- Freeradius-Users - lists.freeradius.org

issues with duplicate AcctUniqueId attribute values
by Alex Sharaz 05 Dec '16

05 Dec '16

While I track down why the above is happening .... 1). Can I enable debugging in just the buffered-sql virt server ? Its a pain running all of a server in debug mode 2). Is it possible to manually take a detail.work file and pipe it into buffered sql offline? 3). When buffered-sql sees rlm_sql_postgresql: Status: PGRES_FATAL_ERROR (4) sql: rlm_sql_postgresql: ERROR: duplicate key value violates unique constraint "radacct_acctuniqueid_key" (4) sql: rlm_sql_postgresql: DETAIL: Key (acctuniqueid)=(e5aa2781f1f3842a1b9e7590ce9d2ab6) already exists. (4) sql: SQL query returned: need alt query (4) sql: No additional queries configured rlm_sql (sql): Released connection (3) (4) [sql] = noop (4) } # accounting = noop (4) detail (/var/spool/freeradius/detail): No response to request. Will retry in 30 seconds it seems to block processing of subsequent statements. Any way of telling it to skip that update log an error and move onto the next one? A

2 2

FreeRadius Error
by Albert K 05 Dec '16

05 Dec '16

Hi, I have an installation with Samba 4.3.x (with winbindd) and FreeRadius 3.0.11. I want authentication with Windows AD and authorization with Windows AD LDAP. I am trying setup the PEAP mschap wifi and get the following error when /usr/local/bin/radtest radius tycbf@179963 localhost 0 testing123 Ready to process requests (1) Received Access-Request Id 160 from 127.0.0.1:22166 to 127.0.0.1:1812 length 76 (1) User-Name = "radius" (1) User-Password = "tycbf@179963" (1) NAS-IP-Address = 10.200.1.7 (1) NAS-Port = 0 (1) Message-Authenticator = 0xbd3d0852f4606cda7488d1198c4387bc (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "radius", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle for 1543 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): Closing connection (5): Hit idle_timeout, was idle for 1537 seconds rlm_ldap (ldap): You probably need to lower "min" rlm_ldap (ldap): 0 of 0 connections in use. You may need to increase "spare" rlm_ldap (ldap): Opening additional connection (6), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://10.100.100.10:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Reserved connection (6) (1) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap: --> (samaccountname=radius) (1) ldap: Performing search in "dc=sgcom,dc=co,dc=sg" with filter "(samaccountname=radius)", scope "sub" (1) ldap: Waiting for search result... rlm_ldap (ldap): Rebinding to URL ldap:// DomainDnsZones.sgcom.co.sg/DC=DomainDnsZones,DC=sgcom,DC=co,DC=sg rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// ForestDnsZones.sgcom.co.sg/DC=ForestDnsZones,DC=sgcom,DC=co,DC=sg rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Rebinding to URL ldap:// sgcom.co.sg/CN=Configuration,DC=sgcom,DC=co,DC=sg rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (1) ldap: User object found at DN "CN=radius,OU=LPK USERS,DC=sgcom,DC=co,DC=sg" (1) ldap: Processing user attributes (1) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (1) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (6) rlm_ldap (ldap): Need 3 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (7), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://10.100.100.10:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) [ldap] = ok (1) [expiration] = noop (1) [logintime] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> radius (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.9 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 160 from 127.0.0.1:1812 to 127.0.0.1:22166 length 20 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 160 with timestamp +1543

2 1

Anyone got a working sites-available/tls file for FR 4.0- ?
by Alex Sharaz 03 Dec '16

03 Dec '16

Once I wrapped the supplied example in "server tls {....} " Get a "Failed to find clients radsec {..} message" even though the config is there. A

4 9

FR 3.1 access-accept (Alan DeKok)
by Chris Howley 02 Dec '16

02 Dec '16

Hi Alan, I was looking for an explanation why the attributes weren't there in 3.1. Thank you for your time. Chris Howley

1 0

Redunant result=action problem
by matus2 01 Dec '16

01 Dec '16

Hello all! I have a small issue with ldap redundancy configuration. My goal is to set up ldap1 and ldap2 module redundancy( if first of listed module fail) with handling return action 'userlock'. I have followed page http://wiki.freeradius.org/config/Fail-over which describes how to assign group RESULT=ACTION specifiers and configured authorize section like this: authorize { redundant { ldap1 ldap2 userlock = 1 } if ( userlock ) { .... } Unfortunately I am not able to start server because of problem on line "userlock = 1" server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} /etc/raddb/sites-enabled/inner-tunnel[170]: Entry with no value is invalid /etc/raddb/sites-enabled/inner-tunnel[48]: Errors parsing authorize section. I am using FreeRADIUS Version 3.0.12 on CentOS version 7. Thanks for your help. Regards matus2

2 1

buffered-sql debugging
by Alex Sharaz 01 Dec '16

01 Dec '16

Is there any way of selectively enabling debugging of the buffered-sql server ? Having got past my previous problems with my config, verified that it was all working puppetized the config, pushed it to all my outward facing eduroam servers, verified that its working and left it alone ... I've now got 4 servers with ~5G detail files I use if ( "%{client:shortname}" == "xb1sw7" ) { update control { Tmp-String-2 = "%{debug:1}" } } in my "default" server for example A

1 1

Using privacyIDEA to authenticate to WiFi with 2FA/Token
by Muenz, Michael 30 Nov '16

30 Nov '16

Hi guys, I have a running setup with privacyIDEA to authenticate VPN users via Token. There's a perl module redirecting the token stuff to the local webserver doing their magic. In order to to run this setup I have to set Default Auth Type to perl in users file. Now I have a customer asking to extend WiFi security with tokens. My thought was no big deal, but there's EAP! :) After some google it was clear to use TTLS and PAP. First problem, when I setup my AP's for radius and Default Auth is perl, EAP won't get called. OK, then I set Default Auth to EAP and bang, EAP starts and everything seems to run fine in inner-tunnel. But then I want to bump perl in authenticate section to give the request to the webserver. What now happens is, that perl won't get recognized and instead again Defaut Auth is chosen and it tries to do MD5. I played around with ttls and md or gtc, inserted perl in authorized section and so on, nothing worked. Enclosed is a (huge) debug, hoping that someone has a clue whats going on (comments inline): --> Initial request rad_recv: Access-Request packet from host ip port 57736, id=87, length=153 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x0200000a016d75656e7a Message-Authenticator = 0x360bad25b59c6c79d36ab8f73531836e # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry DEFAULT at line 205 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop --> perl in authorize, normally not needed (was a test) rlm_perl: Added pair EAP-Message = 0x0200000a016d75656e7a rlm_perl: Added pair Calling-Station-Id = 30-3A-64-D8-D2-13 rlm_perl: Added pair NAS-IP-Address = ip rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair Message-Authenticator = 0x360bad25b59c6c79d36ab8f73531836e rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair Connect-Info = CONNECT 0Mbps 802.11a rlm_perl: Added pair User-Name = user rlm_perl: Added pair Called-Station-Id = BC-16-F5-DB-57-F0:SSID rlm_perl: Added pair Framed-MTU = 1400 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Auth-Type = EAP ++[perl] = ok +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 87 to ip port 57736 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f5678760a3d6495143e099646c4 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=88, length=470 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x02010133150016030101280100012403035469c1888d984c755f09fa127b5a4fd73d3f5e3d76dd0492e39691ff0acbcca10000aac030c02cc028c024c014c00a00a500a300a1009f700860085c032c02ec02ac026c00fc005009d003d00350084c02fc02bc027c023c013c00900a400a200a0009e00670040003f003e0033003200310030009a0099009800970045004400430042c031c02dc029c020cc00200050004c012c008001600130010000dc00dc003000a00ff01000051000b000403000102000a001c001a00170019001c001b0018001a00 EAP-Message = 0x16000e000d000b000c0009000a000d0020001e060106020603050105020503040104020403030103020303020102020203000f000101 State = 0x78771f5678760a3d6495143e099646c4 Message-Authenticator = 0xa2dcbc0456f99c4088c081ea40caa72f # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 253 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls --> OK, going for ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0128], ClientHello [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 003e], ServerHello [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 02d4], Certificate [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state --> is this OK? [ttls] TLS_accept: Need to read more data: unknown state In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 88 to ip port 57736 EAP-Message = 0x0102040015c000000475160301003e0200003a0301fb61a70bc00f4f72254a4961295db23a021ab31db031a2ec5e30f09766eeb92500c014000012ff01000100000b000403000102a308202c6308201aea003020102020900f42e74c60803a393300d06092a864886f70d01010b0500301b3119301706035504030c106f74702e6d627261756e2e6c6f6b616c301e170d3136313132323135323532319301706035504030c106f74702e6d627261756e2e6c6f6b616c30820122300d06092a864886f70d01010105000382010f003082010a02820101 EAP-Message = 0x00c2d539f913b49bddf44e1896b3664ef5414c1e58a0c1263f9c39e0ff204987c19cae285e655970bc06cd5d418e344b24e13cc25fcedfe44b0dceb07563b23a4763f78b0c04db0e0c0046112b6598a674fadc501c0a06361e341c9e5864243551139d5f5fdc235f6f6c0fe211095075ffdf599691fbc583be069c6206539c77288d239f513fb4e56b430df3c9e697dc109fdc2a8e7041049bebde035ef358cf6c8d0185e22b211573ffb36f719017802cac937dce660ae8e6e6c990b46992150fb66c106304bb88c6a63d3fda8c947ceb77eb33a6c4 EAP-Message = 0x991e98690203010001a30d300b30090603551d1304023000300d06092a864886f70d01010b05000382010100c011c45596161f6474a37be2d223e3dd858c194f824a65ec9174cadd54dc523a97820f572379b761fb43b43d1e356e3e36ba4c1fdecd821aef7413344a8072f17c7d8e1c3c6d9e2f064999f600f04d2b6d3d357a91cdf0a60313becaa9503ab79e523471d266d5c3a104580fd6f33c246c24c8d9f9ecbdbe93471e78fb23cc14a01418ee79a7029adaf00ebede94f7dd60b0558136e2b8534a6c9280a012749c5f2fdbcf8be8d8fe6ee9 EAP-Message = 0x9af28691cd18ddbba01e4b85a9f82cfec7eb4201fb914bb9df179d05a1135ed94eb5b0e67a4b6dc13601ccdbe5b970160301014b0c0001470300174104880a6cadb0bda6009cb3b209cd1ab676aecc9445bab4ad851c75e61a0037316b16f93ec6fcbb77722df1dfc5f01008ba6dc4c785bbbaefa09f4c0a751c5c7269ff7ebb5f7e8c67f659c8454f919e96a0adef063bfec5963e07ce2b7aa293159462acbc323ace3570daf0d09e83111a3fe9ddb279a59b126c591b386276dae1922cdf428cd02871bda42dceeb4a16171f332d0e95cb30dcc17b EAP-Message = 0x8e2faa751416e9b4519b8898 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f5679750a3d6495143e099646c4 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=89, length=167 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x020200061500 State = 0x78771f5679750a3d6495143e099646c4 Message-Authenticator = 0xd5e8cfd8ef6c17173e3b4362999ef8e3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 89 to ip port 57736 EAP-Message = 0x010300891580000004759fe317ceebd982fddebffd0960319e213113c8228478e9b467d2beebcef7aacff48414466d77007618337e74bbde1ba4f48ee628129c948a5dae987aafaa6ab658f1b3ab06b9c15495e21cb24d905978e5b9657b14b013747805521a05c5ac23e3b4b16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f567a740a3d6495143e099646c4 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=90, length=301 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x0203008c15001603010046100000424104e2eb375029681f678e5f1c36bfc89b18bb3a00538a95c0274746cf2c7d80d65401633768320eedc9611e0488a3ee26f65f4876f6a366ed051d6bf03d28b8a706ab96ab8a779b307ccbc7b349ef5aa56a5cb952c50576cefca870fc83524c24fc5b90c0cae016f2d State = 0x78771f567a740a3d6495143e099646c4 Message-Authenticator = 0xd761d7690d32fe8b142236eab7f6a1e8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 140 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: unknown state [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] (other): SSL negotiation finished successfully --> Yay, sounds good to me SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 90 to ip port 57736 EAP-Message = 0x0104004515800000003b1403010001011603010030aa0ee47b503121259d548b3cf09b32b5fb7ae3aa7f25d8a0711e2e04f4e240dffa2b84c3272d94a1f6e142cb1c3a391d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f567b730a3d6495143e099646c4 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=91, length=257 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x02040060150017030100207d47ce2ba9ec180dd6fcf0b76e10dde249052da789ab7f9c7ce75204d0b524581703010030a14ec7133706d825b25db9e853c237b4347d0e1b9879d43879a3ce68a State = 0x78771f567b730a3d6495143e099646c4 Message-Authenticator = 0x6928c5095c5c258d6c87ec5f879ec11b # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 96 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x0200000a016d75656e7a FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Got tunneled identity of user [ttls] Setting default EAP type for tunneled EAP session. [ttls] Sending tunneled request EAP-Message = 0x0200000a016d75656e7a FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" --> Finally, reaching inner-tunnel, but perl won't get called, it's in first place in authenticate server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] EAP Identity [eap] processing type gtc [gtc] expand: Password: -> Password: ++[eap] = handled +} # group authenticate = handled } # server inner-tunnel [ttls] Got tunneled reply code 11 EAP-Message = 0x0101000f0650617373776f72643a20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x81d6c4cf81d7c2d83ec9c570cb69f51e [ttls] Got tunneled Access-Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 91 to ip port 57736 EAP-Message = 0x0105003f1580000000351703010030c5db273c3c863eb6b3764a1ed973cd99053166c7fa89d6dc788cb711eae8a72d598037ff2571d3cf8b7ab755794fa29b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f567c720a3d6495143e099646c4 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=92, length=257 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x0205006015001703010020115f8cd11b96b37c00098fb2e5afdef35d419b9f3a06e9333508562ba52bd9941703010030a53ad47636c229f2d43a3884d6de2699fc1fbe65ac79c0be2addff875 State = 0x78771f567c720a3d6495143e099646c4 Message-Authenticator = 0xe18b09b565a096b5c48229e326ba51fe # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 96 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x020100060304 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x020100060304 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" State = 0x81d6c4cf81d7c2d83ec9c570cb69f51e server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/md5 [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled } # server inner-tunnel [ttls] Got tunneled reply code 11 EAP-Message = 0x01020016041054ab7a2ac661b1a17f04daa40325d1bb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x81d6c4cf80d4c0d83ec9c570cb69f51e [ttls] Got tunneled Access-Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 92 to ip port 57736 EAP-Message = 0x0106004f15800000004517030100408ce10260b1e93c4c05898048ef94aac42357aba82089743442651a4f2d969ac0cdc51243d784827f97571443b8cd2ce9c8afb692e8f641e684 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x78771f567d710a3d6495143e099646c4 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host ip port 57736, id=93, length=273 User-Name = "user" NAS-IP-Address = ip NAS-Port = 0 Called-Station-Id = "BC-16-F5-DB-57-F0:SSID" Calling-Station-Id = "30-3A-64-D8-D2-13" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11a" EAP-Message = 0x0206007015001703010020d6cbb1a3a5f469fb69725dcc5585d44cee709422a062a0069002373e41c1a50b17030100404b1af9b738abecc14342b16efacf53eca017241d9f3ffa4b9b970b9ba804bd977ebef8a6ac6aff592d3caaf36 State = 0x78771f567d710a3d6495143e099646c4 Message-Authenticator = 0x686be1d650b37ad2e406ed39ef1dfa5e # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 112 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x0202001604102d9b5073ce522d5e72a61cf2673bbb36 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x0202001604102d9b5073ce522d5e72a61cf2673bbb36 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user" State = 0x81d6c4cf80d4c0d83ec9c570cb69f51e server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 2 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[expiration] = noop ++[logintime] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 --> Yes I know, but I should call perl rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated } # server inner-tunnel [ttls] Got tunneled reply code 3 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user user [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 93 to ip port 57736 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 87 with timestamp +12 Cleaning up request 1 ID 88 with timestamp +12 Cleaning up request 2 ID 89 with timestamp +12 Cleaning up request 3 ID 90 with timestamp +12 Cleaning up request 4 ID 91 with timestamp +12 Cleaning up request 5 ID 92 with timestamp +12 Waking up in 1.0 seconds. Cleaning up request 6 ID 93 with timestamp +12 Ready to process requests. It's a fresh Debian 8 install with FR 2.2.5 deb package. What I canged from the default was the client in clients.conf, DEFAULT Auth-Type := eap/perl in users. In eap.conf change default to ttls, in section ttls tried md5 and gtc. In modules/perl linked to the module and added perl/eap to default and inner-tunnel. Any ideas? Thanks, Michael

4 9

FR 3.1 access-accept
by Chris Howley 30 Nov '16

30 Nov '16

Hi, In using eapol_test against FreeRADIUS 2.2.3 and 3.1 (3.1.0-dead (git #4870102)) I noticed that the following attributes are NOT included in the Access-Accept sent by FR 3.1: EAP-MSK, EAP-EMSK and EAP-Session-Id. Are these attributes required in the Access-Accept? If so, how can I copy them from the inner-tunner server to the Access-Accept? Thanks, Chris 1. FreeRADIUS 2.2.3 Mon Nov 28 08:46:27 2016 : Debug: # Executing section post-auth from file /etc/raddb/sites-enabled/LOCAL-WLAN-outer Mon Nov 28 08:46:27 2016 : Debug: +group post-auth { Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{reply:Packet-Type} -> Access-Accept Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{Operator-Name} -> Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] ... expanding second conditional Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{Calling-Station-ID} -> 02:00:00:00:00:01 Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{NAS-IP-Address} -> 127.0.0.1 Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %{NAS-Port} -> Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] ... expanding second conditional Mon Nov 28 08:46:27 2016 : Debug: [linelog_reply] expand: %t : %{%{reply:Packet-Type}:-unknown-method} [%{User-Name}] ( %{%{Operator-Name}:-No_Operator} client=%{%{Calling-Station-ID}:-00:00:de:ad:be:ef} NAS-IP-Address %{%{NAS-IP-Address}:-0.0.0.0} port %{%{NAS-Port}:-0}) -> Mon Nov 28 08:46:27 2016 : Access-Accept [testuser(a)leeds.ac.uk] ( No_Operator client=02:00:00:00:00:01 NAS-IP-Address 127.0.0.1 port 0) Mon Nov 28 08:46:27 2016 : Debug: ++[linelog_reply] = ok Mon Nov 28 08:46:27 2016 : Debug: ++[exec] = noop Mon Nov 28 08:46:27 2016 : Debug: +} # group post-auth = ok Mon Nov 28 08:46:27 2016 : Debug: Sending Access-Accept packet to host X.X.X.X port 49011, id=11, length=0 Mon Nov 28 08:46:27 2016 : Debug: User-Name = "testuser" Mon Nov 28 08:46:27 2016 : Debug: MS-MPPE-Recv-Key = 0x88f27e096616e54304666947eaa5c38d3b3b62ba9b116e0c2b476718a56ca767 Mon Nov 28 08:46:27 2016 : Debug: MS-MPPE-Send-Key = 0xbb1a28fa8663a7c7516d89ed921db7159fc05315f5578e7c715fe9261d83ddd6 Mon Nov 28 08:46:27 2016 : Debug: EAP-MSK = 0x88f27e096616e54304666947eaa5c38d3b3b62ba9b116e0c2b476718a56ca767bb1a28fa8663a7c7516d89ed921db7159fc05315f5578e7c715fe9261d83ddd6 Mon Nov 28 08:46:27 2016 : Debug: EAP-EMSK = 0x22ad8973c9357152405aec86b3911658adde465b54757f85d8b35e32fc89bb4e6ba96fc01bd1497afc430b403d51487f0df830c75b11fc40edc42595eb4ea37d Mon Nov 28 08:46:27 2016 : Debug: EAP-Session-Id = 0x19583beee34ffd6c9a5fa449c2ee1648b00378dcf0123d0ec8deed9d57ec59edf7583beee384531fad7b0362375c1618ad5923cec29d453037d7b4f88594db792f Mon Nov 28 08:46:27 2016 : Debug: EAP-Message = 0x030b0004 Mon Nov 28 08:46:27 2016 : Debug: Message-Authenticator = 0x00000000000000000000000000000000 Mon Nov 28 08:46:27 2016 : Debug: Finished request 287510. 2. FreeRADIUS 3.1 (12,1) Using 'Auth-Type = eap' for authenticate {...} (12,1) Running Auth-Type eap from file /etc/raddb/sites-enabled/default (12,1) Auth-Type eap { (12,1) eap - Peer sent packet with EAP method PEAP (25) (12,1) eap - Calling submodule eap_peap to process data (12,1) eap_peap - Continuing EAP-TLS (12,1) eap_peap - Got complete TLS record (74 bytes) (12,1) eap_peap - [eap-tls verify] = complete (12,1) eap_peap - Decrypted TLS application data (11 bytes) (12,1) eap_peap - [eap-tls process] = complete (12,1) eap_peap - Session established. Decoding tunneled data (12,1) eap_peap - PEAP state send tlv success (12,1) eap_peap - Received EAP-TLV response (12,1) eap_peap - Success (12,1) eap_peap - Adding session keys (12,1) eap_peap - &reply:MS-MPPE-Recv-Key = 0xc81a9fdb4896685f70a38fcf16fe2403b8c3a767e6f9537be9b51b34ee21f755 (12,1) eap_peap - &reply:MS-MPPE-Send-Key = 0x96c61060a7081969287257d3905acfc21f27ae5093c42ed9b057a2be6c818a21 (12,1) eap_peap - &reply:EAP-MSK = 0xc81a9fdb4896685f70a38fcf16fe2403b8c3a767e6f9537be9b51b34ee21f75596c61060a7081969287257d3905acfc21f27ae5093c42ed9b057a2be6c818a21 (12,1) eap_peap - &reply:EAP-EMSK = 0xb96c201642eb34b43d228b912522eb2fef02d0fbd93a60d2d4d1c90ce5dea84c5a288b49d95fbd9ae1eabfa681064f5e8b1a190ce97500aa79f0a93fffdc0ed7 (12,1) eap - Sending EAP Success (code 3) ID 11 length 4 (12,1) eap - Cleaning up EAP session (12,1) eap (ok) (12,1) if (handled && (Response-Packet-Type == Access-Challenge)) { (12,1) ... (12,1) } (12,1) } # Auth-Type eap (ok) (12,1) Login OK: [testuser@realm] (from client netserv5 port 0 cli 02:00:00:00:00:01) (12,1) Running section post-auth from file /etc/raddb/sites-enabled/default (12,1) post-auth { (12,1) update { (12,1) &reply: += &session-state:Stripped-User-Name -> "testuser" (12,1) &reply: += &session-state:Reply-Message -> "successful authentication" (12,1) } # update (noop) (12,1) update reply { (12,1) &reply:Reply-Message := successful authentication (12,1) } # update reply (noop) (12,1) default-accept-log - Using default message (12,1) default-accept-log - EXPAND %S (%l) id %I DEFAULT ACCEPT %{User-Name} cli %{%{Calling-Station-Id}:--} auth-type %{control:Auth-Type}/%{EAP-Type} realm %{Realm} operator %{%{Operator-Name}:--} client %{%{Packet-Src-IP-Address}:-%{%{Packet-Src-IPv6-Address}:--}} (%{Client-Shortname}) essid (%{%{Called-Station-SSID}:--}) reply-msg '%{reply:Reply-Message}' (12,1) default-accept-log - --> 2016-11-28 13:44:16 (1480340656) id 11 DEFAULT ACCEPT testuser@realm cli 02:00:00:00:00:01 auth-type eap/PEAP realm realm operator - client Y.Y.Y.Y (netserv5) essid (-) reply-msg 'successful authentication' (12,1) default-accept-log - EXPAND /var/log/radius/auth.log (12,1) default-accept-log - --> /var/log/radius/auth.log (12,1) default-accept-log (ok) (12,1) exec (noop) (12,1) remove_reply_message_if_eap { (12,1) if (&reply:EAP-Message && &reply:Reply-Message) { (12,1) update reply { (12,1) &reply:Reply-Message !* ANY (12,1) } # update reply (noop) (12,1) } # if (&reply:EAP-Message && &reply:Reply-Message) (noop) (12,1) else { (12,1) ... skipping else for request 12: Preceding "if" was taken (12,1) } (12,1) } # remove_reply_message_if_eap (noop) (12,1) } # post-auth (ok) (12,1) Sent Access-Accept Id 11 from Y.Y.Y.Y:1812 to Y.Y.Y.Y:53223 via em1 length 0 (12,1) MS-MPPE-Recv-Key = 0xc81a9fdb4896685f70a38fcf16fe2403b8c3a767e6f9537be9b51b34ee21f755 (12,1) MS-MPPE-Send-Key = 0x96c61060a7081969287257d3905acfc21f27ae5093c42ed9b057a2be6c818a21 (12,1) EAP-Message = 0x030b0004 (12,1) Message-Authenticator = 0x00000000000000000000000000000000 (12,1) Finished request

2 1

Stopping Service After Marking Home_Server as Dead
by Avni German 30 Nov '16

30 Nov '16

Hi all, I am using freeradius 3.0.4 version on CentOS 7. And whenever my proxy servers mark as dead, radius service is stopped. At first I get "Proxy: Marking home server x.x.x.x port 1812 as dead." Log and the service is stopped. I changed proxy.conf a bit and log has changed. It says "Error: Failed adding event handler for socket!" and the service is stopped. And I could not get any more logs. I found a mailing about the same issue (http://lists.freeradius.org/pipermail/freeradius-users/2014-October/074120. html) but there was no solution. My proxy server is also proxying requests to core radius servers for eduroam. There is nothing I could do for proxy fails. I have an average of 3000 concurrent users and this cause me a lot of trouble. What should I do? Proxy Configuration sample: home_server External { type = auth ipaddr = x.x.x.x port = 1812 secret = secret num_answers_to_alive = 10 no_response_fail = no status_check = status-server check_interval = 10 } Note that, I tried all variations of proxy.conf but I could not solve it. Thanks for your help. Regards Avni

2 1

Username OR Serial Number
by David Teston 29 Nov '16

29 Nov '16

Hi All, I'd like to enable users to enter their username OR serial number as the &User-Name variable, then let /policy.d/filter determine how to process it. This would also require that I add an attribute in the radcheck table and restructure my SQL queries. The serial number is stored as text. All users know their serial numbers, but not all users have a username which is how this issue arose. Any advice would be helpful. Thanks in advance, David -- David Teston PINES System Administrator http://georgialibraries.org

3 9