from the list (7) eap : Peer sent method MSCHAPv2 (26) (7) eap : EAP MSCHAPv2 (26) (7) eap : Calling eap_mschapv2 to process EAP data (7) eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) eap : Freeing handler (7) [eap] = reject (7) } # authenticate = reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject : EXPAND %{User-Name} (7) attr_filter.access_reject : --> ACME\\philip (7) attr_filter.access_reject : Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) } # Post-Auth-Type REJECT = updated (7) Reply: EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 (7) } # server inner-tunnel } # server inner-tunnel (7) eap_peap : Got tunneled reply code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap : Got tunneled reply RADIUS code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap : Tunneled authentication was rejected (7) eap_peap : FAILURE (7) eap : New EAP session, adding 'State' attribute to reply 0x2021716b272868d5 (7) [eap] = handled (7) } # authenticate = handled (7) Sending Access-Challenge packet to host 10.xx.4.205 port 1645, id=148, length=0 (7) EAP-Message = 0x0109002b19001703010020a23fbc7b14012abe52ab4685295adca8dc32be35b9ffc8351c010143b44f8e2f (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x2021716b272868d531eefb122cb3a198 Sending Access-Challenge Id 148 from 10.xx.130.253:1812 to 10.xx.4.205:1645 EAP-Message = 0x0109002b19001703010020a23fbc7b14012abe52ab4685295adca8dc32be35b9ffc8351c010143b44f8e2f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2021716b272868d531eefb122cb3a198 (7) Finished request Thank you, Matthew

2 3

Salted auth mechanism
by Abdul Basit 22 Feb '17

22 Feb '17

Hi team, I am using freeradius for sip register authentication through digest::md5 using perl. I want to use salted algorithm for sip register authentication. Can you share some pointers that can guide about the supported methods for the solution? Regards Abdul Basit

2 1

Reducing DNS lookups
by David Hartburn 21 Feb '17

21 Feb '17

Hi, For our LDAP queries, we have specified the forest DNS name as the LDAP server, so that we achieve via DNS a random distribution of queries against our AD servers. Previously we had hammered the first server on the list. This has kept our AD guys happy, but we have noticed that at busy times our FR servers are doing over 100 DNS queries per second, for the same thing. I can not spot anything in the FreeRADIUS config files, but is there any way to reduce the number of DNS lookups? We are running 3.0.12 on RHEL7. Outside of FreeRADIUS, we could either make sure each server has a different /etc/hosts file, which is not ideal, or implementing local DNS caching seems to be the more sensible way to go. Are there any other alternatives other people are using? Yours Dave Hartburn

8 9

(802.1X) PEAPv0/EAP-MSCHAPv2 : duplicate access-request
by 3＠D4rkn3ss DuMb 21 Feb '17

21 Feb '17

Dear list, After sucessfuly deploying FreeRADIUS v.3.0.11 against an Active Directory 2008, everything seemed to be fine during the test (wired), but when something weird started to happen when I put the server in production. In fact, we noticted that some station (windows machine) just got kicked out randomnly and suddenly. We fired a packet analyzer and found out that the station got an access-reject from the radius server after a duplicate "access request". The following diagram describes a little bit what happened __________________________________________________________________________________________________________________________________________________________ *+-------------+ +------------+ +--------------+ +---------+| station + | | | | | AD 2008 || | cisco switch | freeradius| | || | | | | | | |+-------------+ +------------+ +--------------+ +---------+ <------------eap req-id----------------+ + +---------------eap resp-id------------> +---------------radius access-req------> <-------------eap request/eap-type + challenge <--------------radius access-challenge-+ + +-------------?-------------------------> +----radius access-req (duplicate)-----> radius access-reject <------------------------------------+* ____________________________________________________________________________________________________________________________________________________________ and the corresponding trace _____________________________________________________________________________________________________________________________________________________________ *No. Time Source Destination Protocol Length Info* * 4379 24010.421900 10.100.100.111 192.168.0.13 RADIUS 223 Access-Request(1) (id=120, l=181)* *Frame 4379: 223 bytes on wire (1784 bits), 223 bytes captured (1784 bits)* * Encapsulation type: Ethernet (1)* * Arrival Time: Feb 20, 2017 14:31:42.767734000 Afrique de l’Est* * [Time shift for this packet: 0.000000000 seconds]* * Epoch Time: 1487590302.767734000 seconds* * [Time delta from previous captured frame: 0.015441000 seconds]* * [Time delta from previous displayed frame: 0.015441000 seconds]* * [Time since reference or first frame: 24010.421900000 seconds]* * Frame Number: 4379* * Frame Length: 223 bytes (1784 bits)* * Capture Length: 223 bytes (1784 bits)* * [Frame is marked: False]* * [Frame is ignored: False]* * [Protocols in frame: eth:ethertype:ip:udp:radius:eap]* * [Coloring Rule Name: UDP]* * [Coloring Rule String: udp]* *Ethernet II, Src: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1), Dst: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Destination: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Address: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Source: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1)* * Address: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Type: IPv4 (0x0800)* *Internet Protocol Version 4, Src: 10.100.100.111, Dst: 192.168.0.13* * 0100 .... = Version: 4* * .... 0101 = Header Length: 20 bytes (5)* * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)* * 0000 00.. = Differentiated Services Codepoint: Default (0)* * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)* * Total Length: 209* * Identification: 0x6f80 (28544)* * Flags: 0x00* * 0... .... = Reserved bit: Not set* * .0.. .... = Don't fragment: Not set* * ..0. .... = More fragments: Not set* * Fragment offset: 0* * Time to live: 254* * Protocol: UDP (17)* * Header checksum: 0x1d13 [validation disabled]* * [Good: False]* * [Bad: False]* * Source: 10.100.100.111* * Destination: 192.168.0.13* * [Source GeoIP: Unknown]* * [Destination GeoIP: Unknown]* *User Datagram Protocol, Src Port: 1645 (1645), Dst Port: 1812 (1812)* * Source Port: 1645* * Destination Port: 1812* * Length: 189* * Checksum: 0xcad9 [validation disabled]* * [Good Checksum: False]* * [Bad Checksum: False]* * [Stream index: 0]* *RADIUS Protocol* * Code: Access-Request (1)* * Packet identifier: 0x78 (120)* * Length: 181* * Authenticator: 8e1e0033348fcf333cf84a46404d7d73* * [The response to this request is in frame 4380]* * Attribute Value Pairs* * AVP: l=24 t=User-Name(1): host/adminlp.aros.lan* * User-Name: host/adminlp.aros.lan* * AVP: l=6 t=Service-Type(6): Framed(2)* * Service-Type: Framed (2)* * AVP: l=6 t=Framed-MTU(12): 1500* * Framed-MTU: 1500* * AVP: l=19 t=Called-Station-Id(30): AC-7E-8A-7B-7B-A0* * Called-Station-Id: AC-7E-8A-7B-7B-A0* * AVP: l=19 t=Calling-Station-Id(31): C4-34-6B-54-C0-2C* * Calling-Station-Id: C4-34-6B-54-C0-2C* * AVP: l=8 t=EAP-Message(79) Last Segment[1]* * EAP fragment: 020800061900* * Extensible Authentication Protocol* * Code: Response (2)* * Id: 8* * Length: 6* * Type: Protected EAP (EAP-PEAP) (25)* * EAP-TLS Flags: 0x00* * 0... .... = Length Included: False* * .0.. .... = More Fragments: False* * ..0. .... = Start: False* * .... .000 = Version: 0* * AVP: l=18 t=Message-Authenticator(80): 5563952a01377f93d4e4a02c0dfa30f8* * Message-Authenticator: 5563952a01377f93d4e4a02c0dfa30f8* * AVP: l=2 t=EAP-Key-Name(102): * * EAP-Key-Name: * * AVP: l=6 t=NAS-Port-Type(61): Ethernet(15)* * NAS-Port-Type: Ethernet (15)* * AVP: l=6 t=NAS-Port(5): 50132* * NAS-Port: 50132* * AVP: l=23 t=NAS-Port-Id(87): GigabitEthernet1/0/32* * NAS-Port-Id: GigabitEthernet1/0/32* * AVP: l=18 t=State(24): 3a9592963b9d8bd01b3c353177f2a183* * State: 3a9592963b9d8bd01b3c353177f2a183* * AVP: l=6 t=NAS-IP-Address(4): 10.100.100.111* * NAS-IP-Address: 10.100.100.111* * No. Time Source Destination Protocol Length Info* * 4380 24010.423040 192.168.0.13 10.100.100.111 RADIUS 1116 Access-Challenge(11) (id=120, l=1074)* *Frame 4380: 1116 bytes on wire (8928 bits), 1116 bytes captured (8928 bits)* * Encapsulation type: Ethernet (1)* * Arrival Time: Feb 20, 2017 14:31:42.768874000 Afrique de l’Est* * [Time shift for this packet: 0.000000000 seconds]* * Epoch Time: 1487590302.768874000 seconds* * [Time delta from previous captured frame: 0.001140000 seconds]* * [Time delta from previous displayed frame: 0.001140000 seconds]* * [Time since reference or first frame: 24010.423040000 seconds]* * Frame Number: 4380* * Frame Length: 1116 bytes (8928 bits)* * Capture Length: 1116 bytes (8928 bits)* * [Frame is marked: False]* * [Frame is ignored: False]* * [Protocols in frame: eth:ethertype:ip:udp:radius:eap]* * [Coloring Rule Name: UDP]* * [Coloring Rule String: udp]* *Ethernet II, Src: Vmware_c9:f4:da (00:0c:29:c9:f4:da), Dst: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * Destination: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * Address: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Source: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Address: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Type: IPv4 (0x0800)* *Internet Protocol Version 4, Src: 192.168.0.13, Dst: 10.100.100.111* * 0100 .... = Version: 4* * .... 0101 = Header Length: 20 bytes (5)* * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)* * 0000 00.. = Differentiated Services Codepoint: Default (0)* * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)* * Total Length: 1102* * Identification: 0x2e00 (11776)* * Flags: 0x00* * 0... .... = Reserved bit: Not set* * .0.. .... = Don't fragment: Not set* * ..0. .... = More fragments: Not set* * Fragment offset: 0* * Time to live: 64* * Protocol: UDP (17)* * Header checksum: 0x1917 [validation disabled]* * [Good: False]* * [Bad: False]* * Source: 192.168.0.13* * Destination: 10.100.100.111* * [Source GeoIP: Unknown]* * [Destination GeoIP: Unknown]* *User Datagram Protocol, Src Port: 1812 (1812), Dst Port: 1645 (1645)* * Source Port: 1812* * Destination Port: 1645* * Length: 1082* * Checksum: 0x33d4 [validation disabled]* * [Good Checksum: False]* * [Bad Checksum: False]* * [Stream index: 0]* *RADIUS Protocol* * Code: Access-Challenge (11)* * Packet identifier: 0x78 (120)* * Length: 1074* * Authenticator: c5909ec6bdb68f7077967c825cf2fe9d* * [This is a response to a request in frame 4379]* * [Time from request: 0.001140000 seconds]* * Attribute Value Pairs* * AVP: l=255 t=EAP-Message(79) Segment[1]* * EAP fragment: 010903f21940c9ebbb122fd0040cc7a2836a3d5a9474629f...* * AVP: l=255 t=EAP-Message(79) Segment[2]* * EAP fragment: 864886f70d010901160f61646d696e7379734062666d2e6d...* * AVP: l=255 t=EAP-Message(79) Segment[3]* * EAP fragment: 82010a0282010100cd45365d93a25c082074dd513a1ce5a9...* * AVP: l=253 t=EAP-Message(79) Last Segment[4]* * EAP fragment: b87acae3d07134cf02c67b0203010001a382013830820134...* * Extensible Authentication Protocol* * Code: Request (1)* * Id: 9* * Length: 1010* * Type: Protected EAP (EAP-PEAP) (25)* * EAP-TLS Flags: 0x40* * 0... .... = Length Included: False* * .1.. .... = More Fragments: True* * ..0. .... = Start: False* * .... .000 = Version: 0* * AVP: l=18 t=Message-Authenticator(80): 4def88d7c7f2e5a286d7e0b3d96670e9* * Message-Authenticator: 4def88d7c7f2e5a286d7e0b3d96670e9* * AVP: l=18 t=State(24): 3a959296389c8bd01b3c353177f2a183* * State: 3a959296389c8bd01b3c353177f2a183* * No. Time Source Destination Protocol Length Info* * 4381 24015.471825 10.100.100.111 192.168.0.13 RADIUS 223 Access-Request(1) (id=120, l=181), Duplicate Request ID:120* *Frame 4381: 223 bytes on wire (1784 bits), 223 bytes captured (1784 bits)* * Encapsulation type: Ethernet (1)* * Arrival Time: Feb 20, 2017 14:31:47.817659000 Afrique de l’Est* * [Time shift for this packet: 0.000000000 seconds]* * Epoch Time: 1487590307.817659000 seconds* * [Time delta from previous captured frame: 5.048785000 seconds]* * [Time delta from previous displayed frame: 5.048785000 seconds]* * [Time since reference or first frame: 24015.471825000 seconds]* * Frame Number: 4381* * Frame Length: 223 bytes (1784 bits)* * Capture Length: 223 bytes (1784 bits)* * [Frame is marked: False]* * [Frame is ignored: False]* * [Protocols in frame: eth:ethertype:ip:udp:radius:eap]* * [Coloring Rule Name: UDP]* * [Coloring Rule String: udp]* *Ethernet II, Src: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1), Dst: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Destination: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Address: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Source: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1)* * Address: CiscoInc_e7:58:c1 (6c:20:56:e7:58:c1)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Type: IPv4 (0x0800)* *Internet Protocol Version 4, Src: 10.100.100.111, Dst: 192.168.0.13* * 0100 .... = Version: 4* * .... 0101 = Header Length: 20 bytes (5)* * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)* * 0000 00.. = Differentiated Services Codepoint: Default (0)* * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)* * Total Length: 209* * Identification: 0x6f83 (28547)* * Flags: 0x00* * 0... .... = Reserved bit: Not set* * .0.. .... = Don't fragment: Not set* * ..0. .... = More fragments: Not set* * Fragment offset: 0* * Time to live: 254* * Protocol: UDP (17)* * Header checksum: 0x1d10 [validation disabled]* * [Good: False]* * [Bad: False]* * Source: 10.100.100.111* * Destination: 192.168.0.13* * [Source GeoIP: Unknown]* * [Destination GeoIP: Unknown]* *User Datagram Protocol, Src Port: 1645 (1645), Dst Port: 1812 (1812)* * Source Port: 1645* * Destination Port: 1812* * Length: 189* * Checksum: 0xcad9 [validation disabled]* * [Good Checksum: False]* * [Bad Checksum: False]* * [Stream index: 0]* *RADIUS Protocol* * Code: Access-Request (1)* * Packet identifier: 0x78 (120)* * Length: 181* * Authenticator: 8e1e0033348fcf333cf84a46404d7d73* * [Duplicate Request: 120]* * [The response to this request is in frame 4380]* * Attribute Value Pairs* * AVP: l=24 t=User-Name(1): host/adminlp.aros.lan* * User-Name: host/adminlp.aros.lan* * AVP: l=6 t=Service-Type(6): Framed(2)* * Service-Type: Framed (2)* * AVP: l=6 t=Framed-MTU(12): 1500* * Framed-MTU: 1500* * AVP: l=19 t=Called-Station-Id(30): AC-7E-8A-7B-7B-A0* * Called-Station-Id: AC-7E-8A-7B-7B-A0* * AVP: l=19 t=Calling-Station-Id(31): C4-34-6B-54-C0-2C* * Calling-Station-Id: C4-34-6B-54-C0-2C* * AVP: l=8 t=EAP-Message(79) Last Segment[1]* * EAP fragment: 020800061900* * Extensible Authentication Protocol* * Code: Response (2)* * Id: 8* * Length: 6* * Type: Protected EAP (EAP-PEAP) (25)* * EAP-TLS Flags: 0x00* * 0... .... = Length Included: False* * .0.. .... = More Fragments: False* * ..0. .... = Start: False* * .... .000 = Version: 0* * AVP: l=18 t=Message-Authenticator(80): 5563952a01377f93d4e4a02c0dfa30f8* * Message-Authenticator: 5563952a01377f93d4e4a02c0dfa30f8* * AVP: l=2 t=EAP-Key-Name(102): * * EAP-Key-Name: * * AVP: l=6 t=NAS-Port-Type(61): Ethernet(15)* * NAS-Port-Type: Ethernet (15)* * AVP: l=6 t=NAS-Port(5): 50132* * NAS-Port: 50132* * AVP: l=23 t=NAS-Port-Id(87): GigabitEthernet1/0/32* * NAS-Port-Id: GigabitEthernet1/0/32* * AVP: l=18 t=State(24): 3a9592963b9d8bd01b3c353177f2a183* * State: 3a9592963b9d8bd01b3c353177f2a183* * AVP: l=6 t=NAS-IP-Address(4): 10.100.100.111* * NAS-IP-Address: 10.100.100.111* * No. Time Source Destination Protocol Length Info* * 4382 24016.478317 192.168.0.13 10.100.100.111 RADIUS 62 Access-Reject(3) (id=120, l=20)* *Frame 4382: 62 bytes on wire (496 bits), 62 bytes captured (496 bits)* * Encapsulation type: Ethernet (1)* * Arrival Time: Feb 20, 2017 14:31:48.824151000 Afrique de l’Est* * [Time shift for this packet: 0.000000000 seconds]* * Epoch Time: 1487590308.824151000 seconds* * [Time delta from previous captured frame: 1.006492000 seconds]* * [Time delta from previous displayed frame: 1.006492000 seconds]* * [Time since reference or first frame: 24016.478317000 seconds]* * Frame Number: 4382* * Frame Length: 62 bytes (496 bits)* * Capture Length: 62 bytes (496 bits)* * [Frame is marked: False]* * [Frame is ignored: False]* * [Protocols in frame: eth:ethertype:ip:udp:radius]* * [Coloring Rule Name: UDP]* * [Coloring Rule String: udp]* *Ethernet II, Src: Vmware_c9:f4:da (00:0c:29:c9:f4:da), Dst: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * Destination: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * Address: All-HSRP-routers_01 (00:00:0c:07:ac:01)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Source: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * Address: Vmware_c9:f4:da (00:0c:29:c9:f4:da)* * .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)* * .... ...0 .... .... .... .... = IG bit: Individual address (unicast)* * Type: IPv4 (0x0800)* *Internet Protocol Version 4, Src: 192.168.0.13, Dst: 10.100.100.111* * 0100 .... = Version: 4* * .... 0101 = Header Length: 20 bytes (5)* * Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)* * 0000 00.. = Differentiated Services Codepoint: Default (0)* * .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)* * Total Length: 48* * Identification: 0x32b3 (12979)* * Flags: 0x00* * 0... .... = Reserved bit: Not set* * .0.. .... = Don't fragment: Not set* * ..0. .... = More fragments: Not set* * Fragment offset: 0* * Time to live: 64* * Protocol: UDP (17)* * Header checksum: 0x1882 [validation disabled]* * [Good: False]* * [Bad: False]* * Source: 192.168.0.13* * Destination: 10.100.100.111* * [Source GeoIP: Unknown]* * [Destination GeoIP: Unknown]* *User Datagram Protocol, Src Port: 1812 (1812), Dst Port: 1645 (1645)* * Source Port: 1812* * Destination Port: 1645* * Length: 28* * Checksum: 0x2fb6 [validation disabled]* * [Good Checksum: False]* * [Bad Checksum: False]* * [Stream index: 0]* *RADIUS Protocol* * Code: Access-Reject (3)* * Packet identifier: 0x78 (120)* * Length: 20* * Authenticator: 47a65c80d6517f720b429b3084dfd86e* Sometimes, FreeRADIUS is also complaining about: *Mon Feb 20 20:58:56 2017 : Error: rlm_eap (EAP): No EAP session matching state 0x01194816005c5102* _____________________________________________________________________________________________________________________________________________________________________ We thought it might have something to do with some hotfixes/patch missing on the windows environment. We deployed the recommended ones by the vendor, but the issue persist! Any hints would really be appreciated. Thank you. Regards

2 1

Re: Multiple shared secret per IP?
by Peter Lambrechtsen 20 Feb '17

20 Feb '17

On 14/02/2017 05:52, "Brian Candler" <b.candler(a)pobox.com> wrote: On 13/02/2017 14:47, Chris Taylor (chtaylo2) wrote: > user: monitor > > source IP: 64.0.0.1 > > secret: MonitorAgent > > > ^ - That’s easy. To complicate, I need to also authenticate real users > from the same source server, using a different shared secret. (anyone can > view the one above, so not secure) Ideally, I’d like to also lockdown the > above secret key, to the single user. > > > Could you add a second IP address to the server (i.e. an alias), and bind to that when sending your test queries? I was just wondering about to reply and say exactly the same thing. On my development server I have bound 6 secondary IP addresses to it and use Packet-Src-IP-Address In the first line of the request. http://lists.freeradius.org/pipermail/freeradius-devel/2012-October/007185.… The other option as suggested is to add multiple IP addresses on the server or a listen statement in the configuration with a new port and use a per port clients to specify the shared secret. In the end after various different ways of achieving it I created my own custom VSA and include that in the request to determine the NAS type. Then for normal NASes I use client shortname and make decisions in code. And for my development server I don't define client shortname and pass it in as an additional VSA.

2 2

Authenticate only through Username
by Muhammad Usman 20 Feb '17

20 Feb '17

Hi, I am using currently using FreeRADIUS to authenticate customers of hotspot. But I want FR to authenticate only based on username and ignores the password. So if the username exists in radcheck table, it should send Accept, even if the password mismatches. How can I do that? Thanks

3 3

Error: Failed switching up to euid 0: No such file or directory
by André Carini 17 Feb '17

17 Feb '17

Hello everyone, I'm trying to configure FreeRADIUS 3.0.11 on LEDE (SNAPSHOT, r3157-2ef3810) to run chrooted, under a non-root user and a specific directory with the required files mounted. The problem I'm currently facing is "Error: Failed switching up to euid 0: No such file or directory" when running the server as a daemon with the chroot option enabled. The file log isn't very helpful: >root@OpenWRT-R1CL:/tmp/log# cat radius.log >Wed Feb 1 04:54:14 2017 : Info: Debugger not attached >Wed Feb 1 04:54:14 2017 : Warning: [/etc/freeradius3/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". >Wed Feb 1 04:54:14 2017 : Warning: [/etc/freeradius3/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". >Wed Feb 1 04:54:14 2017 : Info: Loaded virtual server <default> >Wed Feb 1 04:54:14 2017 : Info: Loaded virtual server default >Wed Feb 1 04:54:14 2017 : Info: Loaded virtual server inner-tunnel >Wed Feb 1 04:54:14 2017 : Error: Failed switching up to euid 0: No such file or directory However, when I run radiusd -X I face no issues. (Full -X log at the end of the email). Interestingly, when I run the daemon with user = root defined under radiusd.conf I also do not receive any errors (but that would defeat my objective of running FreeRADIUS with limited privileges). I do not know how to interpret the error message "Error: Failed switching up to euid 0: No such file or directory". I have defined the chroot destination, directory mounts and user/group definitions to the best of my ability. Please let me know if further troubleshooting and information is required. - André Carini hello(a)silkerdax.com ====================================================================== root@OpenWRT-R1CL:~# radiusd -X Server was built with: accounting : yes authentication : yes ascend-binary-attributes : yes coa : yes control-socket : yes detail : yes dhcp : yes dynamic-clients : yes osfc2 : no proxy : yes regex-pcre : yes regex-posix : no regex-posix-extended : no session-management : yes stats : yes tcp : yes threads : yes tls : yes unlang : yes vmps : yes developer : no Server core libs: freeradius-server : 3.0.11 talloc : 2.0.* ssl : 1.0.2j release pcre : 8.40 2017-01-11 Endianness: little Compilation flags: cppflags : -isystem /data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/include/ -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/include -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/include -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/usr/include -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/include/fortify -I/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/include cflags : -I/data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11 -I/data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src -include /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src/freeradius-devel/autoconf.h -include /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src/freeradius-devel/build.h -include /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src/freeradius-devel/features.h -include /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11/src/freeradius-devel/radpaths.h -fno-strict-aliasing -Os -pipe -mno-branch-likely -mips32r2 -mtune=24kc -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -msoft-float -mips16 -minterlink-mips16 -iremap /data/bowl-builder/mipsel_24kc/build/sdk/build_dir/target-mipsel_24kc_musl-1.1.16/freeradius-server-release_3_0_11:freeradius-server-release_3_0_11 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro -Wall -std=c99 -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG -DIS_MODULE=1 ldflags : -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/lib -Wl,-rpath,/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/lib -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/usr/lib -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/target-mipsel_24kc_musl-1.1.16/lib -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/usr/lib -L/data/bowl-builder/mipsel_24kc/build/sdk/staging_dir/toolchain-mipsel_24kc_gcc-5.4.0_musl-1.1.16/lib -znow -zrelro libs : -lcrypto -lssl -ltalloc -lpcre -lcap -lresolv -ldl -lpthread -lcrypto -lssl -lcrypto -lssl -lcrypto -lssl -lreadline -lncurses Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius3/dictionary including dictionary file /etc/freeradius3/dictionary including configuration file /etc/freeradius3/radiusd.conf including configuration file /etc/freeradius3/clients.conf including files in directory /etc/freeradius3/mods-enabled/ including configuration file /etc/freeradius3/mods-enabled/eap including configuration file /etc/freeradius3/mods-enabled/radutmp including configuration file /etc/freeradius3/mods-enabled/files including configuration file /etc/freeradius3/mods-enabled/sradutmp including configuration file /etc/freeradius3/mods-enabled/preprocess including configuration file /etc/freeradius3/mods-enabled/attr_filter including configuration file /etc/freeradius3/mods-enabled/always including configuration file /etc/freeradius3/mods-enabled/mschap including files in directory /etc/freeradius3/policy.d/ including configuration file /etc/freeradius3/policy.d/eap including configuration file /etc/freeradius3/policy.d/accounting including configuration file /etc/freeradius3/policy.d/filter including files in directory /etc/freeradius3/sites-enabled/ including configuration file /etc/freeradius3/sites-enabled/default including configuration file /etc/freeradius3/sites-enabled/inner-tunnel main { security { user = "radius" group = "radius" chroot = "/var/lib/freeradius3" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var/lib/freeradius3" logdir = "/var/log" run_dir = "/var/lib/freeradius3/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var/lib/freeradius3" sbindir = "/usr/sbin" logdir = "/var/log" run_dir = "/var/lib/freeradius3/run/radiusd" libdir = "/usr/lib/freeradius3" radacctdir = "/var/db/radacct" hostname_lookups = no max_request_time = 10 cleanup_delay = 5 max_requests = 5120 pidfile = "/var/lib/freeradius3/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = off log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.500000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client openwrt { ipaddr = 192.168.42.1 require_message_authenticator = yes secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = yes secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = yes secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = MS-CHAP # Creating Auth-Type = eap radiusd: #### Instantiating modules #### modules { # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius3/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 5120 } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius3/mods-enabled/radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = no check_with_nas = no permissions = 384 caller_id = yes } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius3/mods-enabled/files files { filename = "/etc/freeradius3/mods-config/files/authorize" acctusersfile = "/etc/freeradius3/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius3/mods-config/files/pre-proxy" } # Loading module "sradutmp" from file /etc/freeradius3/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius3/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius3/mods-config/preprocess/huntgroups" hints = "/etc/freeradius3/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius3/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius3/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius3/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius3/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius3/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius3/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius3/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius3/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius3/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius3/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius3/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius3/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius3/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius3/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius3/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius3/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } instantiate { } # Instantiating module "eap" from file /etc/freeradius3/mods-enabled/eap # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius3/certs" pem_file_type = yes private_key_file = "/etc/freeradius3/certs/server.key" certificate_file = "/etc/freeradius3/certs/server.pem" ca_file = "/etc/freeradius3/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius3/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "files" from file /etc/freeradius3/mods-enabled/files reading pairlist file /etc/freeradius3/mods-config/files/authorize reading pairlist file /etc/freeradius3/mods-config/files/accounting reading pairlist file /etc/freeradius3/mods-config/files/pre-proxy # Instantiating module "preprocess" from file /etc/freeradius3/mods-enabled/preprocess reading pairlist file /etc/freeradius3/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius3/mods-config/preprocess/hints # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/access_reject [/etc/freeradius3/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius3/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius3/mods-enabled/attr_filter reading pairlist file /etc/freeradius3/mods-config/attr_filter/accounting_response # Instantiating module "reject" from file /etc/freeradius3/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius3/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius3/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius3/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius3/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius3/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius3/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius3/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius3/mods-enabled/always # Instantiating module "mschap" from file /etc/freeradius3/mods-enabled/mschap rlm_mschap (mschap): using internal authentication } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius3/radiusd.conf } # server server default { # from file /etc/freeradius3/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/freeradius3/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 1813 limit { max_pps = 3000 max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 1813 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Ready to process requests

2 2

Trying to Authorize Users based on AD Groups and SSIDs
by Misbah Hussaini 17 Feb '17

17 Feb '17

Dear, I'm trying to configure PEAP Authentication with AD backend on my FR Server which is running version 3.0.4 on Centos 7. So far, I'm able to authenticate against AD but group membership checking is not working, appreciate if some help can be provided. I want to map my SSIDs - SSID02362, SSID02363 etc to AD groups so that users in specific groups can access that particular SSID. As mentioned in man page of rlm_ldap I have configured group membership check in post-auth by adding below configuration in default and inner-tunnel config files but my users are getting access-reject messages. If I remove the ldap-group check config then all users are able to authenticate and access SSID, off course without any control. post-auth { if (LDAP-Group == "FR-TEST") { noop } else { reject } } if group membership works then I can go ahead and add below config to test SSID with Group membership. (this is not one yet). post-auth { if (LDAP-Group == "FR-TEST" && Calling-Station-SSID == "SSID02362") { noop } else { reject } } Where am I going wrong? Debug can be found here -> http://pastebin.com/zSptQPaa Regards Misbah

3 9

Maximum number of virtual servers?
by Clayton Knorr 16 Feb '17

16 Feb '17

Any opinions (or hard facts) about the upper limit of virtual servers are advisable? Potentially more than 1,000 if we decide to go the virtual server route. Thanks, Clayton

5 8

Update on 3.0, 3.1, and 3.2.
by Alan DeKok 16 Feb '17

16 Feb '17

We plan on releasing 3.0.12 on Monday. it's stable, and there no new issues being reported for it. This will ideally be the last release of the 3.0 series. Version 3.0 was released almost three years ago, and it's time for a new major version of the server. 3.1 supports a "map" keyword, redis cluster, and many other useful features. Many people have been using the 3.1 branch in production, so we're confident that it is stable and functional. To keep things simple, we don't release an official 3.1 version. Instead, we will call 3.1 a "development / experimental" branch. Once we're ready (later this summer), we'll release an official 3.2 release. The v3.1.x branch will then be frozen, and no further development will occur on it. All new development will then start with a 3.3 branch, which will likely turn into version 4.0. There are enough architecture changes needed that it warrants a 4.0. In summary: 2.1 and earlier: dead. Don't use them. 2.2: Only critical security fixes. We expect this won't happen. 3.0: stable. New installations can use 3.0. 3.1: development. Use it only if you know what you're doing. 3.2: (future stable). Mid 2016 on, new installations should use this. 3.3. (future development), more changes, with a goal of increasing performance substantially.

4 6