- Freeradius-Users - lists.freeradius.org

Anyone built FR 3.0.12 pon OS X 10.10 ?
by Alex Sharaz 20 Dec '16

20 Dec '16

What's the best way to install stuff such as the taloc library? A

3 4

Cross platform secure login on wpa2
by Henti Smith 20 Dec '16

20 Dec '16

Good day all. We currently have a wpapsk wifi managed by ubiquiti unif-fi. i'm in the process of trying to move this over to a WPA2-Enterprise setup using kerberos as authentication. I used Alans the guide on http://deployingradius.com/ to get PAP and EAP working with my current certs using a local user. Next I used the Edoroam freeradius for auth against kerberos guide on https://www.eduroam.us/node/90 to setup kerberos authentication. Now this is where things go south. With a test user in users, EAP is working fine. I can auth using ./rad_eap_test -H localhost -S testing123 -u kerberos-test -p secret -P 1812 -e PEAP -m WPA-EAP However if I remove the local user and add "DEFAULT Auth-Type = Kerberos" it stops working. When I then test without EAP, using radtest kerberos-test secret localhost 0 testing123 It's working. So I can get EAP working with local users, and kerberos without EAP. What am I missing or not getting about getting them to work together to allow users to log into the wireless with existing user/pass but encrypted ? Regards Henti -- --

7 18

Regarding RADIUS Authentication feature Implementation over TLS
by Javed 20 Dec '16

20 Dec '16

Hello All, I would like to let me know about my requirement first. We have a project running under RADIUS under UDP that means we have an existing architecture and APIs to support all the user authentication to RADIUS server via PAP and CHAP under UDP. We are running on top of FreeBSD OS. We have used PAM module to do and implement the same. Requirement: We need the same authentication to happen over a secure network where we need to implement RADIUS TCP/TLS .I need to change my client configuration and required code changes has to be done to adapt with RADIUS server which supports RADIUS over TLS. Queries: Is there anywhere I can find Client side program for FreeRadius which supports TLS? Is the existing PAM module any version supports RADIUS over TLS? If You have any suggestion for client configuration and file changes in order to adapt RADIUS over TLS,You may share. Your reply will be much appreciated. Thanks & Regards, Javed Akhtar Technical Lead <mailto:jaakhtar@cisco.com> jaakhtar(a)cisco.com Tel: Cisco Systems, Inc. India cisco.com Think before you print. This email may contain confidential and privileged material for the sole use of the intended recipient. Any review, use, distribution or disclosure by others is strictly prohibited. If you are not the intended recipient (or authorized to receive for the recipient), please contact the sender by reply email and delete all copies of this message. Please <http://www.cisco.com/web/about/doing_business/legal/cri/index.html> click here for Company Registration Information.

3 4

EAP-TLS with Client Cert, with Key Usage "EAP over Lan"
by Dominik.A.Schorpp＠ids.de 19 Dec '16

19 Dec '16

Hello, I have trouble to get 802.1x Authentication with EAP-TLS properly running. My Setup is the following: Server: FreeRADIUS Version 2.2.5, for host i586-pc-linux-gnu, built on Oct 24 2014 at 04:18:43 Switch: A NEXANS iSwitch G 1043E Client/Device: Yocto based Linux with wpa_supplicant v2.4 My Problem is the usage of the "X509v3 Extendend Key Usage" in the Certificate of the Client. If I use at the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, TLS Web Client Authentication" the 802.1x Authentication with EAP-TLS is running Fine. BUT I have the constrain that the Certificate on the Client is without "TLS Web Client Authentication" because there running absolute no Client Applications, the Device is running only some Server Applications. So I tried to Use on the Client a Certificate with the "X509v3 Extendend Key Usage" : "TLS Web Server Authentication, EAP over Lan". But unfortunately the 802.1x Authentication with EAP-TLS did not work. The relevant debug Output (freeradius -X) I think is the following -------------------------CUT------------------------- Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 056b], Certificate --> verify error:num=26:unsupported certificate purpose [tls] >>> TLS 1.0 Alert [length 0002], fatal unsupported_certificate TLS Alert write:fatal:unsupported certificate TLS_accept: error in error rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Login incorrect (unsupported certificate purpose): [<----->] (from client 172.23.10.172 port 3 cli 00-12-AD-00-0E-F5) Using Post-Auth-Type REJECT -------------------------CUT------------------------- I also tried using Certificates with "X509v3 Extended Key Usage" : "TLS Web Server Authentication" and "X509v3 Extended Key Usage" : " EAP over Lan" only, but the Result are the Same. My Question is know which "X509v3 Extended Key Usage" are mandatory for the Certificate on the Device? And why is it not enough that the "X509v3 Extended Key Usage" has "EAP over LAN" in it? Thanks for Help Dominik ************************************* Dipl.-Ing. (FH) Dominik Andreas Schorpp Hard und Softwareentwickler Embedded Geräte IDS GmbH E-FW - Entwicklung Ferwirktechnik Nobelstr. 18 D-76275 Ettlingen T +49 (0) 72 43/2 18-618 F +49 (0) 72 43/2 18-100 <mailto:dominik.a.schorpp@ids.de> http://www.ids.de Geschäftsführer: Harald Herrmann, Jörn Fischer, Michael Schambach Sitz der Gesellschaft: Ettlingen Amtsgericht Mannheim HRB 362503 Ein Unternehmen der IDS-Gruppe *************************************

3 4

Re: EAP-PEAP-GTC issue
by Arjan Sinnige 17 Dec '16

17 Dec '16

Alan DeKok Wrote : > Something is going wrong with TLS. What is going wrong? Upgrade to v3 to get better error messages. Ok I've created a test freeradius server on 3.0.13 Full Debug below... Still stumped by this.. Phone must be dead or cisco NAS issues ?? This does not look like a configuration error AFAIK. (Which isn't much) Any suggestions ? Arjan FreeRADIUS Version 3.0.13 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/ldap including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/ntlm_auth including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/dhcp including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client TESTNET { ipaddr = 192.168.109.194 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap ldap { server = "192.168.109.192" identity = "cn=admin,dc=example,dc=com" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=example,dc=com" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } instantiate { } # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20442 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.109.192:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.109.192:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.109.192:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.109.192:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.109.192:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:378 } # server inner-tunnel server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 36053 Listening on proxy address :: port 48334 Ready to process requests (0) Received Access-Request Id 137 from 192.168.109.194:49205 to 192.168.109.32:1812 length 131 (0) NAS-IP-Address = 192.168.109.194 (0) NAS-Port-Type = Ethernet (0) NAS-Port = 63 (0) User-Name = "ssipwifi1" (0) Acct-Session-Id = "0500170C" (0) Called-Station-Id = "00-87-31-4B-4A-D9" (0) Calling-Station-Id = "00-15-65-AF-D2-23" (0) EAP-Message = 0x02e1000e01737369707769666931 (0) Message-Authenticator = 0x868bbf71d03afb0dba448373c27b32af (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "ssipwifi1", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 225 length 14 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_peap to process data (0) eap_peap: Initiating new EAP-TLS session (0) eap_peap: Flushing SSL sessions (of #0) (0) eap_peap: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 226 length 6 (0) eap: EAP session adding &reply:State = 0xaee2953fae008c08 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Sent Access-Challenge Id 137 from 192.168.109.32:1812 to 192.168.109.194:49205 length 0 (0) EAP-Message = 0x01e200061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xaee2953fae008c082f6a02169119b8d9 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 138 from 192.168.109.194:49205 to 192.168.109.32:1812 length 141 (1) NAS-IP-Address = 192.168.109.194 (1) NAS-Port-Type = Ethernet (1) NAS-Port = 63 (1) User-Name = "ssipwifi1" (1) Acct-Session-Id = "0500170C" (1) State = 0xaee2953fae008c082f6a02169119b8d9 (1) Called-Station-Id = "00-87-31-4B-4A-D9" (1) Calling-Station-Id = "00-15-65-AF-D2-23" (1) EAP-Message = 0x02e200060315 (1) Message-Authenticator = 0x2a5a61031a6bdcf65fc002f6d966d822 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "ssipwifi1", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 226 length 6 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop rlm_ldap (ldap): Reserved connection (0) (1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap: --> (uid=ssipwifi1) (1) ldap: Performing search in "ou=Users,dc=example,dc=com" with filter "(uid=ssipwifi1)", scope "sub" (1) ldap: Waiting for search result... (1) ldap: User object found at DN "cn=SIP-WIFI-1 SIP-WIFI-1,ou=Users,dc=example,dc=com" (1) ldap: Processing user attributes (1) ldap: control:Password-With-Header += '{SSHA}w/lNsXIXXXXXXXXXXXXX0h1eaRhMGVt' (1) ldap: control:NT-Password += 0x433233423237334534XXXXXXXXXXXXXXXXXXXXXXXXX37453735423031304341 (1) ldap: control:Ldap-PrimaryGroupId += 10004 rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://192.168.109.192:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) [ldap] = updated (1) [expiration] = noop (1) [logintime] = noop (1) pap: Converted: &control:Password-With-Header -> &control:SSHA1-Password (1) pap: Removing &control:Password-With-Header (1) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (1) pap: Normalizing SSHA1-Password from base64 encoding, 32 bytes -> 24 bytes (1) pap: WARNING: Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xaee2953fae008c08 (1) eap: Finished EAP session with state 0xaee2953fae008c08 (1) eap: Previous EAP request found for state 0xaee2953fae008c08, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type TTLS (21) (1) eap: Calling submodule eap_ttls to process data (1) eap_ttls: Initiating new EAP-TLS session (1) eap_ttls: [eaptls start] = request (1) eap: Sending EAP Request (code 1) ID 227 length 6 (1) eap: EAP session adding &reply:State = 0xaee2953faf018008 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Sent Access-Challenge Id 138 from 192.168.109.32:1812 to 192.168.109.194:49205 length 0 (1) EAP-Message = 0x01e300061520 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xaee2953faf0180082f6a02169119b8d9 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 139 from 192.168.109.194:49205 to 192.168.109.32:1812 length 239 (2) NAS-IP-Address = 192.168.109.194 (2) NAS-Port-Type = Ethernet (2) NAS-Port = 63 (2) User-Name = "ssipwifi1" (2) Acct-Session-Id = "0500170C" (2) State = 0xaee2953faf0180082f6a02169119b8d9 (2) Called-Station-Id = "00-87-31-4B-4A-D9" (2) Calling-Station-Id = "00-15-65-AF-D2-23" (2) EAP-Message = 0x02e300681500160301005d01000059030158548b761ec832a5d5f5d9a42c19c9c2ee80bf9acf4cd0773b032b009eb413d600003200390038003500160013000a00330032002f00070066000500040063006200150012000900650064006000140011000800030100 (2) Message-Authenticator = 0xc2e44bd0275ac4c299fb30237c2ed6e8 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "ssipwifi1", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 227 length 104 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xaee2953faf018008 (2) eap: Finished EAP session with state 0xaee2953faf018008 (2) eap: Previous EAP request found for state 0xaee2953faf018008, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: [eaptls verify] = ok (2) eap_ttls: Done initial handshake (2) eap_ttls: (other): before/accept initialization (2) eap_ttls: TLS_accept: before/accept initialization (2) eap_ttls: <<< recv TLS 1.0 Handshake [length 005d], ClientHello (2) eap_ttls: TLS_accept: unknown state (2) eap_ttls: >>> send TLS 1.0 Handshake [length 004a], ServerHello (2) eap_ttls: TLS_accept: unknown state (2) eap_ttls: >>> send TLS 1.0 Handshake [length 08a7], Certificate (2) eap_ttls: TLS_accept: unknown state (2) eap_ttls: >>> send TLS 1.0 Handshake [length 030d], ServerKeyExchange (2) eap_ttls: TLS_accept: unknown state (2) eap_ttls: >>> send TLS 1.0 Handshake [length 0004], ServerHelloDone (2) eap_ttls: TLS_accept: unknown state (2) eap_ttls: TLS_accept: unknown state (2) eap_ttls: TLS_accept: unknown state (2) eap_ttls: TLS_accept: Need to read more data: unknown state (2) eap_ttls: TLS_accept: Need to read more data: unknown state (2) eap_ttls: In SSL Handshake Phase (2) eap_ttls: In SSL Accept mode (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 228 length 1004 (2) eap: EAP session adding &reply:State = 0xaee2953fac068008 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) Sent Access-Challenge Id 139 from 192.168.109.32:1812 to 192.168.109.194:49205 length 0 (2) EAP-Message = 0x01e403ec15c000000c16160301004a020000460301d556064763720c86a98591833e5f928ea804b46ead813e9697735ec86f9cf959202571a53d735077767e0b8daa97ff14d760789e4526a13b6f6c81b909e8ddc9bd00390016030108a70b0008a30008a00003cd308203c9308202b1a0030201020201 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xaee2953fac0680082f6a02169119b8d9 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 140 from 192.168.109.194:49205 to 192.168.109.32:1812 length 141 (3) NAS-IP-Address = 192.168.109.194 (3) NAS-Port-Type = Ethernet (3) NAS-Port = 63 (3) User-Name = "ssipwifi1" (3) Acct-Session-Id = "0500170C" (3) State = 0xaee2953fac0680082f6a02169119b8d9 (3) Called-Station-Id = "00-87-31-4B-4A-D9" (3) Calling-Station-Id = "00-15-65-AF-D2-23" (3) EAP-Message = 0x02e400061500 (3) Message-Authenticator = 0x37f29c0a8107b349eddea0d46e2893d1 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "ssipwifi1", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 228 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0xaee2953fac068008 (3) eap: Finished EAP session with state 0xaee2953fac068008 (3) eap: Previous EAP request found for state 0xaee2953fac068008, released from the list (3) eap: Peer sent packet with method EAP TTLS (21) (3) eap: Calling submodule eap_ttls to process data (3) eap_ttls: Authenticate (3) eap_ttls: Continuing EAP-TLS (3) eap_ttls: Peer ACKed our handshake fragment (3) eap_ttls: [eaptls verify] = request (3) eap_ttls: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 229 length 1004 (3) eap: EAP session adding &reply:State = 0xaee2953fad078008 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) Sent Access-Challenge Id 140 from 192.168.109.32:1812 to 192.168.109.194:49205 length 0 (3) EAP-Message = 0x01e503ec15c000000c16eaa7da144e42143e058d4c5294b556c131f792cac9cd6e7a30df9358fa6182906aa8cea1ef7e0c71329922ae6dacb5c1dd0c30aa1a1021f94ac6d92fb0be9027d4364cdef7887b1e140004cd308204c9308203b1a0030201020209008c96fc367ca63be9300d06092a864886f7 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xaee2953fad0780082f6a02169119b8d9 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 141 from 192.168.109.194:49205 to 192.168.109.32:1812 length 141 (4) NAS-IP-Address = 192.168.109.194 (4) NAS-Port-Type = Ethernet (4) NAS-Port = 63 (4) User-Name = "ssipwifi1" (4) Acct-Session-Id = "0500170C" (4) State = 0xaee2953fad0780082f6a02169119b8d9 (4) Called-Station-Id = "00-87-31-4B-4A-D9" (4) Calling-Station-Id = "00-15-65-AF-D2-23" (4) EAP-Message = 0x02e500061500 (4) Message-Authenticator = 0xef7e59b53b2f254ecb41f48138094c29 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "ssipwifi1", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 229 length 6 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0xaee2953fad078008 (4) eap: Finished EAP session with state 0xaee2953fad078008 (4) eap: Previous EAP request found for state 0xaee2953fad078008, released from the list (4) eap: Peer sent packet with method EAP TTLS (21) (4) eap: Calling submodule eap_ttls to process data (4) eap_ttls: Authenticate (4) eap_ttls: Continuing EAP-TLS (4) eap_ttls: Peer ACKed our handshake fragment (4) eap_ttls: [eaptls verify] = request (4) eap_ttls: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 230 length 1004 (4) eap: EAP session adding &reply:State = 0xaee2953faa048008 (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) Post-Auth-Type sub-section not found. Ignoring. (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) Sent Access-Challenge Id 141 from 192.168.109.32:1812 to 192.168.109.194:49205 length 0 (4) EAP-Message = 0x01e603ec15c000000c1622687474703a2f2f7777772e736165616d7374657264616d2e636f6d2f63612e63726c300d06092a864886f70d01010b05000382010100dbe3cc84a7372bcbfb9704deb26aeeafa8d549ac5fff21be2705b1e145bcf7d7665b5b27b6cbc2c730f168805fca2b32356bac539c62 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xaee2953faa0480082f6a02169119b8d9 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 142 from 192.168.109.194:49205 to 192.168.109.32:1812 length 141 (5) NAS-IP-Address = 192.168.109.194 (5) NAS-Port-Type = Ethernet (5) NAS-Port = 63 (5) User-Name = "ssipwifi1" (5) Acct-Session-Id = "0500170C" (5) State = 0xaee2953faa0480082f6a02169119b8d9 (5) Called-Station-Id = "00-87-31-4B-4A-D9" (5) Calling-Station-Id = "00-15-65-AF-D2-23" (5) EAP-Message = 0x02e600061500 (5) Message-Authenticator = 0x5306556bb8fce31af804aad6b7bd0786 (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "ssipwifi1", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 230 length 6 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0xaee2953faa048008 (5) eap: Finished EAP session with state 0xaee2953faa048008 (5) eap: Previous EAP request found for state 0xaee2953faa048008, released from the list (5) eap: Peer sent packet with method EAP TTLS (21) (5) eap: Calling submodule eap_ttls to process data (5) eap_ttls: Authenticate (5) eap_ttls: Continuing EAP-TLS (5) eap_ttls: Peer ACKed our handshake fragment (5) eap_ttls: [eaptls verify] = request (5) eap_ttls: [eaptls process] = handled (5) eap: Sending EAP Request (code 1) ID 231 length 122 (5) eap: EAP session adding &reply:State = 0xaee2953fab058008 (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) Post-Auth-Type sub-section not found. Ignoring. (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) Sent Access-Challenge Id 142 from 192.168.109.32:1812 to 192.168.109.194:49205 length 0 (5) EAP-Message = 0x01e7007a158000000c16911d3bd3d36043b4edaa42d5a2159ffa79bc8af054a7e80d6685c936cc9756b1df3815dec7d729b9de88d88ef67f6e22ff4187231709cd5f04aadea96e4e5e813da5406eb28d25e5870cadf0656854fdf1f5a813d3da07bbf1e21860d6399a01cc20538e92eff516030100040e (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0xaee2953fab0580082f6a02169119b8d9 (5) Finished request Waking up in 4.9 seconds. (6) Received Access-Request Id 143 from 192.168.109.194:49205 to 192.168.109.32:1812 length 148 (6) NAS-IP-Address = 192.168.109.194 (6) NAS-Port-Type = Ethernet (6) NAS-Port = 63 (6) User-Name = "ssipwifi1" (6) Acct-Session-Id = "0500170C" (6) State = 0xaee2953fab0580082f6a02169119b8d9 (6) Called-Station-Id = "00-87-31-4B-4A-D9" (6) Calling-Station-Id = "00-15-65-AF-D2-23" (6) EAP-Message = 0x02e7000d150015030100020233 (6) Message-Authenticator = 0x81205696b3a6fcc2330bcaa65d6a7c27 (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/freeradius/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "ssipwifi1", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 231 length 13 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0xaee2953fab058008 (6) eap: Finished EAP session with state 0xaee2953fab058008 (6) eap: Previous EAP request found for state 0xaee2953fab058008, released from the list (6) eap: Peer sent packet with method EAP TTLS (21) (6) eap: Calling submodule eap_ttls to process data (6) eap_ttls: Authenticate (6) eap_ttls: Continuing EAP-TLS (6) eap_ttls: [eaptls verify] = ok (6) eap_ttls: Done initial handshake (6) eap_ttls: <<< recv TLS 1.0 Alert [length 0002], fatal decrypt_error (6) eap_ttls: ERROR: TLS Alert read:fatal:decrypt error (6) eap_ttls: ERROR: TLS_accept: Failed in unknown state (6) eap_ttls: ERROR: Failed in __FUNCTION__ (SSL_read) (6) eap_ttls: ERROR: error:1409441B:SSL routines:ssl3_read_bytes:tlsv1 alert decrypt error (6) eap_ttls: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure (6) eap_ttls: ERROR: System call (I/O) error (-1) (6) eap_ttls: ERROR: TLS receive handshake failed during operation (6) eap_ttls: ERROR: [eaptls process] = fail (6) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (6) eap: Sending EAP Failure (code 4) ID 231 length 4 (6) eap: Failed in EAP select (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user (6) Using Post-Auth-Type Reject (6) # Executing group from file /etc/freeradius/sites-enabled/default (6) Post-Auth-Type REJECT { (6) attr_filter.access_reject: EXPAND %{User-Name} (6) attr_filter.access_reject: --> ssipwifi1 (6) attr_filter.access_reject: Matched entry DEFAULT at line 11 (6) [attr_filter.access_reject] = updated (6) [eap] = noop (6) policy remove_reply_message_if_eap { (6) if (&reply:EAP-Message && &reply:Reply-Message) { (6) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (6) else { (6) [noop] = noop (6) } # else = noop (6) } # policy remove_reply_message_if_eap = noop (6) } # Post-Auth-Type REJECT = updated (6) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (6) Sending delayed response (6) Sent Access-Reject Id 143 from 192.168.109.32:1812 to 192.168.109.194:49205 length 44 (6) EAP-Message = 0x04e70004 (6) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. (0) Cleaning up request packet ID 137 with timestamp +36 (1) Cleaning up request packet ID 138 with timestamp +36 (2) Cleaning up request packet ID 139 with timestamp +36 (3) Cleaning up request packet ID 140 with timestamp +36 (4) Cleaning up request packet ID 141 with timestamp +36 (5) Cleaning up request packet ID 142 with timestamp +36 (6) Cleaning up request packet ID 143 with timestamp +36 Ready to process requests

2 1

Re: Freeradius 3.0.12 - Cisco EAP-Fast Supported?
by Kevin Morrison 16 Dec '16

16 Dec '16

Hi Alan, Thank you for your assistance with this! I worked with my network engineer today and we were able to confirm that PEAP works to authenticate, but when changed over to EAP-FAST, it fails as before. I have a debug log of PEAP working and then EAP-FAST failing, however, it is pretty dang large at over 4k lines in Notepad++. I am attaching the text file, with some information changed to protect internal names, MAC addresses, etc. I am extremely grateful for whatever help you can render me. Warmest regards, Kevin Morrison Systems Administrator T: +1 (704) 378-9235 C: +1 (980) 255-9668 kmorrison(a)vectorusa.com VectorUSA 2520 Whitehall Park Drive, Suite 300 Charlotte, NC 28273 Customer Service: +1 (877) 569-8800 -----Original Message----- Date: Wed, 14 Dec 2016 16:21:15 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius 3.0.12 - Cisco EAP-Fast Supported? Message-ID: <04774D10-8DB6-409F-9589-8FC7DFAE5A55(a)deployingradius.com> Content-Type: text/plain; charset=us-ascii > On Dec 14, 2016, at 3:54 PM, Kevin Morrison <kmorrison(a)vectorusa.com> wrote: > > Greetings folks, > > This is my first time posting to this mailing list, I am hoping you can answer a question/help me out. Does the newest Freeradius version 3.0.12 support the CISCO version of EAP-FAST? It's been tested against other EAP-FAST implementations. > I have been trying to get the newly created EAP FAST module to work with a Cisco WLC and Cisco device to authenticate via EAP-Fast, but I keep getting the error message about: > > (37) mschap: Client is using MS-CHAPv2 > (37) mschap: ERROR: MS-CHAP2-Response is incorrect The full debug may be more useful. > I am running on CentOS 7, as well. > > If the answer is Yes to supporting Cisco EAP FAST, then I can definitely provide the full output of radiusd -X for assistance. If the same password works for PEAP (try it), it should also work for EAP-FAST. Alan DeKok. ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ End of Freeradius-Users Digest, Vol 140, Issue 23 *************************************************

2 5

EAP-PEAP-GTC issue
by Arjan Sinnige 15 Dec '16

15 Dec '16

Hi guys, Last week I got 20 new phones (3 models) and I got 18 of them working but 2 of them are a model which can only do EAP-MD5, EAP-PEAP-GTC and EAP-TTLS-EAP-GTC. (Yealink W52P) My system is 2.2.10 from git (love to upgrade to 3.0 but that will have to wait. Will happen in first half 2017 though.. The other phones connect up with EAP-PEAP-MSCHAPv2 which works without a hitch. So I assume my uploaded CA certificates are ok. I have +/- 300 students connecting with Windows/OSX/Linux/Android/ipads/iphones and Windows Phone without an issue. But GTC is new for me.. Is there working support for GTC in 2.2.10 (build from git last march)?? When looking at the logs I notice these things : - it never gets to the inner-tunnel - TTLS does not seem to finish. [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] TLS_accept: Need to read more data: unknown state [ttls] TLS_accept: Need to read more data: unknown state - I get a fatal error. (My only guess to this is that my switch could be stopping after a number of retries(cannot disable this), or my phones are broken.) [ttls] <<< TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert read:fatal:decrypt error TLS_accept: failed in unknown state rlm_eap: SSL error error:1409441B:SSL routines:ssl3_read_bytes:tlsv1 alert decrypt error SSL: SSL_read failed inside of TLS (-1), TLS session fails. Any hints for me ?? Arjan Sinnige Full Debug : root@studentserv:/home/sinnige# freeradius -X freeradius: FreeRADIUS Version 2.2.10, for host x86_64-pc-linux-gnu, built on Mar 20 2016 at 19:51:40 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "root" group = "root" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 51200 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 192.168.109.190 { require_message_authenticator = no secret = "MYPASSWORD" shortname = "SwitchStack" nastype = "cisco" } client 192.168.109.194 { require_message_authenticator = no secret = "MYPASSWORD" shortname = "SwitchStack" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Auth-Type = LDAP Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/modules/ldap ldap { server = "127.0.0.1" port = 389 password = "MYPASSWORD" expect_password = yes identity = "cn=admin,dc=example,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 max_uses = 0 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=Users,dc=example,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(ou=Users)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(&(cn=*)(memberUid=%{%Stripped-User-Name}:-%{User-Name}}))" groupmembership_attribute = "radiusGroupName" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP gidNumber mapped to RADIUS Ldap-PrimaryGroupId rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x120aab0 Module: Linked to module rlm_always Module: Instantiating module "reject" from file /etc/freeradius/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "peap" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 42916 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.109.194 port 49205, id=222, length=131 NAS-IP-Address = 192.168.109.194 NAS-Port-Type = Ethernet NAS-Port = 63 User-Name = "ssipwifi1" Acct-Session-Id = "05001068" Called-Station-Id = "00-87-31-4B-4A-D9" Calling-Station-Id = "00-15-65-AF-D2-23" EAP-Message = 0x0201000e01737369707769666931 Message-Authenticator = 0xa26adbccad03de7fe70b5f55ca50e571 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "ssipwifi1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [ldap] performing user authorization for ssipwifi1 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ssipwifi1 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ssipwifi1) [ldap] expand: ou=Users,dc=example,dc=com -> ou=Users,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 127.0.0.1:389, authentication 0 [ldap] bind as cn=admin,dc=example,dc=com/MYPASSWORD to 127.0.0.1:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=Users,dc=example,dc=com, with filter (uid=ssipwifi1) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] gidNumber -> Ldap-PrimaryGroupId == 10004 [ldap] userPassword -> Password-With-Header == "{SSHA}w/lNsXIc3dQXXXXXXXXXXXXXXeaRhMGVt" [ldap] sambaNtPassword -> NT-Password == 0x433233423237334534XXXXXXXXXXXXXXX83546314337453735423031304341 [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 222 to 192.168.109.194 port 49205 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf3248093f32699e803792eac5869d440 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.109.194 port 49205, id=223, length=141 NAS-IP-Address = 192.168.109.194 NAS-Port-Type = Ethernet NAS-Port = 63 User-Name = "ssipwifi1" Acct-Session-Id = "05001068" State = 0xf3248093f32699e803792eac5869d440 Called-Station-Id = "00-87-31-4B-4A-D9" Calling-Station-Id = "00-15-65-AF-D2-23" EAP-Message = 0x020200060315 Message-Authenticator = 0x47c58cec3484eaff137af8e0f896b447 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "ssipwifi1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [ldap] performing user authorization for ssipwifi1 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ssipwifi1 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ssipwifi1) [ldap] expand: ou=Users,dc=example,dc=com -> ou=Users,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Users,dc=example,dc=com, with filter (uid=ssipwifi1) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] gidNumber -> Ldap-PrimaryGroupId == 10004 [ldap] userPassword -> Password-With-Header == "{SSHA}w/lNsXIc3dQXXXXXXXXXXXXXXeaRhMGVt" [ldap] sambaNtPassword -> NT-Password == 0x433233423237334534XXXXXXXXXXXXXXX83546314337453735423031304341 [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 223 to 192.168.109.194 port 49205 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf3248093f22795e803792eac5869d440 Finished request 1. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.109.194 port 49205, id=224, length=239 NAS-IP-Address = 192.168.109.194 NAS-Port-Type = Ethernet NAS-Port = 63 User-Name = "ssipwifi1" Acct-Session-Id = "05001068" State = 0xf3248093f22795e803792eac5869d440 Called-Station-Id = "00-87-31-4B-4A-D9" Calling-Station-Id = "00-15-65-AF-D2-23" EAP-Message = 0x020300681500160301005d01000059030158530887210f58d8d6b244c838f96da45450f4f86718340d1896a196652d37cc00003200390038003500160013000a00330032002f00070066000500040063006200150012000900650064006000140011000800030100 Message-Authenticator = 0xdb90c4d7b9b838a214d0de5f6470923f # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "ssipwifi1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 104 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 005d], ClientHello [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 08a7], Certificate [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 030d], ServerKeyExchange [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] TLS_accept: Need to read more data: unknown state [ttls] TLS_accept: Need to read more data: unknown state In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 224 to 192.168.109.194 port 49205 EAP-Message = 0x0104040015c000000bf6160301002a0200002603018df62fac61181c5738eaaf644f67a012285e5fe2cc6ef541bcc9fb2a274c4d680000390016030108a70b0008a30008a00003cd308203c9308202b1a003020102020101300d06092a864886f70d01010b050030818c310b3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d3120301e06092a864886f70d0109011611612e73696e6e696765407361652e6564753122302006035504030c1953414520436572746966696361746520417574686f72697479301e170d313630 EAP-Message = 0x3332323136353935385a170d3236303332303136353935385a3075310b3009060355040613024e4c310b300906035504080c024e4831163014060355040a0c0d53414520416d7374657264616d311f301d06035504030c16534145205365727665722043657274696669636174653120301e06092a864886f70d0109011611612e73696e6e696765407361652e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100a8e646288e90248e347514a9562adc1c669654454ec7634463cf7f6ff0d37a9c45413ec38f49eb9cfac08ff1ff9c3c41d64136357aece8334d35a32fae50e057154b2b3c66ed0413827928f2 EAP-Message = 0xdc908db4ca4a43180b46e3078da30a62ce15a45a0d95947aba8a8f511c2b0fbb6606bb3fdb91d814cbe24e25611e93ad1f435ea3014cc5204430fab1b5f678e5bcf1b2683013482f71e090746fb4126921036fb2cdc3e6497cd9f85b557229527a2ab56a0d76336f987e28195572c6e7f654e8dd8c7688d671fe3d178e25428a2a431e053885df4625a791287dbdfaea10f3dfc32476cb8cbe87992c0710628d5b5736be3ec785e59d88508333640cc7b5e9051d0203010001a34c304a30130603551d25040c300a06082b0601050507030130330603551d1f042c302a3028a026a0248622687474703a2f2f7777772e736165616d7374657264616d2e EAP-Message = 0x636f6d2f63612e63726c300d06092a864886f70d01010b050003820101004ed2a48cbc22c9a4b49ad922f3ebebe5d4e25ff70f41790eb52d2c2be30fada0536b2cf0191fa25e9714f76873115edc08621d308165aee6bf10adda3168462230a93073e4d62fd0f151d8b35691f1c668ae3e4f6c17338cdd16181420fb13087ee166711fcc05caf181753fcb53ecce5fec499e6bbefbdcf518c0b5150d73f272b1cabac3f082b23b900c8f4a76e956367c02f64ff93d67a8c2231746c1993cd477d4502809c33b8c5277a334dc499c6f9ade0d4657adeaa7da144e42143e058d4c5294b556c131f792cac9cd6e7a30df9358fa6182906aa8cea1ef7e0c71 EAP-Message = 0x329922ae6dacb5c1dd0c30aa Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf3248093f12095e803792eac5869d440 Finished request 2. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.109.194 port 49205, id=225, length=141 NAS-IP-Address = 192.168.109.194 NAS-Port-Type = Ethernet NAS-Port = 63 User-Name = "ssipwifi1" Acct-Session-Id = "05001068" State = 0xf3248093f12095e803792eac5869d440 Called-Station-Id = "00-87-31-4B-4A-D9" Calling-Station-Id = "00-15-65-AF-D2-23" EAP-Message = 0x020400061500 Message-Authenticator = 0xc2641a7ce4c8ecb0a0fa877c97250bbf # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "ssipwifi1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 225 to 192.168.109.194 port 49205 EAP-Message = 0x0105040015c000000bf61a1021f94ac6d92fb0be9027d4364cdef7887b1e140004cd308204c9308203b1a0030201020209008c96fc367ca63be9300d06092a864886f70d01010b050030818c310b3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d3120301e06092a864886f70d0109011611612e73696e6e696765407361652e6564753122302006035504030c1953414520436572746966696361746520417574686f72697479301e170d3136303332323136343935385a170d3236303332303136343935385a30818c310b EAP-Message = 0x3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d3120301e06092a864886f70d0109011611612e73696e6e696765407361652e6564753122302006035504030c1953414520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100de6649176647c36cbec1bc7545e5ab88c8ab3bd57d63e6cac9d0a28676d45477cd54f5a09e5026506c37db77e7216cecc63fe1f1685daa101ff58f0232ce8e63e0df9e9d934c7086bb76f4d676f4c97c2b5c EAP-Message = 0x24084676e3a03c055fbf6483a21b3996618ffc52e9b0e3843eb75a604e1936071a307eb09be8392ede3d55355d1d80be2b2ae4943bde3fc0e577cc5603d854bb39d1298dabd3896d1cb206f018bba68c1e399f6a2590290544a51a38cd89fddc5661bffdadd912653d0289dc80c6bda51342319638b3977265b289e34e998acb615339f2f9ae9bb97b70fd42bdce98c326f03cb91a1705abcf6f51ec997fdbdea598fe21a8e1552999e0bed71c4b0203010001a382012a30820126301d0603551d0e0416041431193dc758d4d6c2f73a147365c3cd0d39a238833081c10603551d230481b93081b6801431193dc758d4d6c2f73a147365c3cd0d39a238 EAP-Message = 0x83a18192a4818f30818c310b3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d3120301e06092a864886f70d0109011611612e73696e6e696765407361652e6564753122302006035504030c1953414520436572746966696361746520417574686f726974798209008c96fc367ca63be9300c0603551d13040530030101ff30330603551d1f042c302a3028a026a0248622687474703a2f2f7777772e736165616d7374657264616d2e636f6d2f63612e63726c300d06092a864886f70d01010b05000382010100dbe3cc84a7 EAP-Message = 0x372bcbfb9704deb26aeeafa8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf3248093f02195e803792eac5869d440 Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.109.194 port 49205, id=226, length=141 NAS-IP-Address = 192.168.109.194 NAS-Port-Type = Ethernet NAS-Port = 63 User-Name = "ssipwifi1" Acct-Session-Id = "05001068" State = 0xf3248093f02195e803792eac5869d440 Called-Station-Id = "00-87-31-4B-4A-D9" Calling-Station-Id = "00-15-65-AF-D2-23" EAP-Message = 0x020500061500 Message-Authenticator = 0x6fc6823020c04432d9acf82f0c9ee2c2 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "ssipwifi1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 226 to 192.168.109.194 port 49205 EAP-Message = 0x0106040015c000000bf6d549ac5fff21be2705b1e145bcf7d7665b5b27b6cbc2c730f168805fca2b32356bac539c62e383a77d29c940ddd0757fc9cf07bd7978b8074973474e76dbea9adb2fd2db612de5c78098f30236cc501bb9980c3b798535b40a9660b5533a083b0882dea880d2899bd515a797b381be09d4c7174cc19492d683d11cd381b7f2cab27109b64e91d7ccccf9b58b3f80d2fcd44aa4dad8405c516663edbc4dfca0a8ee682635307b2f458290bbc430ea2975d31822a546ea4f87f645864750dd184169b44b0d02e93ac54ff225e6f4f74a579e230953832fc90092f10ba94efa2b070e67d44338a7fb3488a6bf56c7487216030103 EAP-Message = 0x0d0c0003090100d22106c0a5b03700957f1cb02d3b9766efbb63576466492685ee475d6ed4c1565f1b3c2e0a5f8281c29398ad39093232179f2c838c3e413fa982c7906e1bbce2e8977a9f477656115b5059ba1ef44053ec2e86b9fc5d029992ae0acfe1a7895db3bb9436198319d28cfe44e1be3a5b67253956dd11543dd2c01cf1fbd68a19914c36fa76420c7032b5b8d4804b3641164bcbbf78241cd5a148a5748fb6b472d68051da53e660c513bb97e55511db9ac81c5b725a9e13a61a1da813cb8da5f7a2e5e7aab5e638ea3c64d995c6398ff1ba4b7b909b8ef7ac962a1c197e13f9a3af91c5789e7fa0480352cd88b224b12b3ce48a86478e97 EAP-Message = 0xf06fc2ff6e318e8744eb0001020100c3e72471fecb556c93dd53d51acde1f3729dcae17952767bd763cb16293b64b6d0d65eed6799d4d66d360eb8f51195742183036ee7a1b181f4e019a995d29436bceef78c8d9453c57cc5bb3af8308c5407b60ab5670084894907d4280dd97b35aef727c77086f9633d2feca8cdede8eb5fd0818a7e837f474aa2e624abe54357653105501ae950e57f0bf00cd725b561636842f1d64261bf13e137c4e34df1111a06d6cd094435a6a365df538b8606ccef7373b4bbc75b18b0cd5c3ba94b5a3350df915d3b8473b5cc9f3f4ac33004cbfe9339fcb20d0f083a88df3933e8b61c32708947b20fa099db88abe16938 EAP-Message = 0x7b835550d3ce2717c53f8937aa84fa764547010061532482fba13e2b8741883cd54c0254234beaaadff4e6cd9c29b0aed7afd8df3103da418cb71e4e290be7a2e373c31176d0dcd1f922dd3a7507a7b10adbc17bac6d1cd0999d5936703274856263c2c2d9d7d5430f319991ffe7c45c2b1383e8bb1c1da85d8faac14408affd9da642cb4a2db936ba18a711ea9ffd90154cb986e2dd444585787152e3cbb08133ce5bfd206ae3ff56b165026b394c4b20e4a17167030eaae2ffd7f42ade0bcee706f34a63220dd0a6f0a0e3825ca65daa6bb8bef72115a7b55a69812304f12374274353b570d0f1dcbe794e63f9e34b6bc965b3ed240edee6969000b8 EAP-Message = 0x217354c3ccaf26f033f83583 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf3248093f72295e803792eac5869d440 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.109.194 port 49205, id=227, length=141 NAS-IP-Address = 192.168.109.194 NAS-Port-Type = Ethernet NAS-Port = 63 User-Name = "ssipwifi1" Acct-Session-Id = "05001068" State = 0xf3248093f72295e803792eac5869d440 Called-Station-Id = "00-87-31-4B-4A-D9" Calling-Station-Id = "00-15-65-AF-D2-23" EAP-Message = 0x020600061500 Message-Authenticator = 0x4e3105a4d4c92d23c6f2ba0bb7cb7cd1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "ssipwifi1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 227 to 192.168.109.194 port 49205 EAP-Message = 0x0107001e158000000bf6538bc8711672573639644816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf3248093f62395e803792eac5869d440 Finished request 5. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.109.194 port 49205, id=228, length=148 NAS-IP-Address = 192.168.109.194 NAS-Port-Type = Ethernet NAS-Port = 63 User-Name = "ssipwifi1" Acct-Session-Id = "05001068" State = 0xf3248093f62395e803792eac5869d440 Called-Station-Id = "00-87-31-4B-4A-D9" Calling-Station-Id = "00-15-65-AF-D2-23" EAP-Message = 0x0207000d150015030100020233 Message-Authenticator = 0xe509af21a3d2eb70c5d6faf28cda7bb1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "ssipwifi1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 7 length 13 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert read:fatal:decrypt error TLS_accept: failed in unknown state rlm_eap: SSL error error:1409441B:SSL routines:ssl3_read_bytes:tlsv1 alert decrypt error SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Login incorrect (TLS Alert read:fatal:decrypt error): [ssipwifi1] (from client SwitchStack port 63 cli 00-15-65-AF-D2-23) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> ssipwifi1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 228 to 192.168.109.194 port 49205 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds.

2 1

FreeRadius LDAP group verification
by Stefan Sundberg 15 Dec '16

15 Dec '16

Hi I am using FreeRadius 3 to authenicate Wifi users with WPA2 enterprise which are then checked in a OpenLDAP directory. This is working fine as long as I accept that all users in base_dn = 'ou=People,dc=example,dc=se' can use the Wifi. To guard againt this I have worked to implement LDAP Group checking in FreeRadius 3 and this seems not to to be working. Even if I mess up the filter settings under the ”Group” section in /usr/local/etc/raddb/mods-enabled/ldap, FreeRadius gladly accepts the user as long as the user/password is OK. The Group section does not seem to affect the process at all. I am using FreeRadius 3.0.12 and OpenLDAP 2.4.44 which are running happily on FreeBSD 10.3 i386. Best Regards Stefan Sundberg User section of the FreeRadius ldap file: user { # Where to start searching in the tree for users base_dn = 'ou=People,dc=example,dc=se' # Filter for user objects, should be specific enough # to identify a single user object. # # For Active Directory, you should use # "samaccountname=" instead of "uid=" # filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" } Group section of the FreeRadius ldap file: group { # Where to start searching in the tree for groups base_dn = 'ou=Groups,dc=example,dc=se' # Filter for group objects, should match all available # group objects a user might be a member of. # Radius is an existing LDAP Group under 'ou=Groups,dc=example,dc=se' filter = '(cn=Radius)' # Attribute that uniquely identifies a group. # Is used when converting group DNs to group # names. name_attribute = cn # Filter to find group objects a user is a member of. # That is, group objects with attributes that # identify members (the inverse of membership_attribute). membership_filter = "(|(member=%{control:Ldap-UserDn})(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" # The attribute in user objects which contain the names # or DNs of groups a user is a member of. # Unless a conversion between group name and group DN is # needed, there's no requirement for the group objects # referenced to actually exist. membership_attribute = 'memberUid' } Debug print of radiusd -X: (0) Received Access-Request Id 48 from 192.168.5.250:3759 to 192.168.5.249:1812 length 117 (0) User-Name = "myuser" (0) Acct-Session-Id = "1481748386W82ujh" (0) NAS-IP-Address = 127.0.0.1 (0) NAS-Identifier = "Localhost" (0) NAS-Port = 0 (0) Calling-Station-Id = "1115551212" (0) User-Password = "password" (0) Message-Authenticator = 0x5e20b42290bb652cd15b5355b41d0b4d (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "myuser", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=myuser) (0) ldap: Performing search in "ou=People,dc=example,dc=se" with filter "(uid=myuser)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=myuser,ou=People,dc=example,dc=se" (0) ldap: Processing user attributes (0) ldap: control:Password-With-Header += 'password' rlm_ldap (ldap): Released connection (0) rlm_ldap (ldap): Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = updated (0) [expiration] = noop (0) [logintime] = noop (0) pap: No {...} in Password-With-Header, re-writing to Cleartext-Password (0) pap: Removing &control:Password-With-Header (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Login OK: [myuser/password] (from client ts01 port 0 cli 1115551212) (0) Sent Access-Accept Id 48 from 192.168.5.249:1812 to 192.168.5.250:3759 length 0 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 48 with timestamp +33 Ready to process requests

2 2

Re: Cross platform secure login on wpa2
by Brian Candler 15 Dec '16

15 Dec '16

On 15/12/2016 09:23, Henti Smith wrote: > That is correct. I just can't find the documentation to outline how to > achieve this, hence using two documents each, detailing one component > and ending up where I am. > > If I can be pointed in a direction of some documentation that covers > exactly that, it would help a great load. > OK. I don't have that I'm afraid. I have one pointer which may help. In your EAP outer config (the "default" virtual server) you may want something like this: eap { ok = return updated = return # << new } This is to ensure that any modules you put after this aren't invoked during an EAP exchange, except at the very end. The problem I found originally was with a config like this: eap { ok = return } mypolicy In "mypolicy" I was setting Auth-Type := reject in some circumstances, based on group membership. This was resulting in the user being rejected part-way through the EAP exchange, because (1) during one of the intermediate EAP steps, the eap module returns "updated" instead of "ok", and so it fell through to the next step of the default server; and (2) at that point, mypolicy was seeing the outer (anonymous) identity, not the true identity of the user. I'm afraid I don't know how to invoke the krb5 module. In the documentation at https://wiki.freeradius.org/modules/Rlm_krb5 it says: Auth-Type Kerberos { krb5 } However it's not at all clear to me how Auth-Type := Kerberos is set in the first place. You may have to do this explicitly in the inner tunnel virtual server, e.g. at the end of the authorize section put something like Auth-Type = Kerberos (the '=' operator will set it only if it's not already been set to something else already) Looking through the source: the rlm_krb5 module doesn't have an authorize hook which could do this. However the rlm_pap module appears to have functionality to set the auth type to its own name. Hence, if you create an instance of the rlm_pap module called "Kerberos" this may do what you want; but this is not mentioned in the rlm_pap manpage. Regards, Brian.

1 0

Freeradius 3.0.12 - Cisco EAP-Fast Supported?
by Kevin Morrison 14 Dec '16

14 Dec '16

Greetings folks, This is my first time posting to this mailing list, I am hoping you can answer a question/help me out. Does the newest Freeradius version 3.0.12 support the CISCO version of EAP-FAST? I have been trying to get the newly created EAP FAST module to work with a Cisco WLC and Cisco device to authenticate via EAP-Fast, but I keep getting the error message about: (37) mschap: Client is using MS-CHAPv2 (37) mschap: ERROR: MS-CHAP2-Response is incorrect I am running on CentOS 7, as well. If the answer is Yes to supporting Cisco EAP FAST, then I can definitely provide the full output of radiusd -X for assistance. Thank you! Kevin Morrison Systems Administrator T: +1 (704) 378-9235 C: +1 (980) 255-9668 kmorrison(a)vectorusa.com<mailto:kmorrison@vectorusa.com> VectorUSA 2520 Whitehall Park Drive, Suite 300 Charlotte, NC 28273 Customer Service: +1 (877) 569-8800 [cid:AVectorUSA_logo_com_on_white.bmp]<www.vectorusa.com>

3 2