- Freeradius-Users - lists.freeradius.org

Using privacyIDEA to authenticate to WiFi with 2FA/Token
by Muenz, Michael 30 Nov '16

30 Nov '16

Hi guys, I have a running setup with privacyIDEA to authenticate VPN users via Token. There's a perl module redirecting the token stuff to the local webserver doing their magic. In order to to run this setup I have to set Default Auth Type to perl in users file. Now I have a customer asking to extend WiFi security with tokens. My thought was no big deal, but there's EAP! :) After some google it was clear to use TTLS and PAP. First problem, when I setup my AP's for radius and Default Auth is perl, EAP won't get called. OK, then I set Default Auth to EAP and bang, EAP starts and everything seems to run fine in inner-tunnel. But then I want to bump perl in authenticate section to give the request to the webserver. What now happens is, that perl won't get recognized and instead again Defaut Auth is chosen and it tries to do MD5. I played around with ttls and md or gtc, inserted perl in authorized section and so on, nothing worked. Enclosed is a (huge) debug, hoping that someone has a clue whats going on (comments inline): --> Initial request rad_recv: Access-Request packet from host ip port 57736, id=87, length=153 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x0200000a016d75656e7a Message-Authenticator = 0x360bad25b59c6c79d36ab8f73531836e # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry DEFAULT at line 205 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop --> perl in authorize, normally not needed (was a test) rlm_perl: Added pair EAP-Message = 0x0200000a016d75656e7a rlm_perl: Added pair Calling-Station-Id = 30-3A-64-D8-D2-13 rlm_perl: Added pair NAS-IP-Address = ip rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair Message-Authenticator = 0x360bad25b59c6c79d36ab8f73531836e rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Connect-Info = CONNECT 0Mbps 802.11a rlm_perl: Added pair User-Name = user rlm_perl: Added pair Called-Station-Id = BC-16-F5-DB-57-F0:SSID rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Auth-Type = EAP ++[perl] = ok +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 87 to ip port 57736 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f5678760a3d6495143e099646c4 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=88, length=470 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x02010133150016030101280100012403035469c1888d984c755f09fa127b5a4fd73d3f5e3d76dd0492e39691ff0acbcca10000aac030c02cc028c024c014c00a00a500a300a1009f700860085c032c02ec02ac026c00fc005009d003d00350084c02fc02bc027c023c013c00900a400a200a0009e00670040003f003e0033003200310030009a0099009800970045004400430042c031c02dc029c020cc00200050004c012c008001600130010000dc00dc003000a00ff01000051000b000403000102000a001c001a00170019001c001b0018001a00 EAP-Message = 0x16000e000d000b000c0009000a000d0020001e060106020603050105020503040104020403030103020303020102020203000f000101 State = 0x78771f5678760a3d6495143e099646c4 Message-Authenticator = 0xa2dcbc0456f99c4088c081ea40caa72f # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 253 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls --> OK, going for ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0128], ClientHello [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 003e], ServerHello [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 02d4], Certificate [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state --> is this OK? [ttls] TLS_accept: Need to read more data: unknown state In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 88 to ip port 57736 EAP-Message = 0x0102040015c000000475160301003e0200003a0301fb61a70bc00f4f72254a4961295db23a021ab31db031a2ec5e30f09766eeb92500c014000012ff01000100000b000403000102a308202c6308201aea003020102020900f42e74c60803a393300d06092a864886f70d01010b0500301b3119301706035504030c106f74702e6d627261756e2e6c6f6b616c301e170d3136313132323135323532319301706035504030c106f74702e6d627261756e2e6c6f6b616c30820122300d06092a864886f70d01010105000382010f003082010a02820101 EAP-Message = 0x00c2d539f913b49bddf44e1896b3664ef5414c1e58a0c1263f9c39e0ff204987c19cae285e655970bc06cd5d418e344b24e13cc25fcedfe44b0dceb07563b23a4763f78b0c04db0e0c0046112b6598a674fadc501c0a06361e341c9e5864243551139d5f5fdc235f6f6c0fe211095075ffdf599691fbc583be069c6206539c77288d239f513fb4e56b430df3c9e697dc109fdc2a8e7041049bebde035ef358cf6c8d0185e22b211573ffb36f719017802cac937dce660ae8e6e6c990b46992150fb66c106304bb88c6a63d3fda8c947ceb77eb33a6c4 EAP-Message = 0x991e98690203010001a30d300b30090603551d1304023000300d06092a864886f70d01010b05000382010100c011c45596161f6474a37be2d223e3dd858c194f824a65ec9174cadd54dc523a97820f572379b761fb43b43d1e356e3e36ba4c1fdecd821aef7413344a8072f17c7d8e1c3c6d9e2f064999f600f04d2b6d3d357a91cdf0a60313becaa9503ab79e523471d266d5c3a104580fd6f33c246c24c8d9f9ecbdbe93471e78fb23cc14a01418ee79a7029adaf00ebede94f7dd60b0558136e2b8534a6c9280a012749c5f2fdbcf8be8d8fe6ee9 EAP-Message = 0x9af28691cd18ddbba01e4b85a9f82cfec7eb4201fb914bb9df179d05a1135ed94eb5b0e67a4b6dc13601ccdbe5b970160301014b0c0001470300174104880a6cadb0bda6009cb3b209cd1ab676aecc9445bab4ad851c75e61a0037316b16f93ec6fcbb77722df1dfc5f01008ba6dc4c785bbbaefa09f4c0a751c5c7269ff7ebb5f7e8c67f659c8454f919e96a0adef063bfec5963e07ce2b7aa293159462acbc323ace3570daf0d09e83111a3fe9ddb279a59b126c591b386276dae1922cdf428cd02871bda42dceeb4a16171f332d0e95cb30dcc17b EAP-Message = 0x8e2faa751416e9b4519b8898 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f5679750a3d6495143e099646c4 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=89, length=167 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x020200061500 State = 0x78771f5679750a3d6495143e099646c4 Message-Authenticator = 0xd5e8cfd8ef6c17173e3b4362999ef8e3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 89 to ip port 57736 EAP-Message = 0x010300891580000004759fe317ceebd982fddebffd0960319e213113c8228478e9b467d2beebcef7aacff48414466d77007618337e74bbde1ba4f48ee628129c948a5dae987aafaa6ab658f1b3ab06b9c15495e21cb24d905978e5b9657b14b013747805521a05c5ac23e3b4b16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f567a740a3d6495143e099646c4 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=90, length=301 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x0203008c15001603010046100000424104e2eb375029681f678e5f1c36bfc89b18bb3a00538a95c0274746cf2c7d80d65401633768320eedc9611e0488a3ee26f65f4876f6a366ed051d6bf03d28b8a706ab96ab8a779b307ccbc7b349ef5aa56a5cb952c50576cefca870fc83524c24fc5b90c0cae016f2d State = 0x78771f567a740a3d6495143e099646c4 Message-Authenticator = 0xd761d7690d32fe8b142236eab7f6a1e8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 140 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] (other): SSL negotiation finished successfully --> Yay, sounds good to me SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 90 to ip port 57736 EAP-Message = 0x0104004515800000003b1403010001011603010030aa0ee47b503121259d548b3cf09b32b5fb7ae3aa7f25d8a0711e2e04f4e240dffa2b84c3272d94a1f6e142cb1c3a391d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f567b730a3d6495143e099646c4 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=91, length=257 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x02040060150017030100207d47ce2ba9ec180dd6fcf0b76e10dde249052da789ab7f9c7ce75204d0b524581703010030a14ec7133706d825b25db9e853c237b4347d0e1b9879d43879a3ce68a State = 0x78771f567b730a3d6495143e099646c4 Message-Authenticator = 0x6928c5095c5c258d6c87ec5f879ec11b # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 96 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x0200000a016d75656e7a FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Got tunneled identity of user [ttls] Setting default EAP type for tunneled EAP session. [ttls] Sending tunneled request EAP-Message = 0x0200000a016d75656e7a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" --> Finally, reaching inner-tunnel, but perl won't get called, it's in first place in authenticate server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] EAP Identity [eap] processing type gtc [gtc] expand: Password: -> Password: ++[eap] = handled +} # group authenticate = handled } # server inner-tunnel [ttls] Got tunneled reply code 11 EAP-Message = 0x0101000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x81d6c4cf81d7c2d83ec9c570cb69f51e [ttls] Got tunneled Access-Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 91 to ip port 57736 EAP-Message = 0x0105003f1580000000351703010030c5db273c3c863eb6b3764a1ed973cd99053166c7fa89d6dc788cb711eae8a72d598037ff2571d3cf8b7ab755794fa29b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f567c720a3d6495143e099646c4 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=92, length=257 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x0205006015001703010020115f8cd11b96b37c00098fb2e5afdef35d419b9f3a06e9333508562ba52bd9941703010030a53ad47636c229f2d43a3884d6de2699fc1fbe65ac79c0be2addff875 State = 0x78771f567c720a3d6495143e099646c4 Message-Authenticator = 0xe18b09b565a096b5c48229e326ba51fe # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 96 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x020100060304 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x020100060304 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" State = 0x81d6c4cf81d7c2d83ec9c570cb69f51e server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/md5 [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled } # server inner-tunnel [ttls] Got tunneled reply code 11 EAP-Message = 0x01020016041054ab7a2ac661b1a17f04daa40325d1bb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x81d6c4cf80d4c0d83ec9c570cb69f51e [ttls] Got tunneled Access-Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 92 to ip port 57736 EAP-Message = 0x0106004f15800000004517030100408ce10260b1e93c4c05898048ef94aac42357aba82089743442651a4f2d969ac0cdc51243d784827f97571443b8cd2ce9c8afb692e8f641e684 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f567d710a3d6495143e099646c4 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=93, length=273 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x0206007015001703010020d6cbb1a3a5f469fb69725dcc5585d44cee709422a062a0069002373e41c1a50b17030100404b1af9b738abecc14342b16efacf53eca017241d9f3ffa4b9b970b9ba804bd977ebef8a6ac6aff592d3caaf36 State = 0x78771f567d710a3d6495143e099646c4 Message-Authenticator = 0x686be1d650b37ad2e406ed39ef1dfa5e # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 112 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x0202001604102d9b5073ce522d5e72a61cf2673bbb36 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x0202001604102d9b5073ce522d5e72a61cf2673bbb36 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" State = 0x81d6c4cf80d4c0d83ec9c570cb69f51e server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 2 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 --> Yes I know, but I should call perl rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated } # server inner-tunnel [ttls] Got tunneled reply code 3 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user user [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 93 to ip port 57736 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 87 with timestamp +12 Cleaning up request 1 ID 88 with timestamp +12 Cleaning up request 2 ID 89 with timestamp +12 Cleaning up request 3 ID 90 with timestamp +12 Cleaning up request 4 ID 91 with timestamp +12 Cleaning up request 5 ID 92 with timestamp +12 Waking up in 1.0 seconds. Cleaning up request 6 ID 93 with timestamp +12 Ready to process requests. It's a fresh Debian 8 install with FR 2.2.5 deb package. What I canged from the default was the client in clients.conf, DEFAULT Auth-Type := eap/perl in users. In eap.conf change default to ttls, in section ttls tried md5 and gtc. In modules/perl linked to the module and added perl/eap to default and inner-tunnel. Any ideas? Thanks, Michael

4 9

FR 3.1 access-accept
by Chris Howley 30 Nov '16

30 Nov '16

Hi, In using eapol_test against FreeRADIUS 2.2.3 and 3.1 (3.1.0-dead (git #4870102)) I noticed that the following attributes are NOT included in the Access-Accept sent by FR 3.1: EAP-MSK, EAP-EMSK and EAP-Session-Id. Are these attributes required in the Access-Accept? If so, how can I copy them from the inner-tunner server to the Access-Accept? Thanks, Chris 1. FreeRADIUS 2.2.3 Mon Nov 28 08:46:27 2016 : Debug: # Executing section post-auth from file /etc/raddb/sites-enabled/LOCAL-WLAN-outer Mon Nov 28 08:46:27 2016 : Debug: +group post-auth { Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{reply:Packet-Type} -> Access-Accept Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{Operator-Name} -> Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] ... expanding second conditional Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{Calling-Station-ID} -> 02:00:00:00:00:01 Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{NAS-IP-Address} -> 127.0.0.1 Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{NAS-Port} -> Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] ... expanding second conditional Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %t : %{%{reply:Packet-Type}:-unknown-method} [%{User-Name}] ( %{%{Operator-Name}:-No_Operator} client=%{%{Calling-Station-ID}:-00:00:de:ad:be:ef} NAS-IP-Address %{%{NAS-IP-Address}:-0.0.0.0} port %{%{NAS-Port}:-0}) -> Mon Nov 28 08:46:27 2016 : Access-Accept [testuser(a)leeds.ac.uk] ( No_Operator client=02:00:00:00:00:01 NAS-IP-Address 127.0.0.1 port 0) Mon Nov 28 08:46:27 2016 : Debug: ++[linelog_reply] = ok Mon Nov 28 08:46:27 2016 : Debug: ++[exec] = noop Mon Nov 28 08:46:27 2016 : Debug: +} # group post-auth = ok Mon Nov 28 08:46:27 2016 : Debug: Sending Access-Accept packet to host X.X.X.X port 49011, id=11, length=0 Mon Nov 28 08:46:27 2016 : Debug: User-Name = "testuser" Mon Nov 28 08:46:27 2016 : Debug: MS-MPPE-Recv-Key = 0x88f27e096616e54304666947eaa5c38d3b3b62ba9b116e0c2b476718a56ca767 Mon Nov 28 08:46:27 2016 : Debug: MS-MPPE-Send-Key = 0xbb1a28fa8663a7c7516d89ed921db7159fc05315f5578e7c715fe9261d83ddd6 Mon Nov 28 08:46:27 2016 : Debug: EAP-MSK = 0x88f27e096616e54304666947eaa5c38d3b3b62ba9b116e0c2b476718a56ca767bb1a28fa8663a7c7516d89ed921db7159fc05315f5578e7c715fe9261d83ddd6 Mon Nov 28 08:46:27 2016 : Debug: EAP-EMSK = 0x22ad8973c9357152405aec86b3911658adde465b54757f85d8b35e32fc89bb4e6ba96fc01bd1497afc430b403d51487f0df830c75b11fc40edc42595eb4ea37d Mon Nov 28 08:46:27 2016 : Debug: EAP-Session-Id = 0x19583beee34ffd6c9a5fa449c2ee1648b00378dcf0123d0ec8deed9d57ec59edf7583beee384531fad7b0362375c1618ad5923cec29d453037d7b4f88594db792f Mon Nov 28 08:46:27 2016 : Debug: EAP-Message = 0x030b0004 Mon Nov 28 08:46:27 2016 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Mon Nov 28 08:46:27 2016 : Debug: Finished request 287510. 2. FreeRADIUS 3.1 (12,1) Using 'Auth-Type = eap' for authenticate {...} (12,1) Running Auth-Type eap from file /etc/raddb/sites-enabled/default (12,1) Auth-Type eap { (12,1) eap - Peer sent packet with EAP method PEAP (25) (12,1) eap - Calling submodule eap_peap to process data (12,1) eap_peap - Continuing EAP-TLS (12,1) eap_peap - Got complete TLS record (74 bytes) (12,1) eap_peap - [eap-tls verify] = complete (12,1) eap_peap - Decrypted TLS application data (11 bytes) (12,1) eap_peap - [eap-tls process] = complete (12,1) eap_peap - Session established. Decoding tunneled data (12,1) eap_peap - PEAP state send tlv success (12,1) eap_peap - Received EAP-TLV response (12,1) eap_peap - Success (12,1) eap_peap - Adding session keys (12,1) eap_peap - &reply:MS-MPPE-Recv-Key = 0xc81a9fdb4896685f70a38fcf16fe2403b8c3a767e6f9537be9b51b34ee21f755 (12,1) eap_peap - &reply:MS-MPPE-Send-Key = 0x96c61060a7081969287257d3905acfc21f27ae5093c42ed9b057a2be6c818a21 (12,1) eap_peap - &reply:EAP-MSK = 0xc81a9fdb4896685f70a38fcf16fe2403b8c3a767e6f9537be9b51b34ee21f75596c61060a7081969287257d3905acfc21f27ae5093c42ed9b057a2be6c818a21 (12,1) eap_peap - &reply:EAP-EMSK = 0xb96c201642eb34b43d228b912522eb2fef02d0fbd93a60d2d4d1c90ce5dea84c5a288b49d95fbd9ae1eabfa681064f5e8b1a190ce97500aa79f0a93fffdc0ed7 (12,1) eap - Sending EAP Success (code 3) ID 11 length 4 (12,1) eap - Cleaning up EAP session (12,1) eap (ok) (12,1) if (handled && (Response-Packet-Type == Access-Challenge)) { (12,1) ... (12,1) } (12,1) } # Auth-Type eap (ok) (12,1) Login OK: [testuser@realm] (from client netserv5 port 0 cli 02:00:00:00:00:01) (12,1) Running section post-auth from file /etc/raddb/sites-enabled/default (12,1) post-auth { (12,1) update { (12,1) &reply: += &session-state:Stripped-User-Name -> "testuser" (12,1) &reply: += &session-state:Reply-Message -> "successful authentication" (12,1) } # update (noop) (12,1) update reply { (12,1) &reply:Reply-Message := successful authentication (12,1) } # update reply (noop) (12,1) default-accept-log - Using default message (12,1) default-accept-log - EXPAND %S (%l) id %I DEFAULT ACCEPT %{User-Name} cli %{%{Calling-Station-Id}:--} auth-type %{control:Auth-Type}/%{EAP-Type} realm %{Realm} operator %{%{Operator-Name}:--} client %{%{Packet-Src-IP-Address}:-%{%{Packet-Src-IPv6-Address}:--}} (%{Client-Shortname}) essid (%{%{Called-Station-SSID}:--}) reply-msg '%{reply:Reply-Message}' (12,1) default-accept-log - --> 2016-11-28 13:44:16 (1480340656) id 11 DEFAULT ACCEPT testuser@realm cli 02:00:00:00:00:01 auth-type eap/PEAP realm realm operator - client Y.Y.Y.Y (netserv5) essid (-) reply-msg 'successful authentication' (12,1) default-accept-log - EXPAND /var/log/radius/auth.log (12,1) default-accept-log - --> /var/log/radius/auth.log (12,1) default-accept-log (ok) (12,1) exec (noop) (12,1) remove_reply_message_if_eap { (12,1) if (&reply:EAP-Message && &reply:Reply-Message) { (12,1) update reply { (12,1) &reply:Reply-Message !* ANY (12,1) } # update reply (noop) (12,1) } # if (&reply:EAP-Message && &reply:Reply-Message) (noop) (12,1) else { (12,1) ... skipping else for request 12: Preceding "if" was taken (12,1) } (12,1) } # remove_reply_message_if_eap (noop) (12,1) } # post-auth (ok) (12,1) Sent Access-Accept Id 11 from Y.Y.Y.Y:1812 to Y.Y.Y.Y:53223 via em1 length 0 (12,1) MS-MPPE-Recv-Key = 0xc81a9fdb4896685f70a38fcf16fe2403b8c3a767e6f9537be9b51b34ee21f755 (12,1) MS-MPPE-Send-Key = 0x96c61060a7081969287257d3905acfc21f27ae5093c42ed9b057a2be6c818a21 (12,1) EAP-Message = 0x030b0004 (12,1) Message-Authenticator = 0x00000000000000000000000000000000 (12,1) Finished request

2 1

Stopping Service After Marking Home_Server as Dead
by Avni German 30 Nov '16

30 Nov '16

Hi all, I am using freeradius 3.0.4 version on CentOS 7. And whenever my proxy servers mark as dead, radius service is stopped. At first I get "Proxy: Marking home server x.x.x.x port 1812 as dead." Log and the service is stopped. I changed proxy.conf a bit and log has changed. It says "Error: Failed adding event handler for socket!" and the service is stopped. And I could not get any more logs. I found a mailing about the same issue (http://lists.freeradius.org/pipermail/freeradius-users/2014-October/074120. html) but there was no solution. My proxy server is also proxying requests to core radius servers for eduroam. There is nothing I could do for proxy fails. I have an average of 3000 concurrent users and this cause me a lot of trouble. What should I do? Proxy Configuration sample: home_server External { type = auth ipaddr = x.x.x.x port = 1812 secret = secret num_answers_to_alive = 10 no_response_fail = no status_check = status-server check_interval = 10 } Note that, I tried all variations of proxy.conf but I could not solve it. Thanks for your help. Regards Avni

2 1

Username OR Serial Number
by David Teston 29 Nov '16

29 Nov '16

Hi All, I'd like to enable users to enter their username OR serial number as the &User-Name variable, then let /policy.d/filter determine how to process it. This would also require that I add an attribute in the radcheck table and restructure my SQL queries. The serial number is stored as text. All users know their serial numbers, but not all users have a username which is how this issue arose. Any advice would be helpful. Thanks in advance, David -- David Teston PINES System Administrator http://georgialibraries.org

3 9

Logging when radius is live
by Poltorak, Paul (CT DD DS EVO O BFD TM&ISEC 1) 29 Nov '16

29 Nov '16

Hi all, Question about logging. At development time normally we use radiusd -X to have an idea which module fail and see the exact error message. What about if radius is live how should I found out if a client cannot access? Best way it will be to check a log and see what's happened or not. I've tried with sql but at radpostauth table there only id, username, pass, reply, authdate. I've expanded to see vlan assignment but ok always expand sql table and the querie takes time so I switched to module linelog for testing. At Accept now get same as at sql logging with reply vlan. Access-Accept = "%t: Accepted user: %{User-Name} MAC: %{Calling-Station-Id} VLAN: %{reply:Tunnel-Private-Group-Id}" But if reject I would like to see User-Name (computer), MAC and which module fail and why Access-Reject = "%t: Rejected user: %{User-Name} MAC: %{Calling-Station-Id} module and error message " Is there a possibility? Or how did you check afterward if a client cannot access? Gruß, Best Regards, Paul

3 5

3GPP Dictionary
by Eve Lennie 29 Nov '16

29 Nov '16

Hi all, Just a quick question. Is it possible to check which version or release of a dictionary FreeRADIUS version 3 is using? One of our vendors requires us to use the 3GPP release 8. I know this was the dictionary used in previous versions of FreeRADIUS, but I want to make sure the dictionary we are using is either release 8 or is backward compatible with release 8. We are using FreeRADIUS 3.0.4 Thanks for your help. Kind regards, Eve Lennie Graduate Systems Administrator t: 01234 867250 e: eve.lennie(a)comms365.com<mailto:eve.lennie@comms365.com> Comms365 Limited South House 3, Bond Avenue, Milton Keynes, MK1 1SW w: www.comms365.com<applewebdata://C036AF1A-DD9C-45FE-8F04-95FE6681EC18/www.comms365.com> Linked In: Comms365 Limited<https://www.linkedin.com/company/comms365-limited?trk=biz-companies-cym> Twitter: www.twitter.com/Comms365<http://www.twitter.com/Comms365> [cid:image001.png@01D22BB5.0CA9B850] [cid:image002.png@01D22BB5.0CA9B850] No contract may be entered into on behalf of Comms365 Limited by means of email communication. Any pricing given is subject to E&OE at all times. Company Reg No. 06662688 / Registered in England VAT Reg No. 936428405 ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud ______________________________________________________________________

2 3

RE: No TLS 1.2 [Solved]
by David Ward 29 Nov '16

29 Nov '16

Thank you. That steered me in the right direction. Here are the entries to make in the TLS section of eap: disable_tlsv1_0 = no disable_tlsv1_1 = yes disable_tlsv1_2 = yes Verified with trace like this: TLSv1 Record Layer: Handshake Protocol: Server Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 81 Handshake Protocol: Server Hello Handshake Type: Server Hello (2) Length: 77 Version: TLS 1.0 (0x0301) -David -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+daward=brocade.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, November 17, 2016 5:23 PM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: No TLS 1.2 On Nov 17, 2016, at 5:08 PM, David Ward <daward(a)Brocade.COM> wrote: > > We are looking into how to change TLS behavior on radiusd. This is for > testing purpose, so I want to intentionally only allow TLS 1.0. > Currently > running: FreeRADIUS Version 3.0.12. > > Is there a way to make this version only accept TLS 1.0, right now we > are using older 2.x version to test this. In version 3, see "disable_tls" in raddb/mods-available/eap. There are flags for each TLS version. Alan DeKok. - List info/subscribe/unsubscribe? See https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org_list…

1 0

Error: Program returend code (98) and output ''
by Skrebetz, Pete 28 Nov '16

28 Nov '16

Not sure what happened, but I walked away from my freeradius and MOTP deployment for a month or so, when I came back I can't authenticate from my client. I can do it locally, but can't do it remotely. The log throws another message 'warning: rlm_sql (sql): you probably need to lower "min" '. Not sure where to start on this. Thanks, Pete

2 3

FreeRADIUS server: Error in testing user access!
by Pedro García Teodoro 28 Nov '16

28 Nov '16

Dear all, Ive installed and configured FreeRADIUS 3.0.12 on Ubuntu 16.04 LTS. In the file /usr/local/etc/raddb/mods-available/eap Ive specified: - default_eap_type = peap in the general eap section, and - default_eap_type = mschapv2 in the peap section. After running the server with radiusd X, I test it with the default user bob defined in /usr/local/etc/raddb/users: radtest bob hello localhost 0 testing123 Regretfully, the authentication fails, the debugger saying: } # server radiusd: #### Opening IP addresses and Ports #### Listening on auth address 127.0.0.1 port 1812 Listening on acct address 127.0.0.1 port 1813 Listening on proxy address * port 39814 Ready to process requests (0) Received Access-Request Id 239 from 127.0.0.1:39509 to 127.0.0.1:1812 length 73 (0) User-Name = "bob" (0) User-Password = "hello" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0x5456ab996d2c7087d14a1529bd8c950d (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 239 from 127.0.0.1:1812 to 127.0.0.1:39509 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 239 with timestamp +32 Ready to process requests Ive tried radtest with other auth methods (-t pap/chap/mschap) but it always fails! Whats wrong? Can someone help me, please? Thanks in advance, Pedro

5 8

[FreeRadius 2.2.8] Error: ASSERT FAILED event.c[164]: request->thread_id == NO_CHILD_THREAD
by Santi Pérez Fernández 28 Nov '16

28 Nov '16

Hi, I configured freeradius 2.2.8 with the coa update options according to the documentation. /etc/freeradius/sites-enabled Auth-Type MS-CHAP { mschap update coa { Packet-Dst-IP-Address = 10.0.1.80 Packet-Dst-Port = 4141 Alc-SLA-Prof-Str = "%{reply:Alc-Subsc-Prof-Str}" } } /etc/freeradius/sites-available/originate-coa home_server localhost-coa { type = coa # # Note that a home server of type "coa" MUST be a real NAS, # with an ipaddr or ipv6addr. It CANNOT point to a virtual # server. # ipaddr = 10.0.1.80 port = 4141 # This secret SHOULD NOT be the same as the shared # secret in a "client" section. secret = testing1234 # CoA specific parameters. See raddb/proxy.conf for details. coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } This is the output from the logs: Mon Nov 28 18:45:38 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #30 Mon Nov 28 18:45:38 2016 : Info: rlm_sql (sql): Connected new DB handle, #30 Mon Nov 28 18:45:38 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 Mon Nov 28 18:45:38 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #31 Mon Nov 28 18:45:38 2016 : Info: rlm_sql (sql): Connected new DB handle, #31 Mon Nov 28 18:45:38 2016 : Info: Loaded virtual server <default> Mon Nov 28 18:45:38 2016 : Info: Loaded virtual server inner-tunnel Mon Nov 28 18:45:38 2016 : Info: Ready to process requests. Mon Nov 28 18:45:42 2016 : Auth: Login OK: [H-VPORT-CPE-LITE-i2cat-2/<via Auth-Type = MSCHAP>] (from client localhost port 0) Mon Nov 28 18:45:42 2016 : Error: ASSERT FAILED event.c[164]: request->thread_id == NO_CHILD_THREAD It only works for the first request. Then I got the following error: Mon Nov 28 18:45:42 2016 : Error: ASSERT FAILED event.c[164]: request->thread_id == NO_CHILD_THREAD What i'm doing wrong? Am I missing something? I am also not been capable of returning the custom attribute. Thanks for your help.

2 1