- Freeradius-Users - lists.freeradius.org

Accounting on custom tables
by Ahmed Munir 05 Oct '16

05 Oct '16

Hi, I would like to know is it possible to do accounting in custom tables rather than using radacct? If yes, where do I need to make changes? Further added, the platform I need to do the accounting for Asterisk and OpenSIPs i.e. two separate tables for Asterisk & OpenSIPs accounting . Please advise in which config file(s) changes are required. Note: radius server has setup with MySQL DB. -- Regards, Ahmed Munir Chohan

2 1

Re: EAP-FAST failure in v3.0.12
by STE SQE 05 Oct '16

05 Oct '16

Hi, >> I'm new to RADIUS servers and I'm trying to enable EAP-FAST. Is there a >> documentation I can use to enable it? I'm using version 3.0.12. > The documentation in the EAP module is all you need. >> Anyway, this is what I've done. > That should work. >> I don't know where to look at in the debug output but shown below is part >> of it. >> >> (9) eap_fast: Got tunneled Access-Reject >> (9) eap_fast: Reject >> (9) eap: ERROR: Failed continuing EAP FAST (43) session. EAP sub-module >> failed > Well... look at the *earlier* messages to see what's wrong. If you're running it in a terminal, the error message will even be colourised to show importance. I'm seeing another error, MS-CHAP2-Response is failing. And there are warnings also shown. Please help me solve this. Thanks. (8) eap_fast: WARNING: AUTHENTICATION (8) eap_fast: WARNING: AUTHENTICATION (8) WARNING: Outer and inner identities are the same. User privacy is compromised. (9) mschap: ERROR: MS-CHAP2-Response is incorrect (9) eap: ERROR: Failed continuing EAP FAST (43) session. EAP sub-module failed Shown below in a snippet of the debug output. (8) Received Access-Request Id 120 from 10.30.32.46:3073 to 10.30.32.40:1812 length 221 (8) User-Name = "bob" (8) NAS-Port = 0 (8) Called-Station-Id = "14-D6-4D-C7-DC-88:DLINK-SDESQE-EAP-2" (8) Calling-Station-Id = "00-AE-FA-9C-FF-FC" (8) Framed-MTU = 1400 (8) NAS-Port-Type = Wireless-802.11 (8) Connect-Info = "CONNECT 11Mbps 802.11b" (8) EAP-Message = 0x020b003b2b011703010030395790f43e1b9dcf131fb7f74983d279244d9ae2493d1ca9270a9ef434fcafc937b4fcf9cb3e0fc8390047a796569cf6 (8) State = 0xd951d3a9dd5af8abc01e99543ad15de0 (8) Message-Authenticator = 0x52eec993910273fb7aa3ece5018c83fe (8) session-state: No cached attributes (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "bob", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 11 length 59 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) files: users: Matched entry bob at line 87 (8) [files] = ok (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: Auth-Type already set. Not setting to PAP (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x592fa0ee5b2c8b60 (8) eap: Finished EAP session with state 0xd951d3a9dd5af8ab (8) eap: Previous EAP request found for state 0xd951d3a9dd5af8ab, released from the list (8) eap: Peer sent packet with method EAP FAST (43) (8) eap: Calling submodule eap_fast to process data (8) eap_fast: Authenticate (8) eap_fast: Continuing EAP-TLS (8) eap_fast: [eaptls verify] = ok (8) eap_fast: Done initial handshake (8) eap_fast: [eaptls process] = ok (8) eap_fast: Session established. Proceeding to decode tunneled attributes (8) eap_fast: Got Tunneled FAST TLVs (8) eap_fast: FreeRADIUS-EAP-FAST-EAP-Payload = 0x020b000801626f62 (8) eap_fast: Processing received EAP Payload (8) eap_fast: Got tunneled request (8) eap_fast: EAP-Message = 0x020b000801626f62 (8) eap_fast: Got tunneled identity of bob (8) eap_fast: WARNING: AUTHENTICATION (8) eap_fast: WARNING: AUTHENTICATION (8) Virtual server inner-tunnel received request (8) EAP-Message = 0x020b000801626f62 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "bob" (8) WARNING: Outer and inner identities are the same. User privacy is compromised. (8) server inner-tunnel { (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [chap] = noop (8) [mschap] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "bob", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 11 length 8 (8) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Peer sent packet with method EAP Identity (1) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: Issuing Challenge (8) eap: Sending EAP Request (code 1) ID 12 length 43 (8) eap: EAP session adding &reply:State = 0xcd5f27e3cd533d7f (8) [eap] = handled (8) } # authenticate = handled (8) } # server inner-tunnel (8) Virtual server sending reply (8) EAP-Message = 0x010c002b1a010c002610fba8fb3aac28c0bc78ca631f320436b6667265657261646975732d332e302e3132 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0xcd5f27e3cd533d7f53bfae26bc7d5c8e (8) eap_fast: Got tunneled Access-Challenge (8) eap_fast: Challenge (8) eap: Sending EAP Request (code 1) ID 12 length 91 (8) eap: EAP session adding &reply:State = 0xd951d3a9dc5df8ab (8) [eap] = handled (8) } # authenticate = handled (8) Using Post-Auth-Type Challenge (8) Post-Auth-Type sub-section not found. Ignoring. (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Sent Access-Challenge Id 120 from 10.30.32.40:1812 to 10.30.32.46:3073 length 0 (8) EAP-Message = 0x010c005b2b0117030100505c32d6e574493d1fae7ed03024b6391b56fd8373b43e14b9908313ec682d1b783b962518a2f3666e7f13f843f37e6f924435d3d074119b47d571473c95478d5cfcc443fea1145ff781a807b56b7ccbe1 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0xd951d3a9dc5df8abc01e99543ad15de0 (8) Finished request Waking up in 4.2 seconds. (9) Received Access-Request Id 121 from 10.30.32.46:3073 to 10.30.32.40:1812 length 269 (9) User-Name = "bob" (9) NAS-Port = 0 (9) Called-Station-Id = "14-D6-4D-C7-DC-88:DLINK-SDESQE-EAP-2" (9) Calling-Station-Id = "00-AE-FA-9C-FF-FC" (9) Framed-MTU = 1400 (9) NAS-Port-Type = Wireless-802.11 (9) Connect-Info = "CONNECT 11Mbps 802.11b" (9) EAP-Message = 0x020c006b2b011703010060fe42e1f967e18b8037a3c0dc98b2488f66fa4c0f9eb383d19e0632cf01ec98325fbb3eeb5c6f503235e424c8ae20a288d039334e277fc5c34a28d2308b03a2f750b82b736652de1faaf697bdd5171a70727aebda1f253487ef0dd7d9c1d73505 (9) State = 0xd951d3a9dc5df8abc01e99543ad15de0 (9) Message-Authenticator = 0xf2df5a7c3c9352285f1942cc3e56db7b (9) session-state: No cached attributes (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "bob", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 12 length 107 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) files: users: Matched entry bob at line 87 (9) [files] = ok (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: Auth-Type already set. Not setting to PAP (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = eap (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x592fa0ee5b2c8b60 (9) eap: Finished EAP session with state 0xd951d3a9dc5df8ab (9) eap: Previous EAP request found for state 0xd951d3a9dc5df8ab, released from the list (9) eap: Peer sent packet with method EAP FAST (43) (9) eap: Calling submodule eap_fast to process data (9) eap_fast: Authenticate (9) eap_fast: Continuing EAP-TLS (9) eap_fast: [eaptls verify] = ok (9) eap_fast: Done initial handshake (9) eap_fast: [eaptls process] = ok (9) eap_fast: Session established. Proceeding to decode tunneled attributes (9) eap_fast: Got Tunneled FAST TLVs (9) eap_fast: FreeRADIUS-EAP-FAST-EAP-Payload = 0x020c003e1a020c0039310000000000000000000000000000000000000000000000002f87a8fd680c8c2541e34eb0ae6de571dcc6da7cb15872c900626f62 (9) eap_fast: Processing received EAP Payload (9) eap_fast: Got tunneled request (9) eap_fast: EAP-Message = 0x020c003e1a020c0039310000000000000000000000000000000000000000000000002f87a8fd680c8c2541e34eb0ae6de571dcc6da7cb15872c900626f62 (9) eap_fast: WARNING: AUTHENTICATION (9) eap_fast: WARNING: AUTHENTICATION (9) Virtual server inner-tunnel received request (9) EAP-Message = 0x020c003e1a020c0039310000000000000000000000000000000000000000000000002f87a8fd680c8c2541e34eb0ae6de571dcc6da7cb15872c900626f62 (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "bob" (9) State = 0xcd5f27e3cd533d7f53bfae26bc7d5c8e (9) WARNING: Outer and inner identities are the same. User privacy is compromised. (9) server inner-tunnel { (9) session-state: No cached attributes (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [chap] = noop (9) [mschap] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "bob", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) update control { (9) &Proxy-To-Realm := LOCAL (9) } # update control = noop (9) eap: Peer sent EAP Response (code 2) ID 12 length 62 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) files: users: Matched entry bob at line 87 (9) [files] = ok (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: Auth-Type already set. Not setting to PAP (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = eap (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) authenticate { (9) eap: Expiring EAP session with state 0x592fa0ee5b2c8b60 (9) eap: Finished EAP session with state 0xcd5f27e3cd533d7f (9) eap: Previous EAP request found for state 0xcd5f27e3cd533d7f, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) eap_mschapv2: authenticate { (9) mschap: Found Cleartext-Password, hashing to create NT-Password (9) mschap: Found Cleartext-Password, hashing to create LM-Password (9) mschap: Creating challenge hash with username: bob (9) mschap: Client is using MS-CHAPv2 (9) mschap: ERROR: MS-CHAP2-Response is incorrect (9) [mschap] = reject (9) } # authenticate = reject (9) eap: Sending EAP Failure (code 4) ID 12 length 4 (9) eap: Freeing handler (9) [eap] = reject (9) } # authenticate = reject (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (9) Post-Auth-Type REJECT { (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> bob (9) attr_filter.access_reject: Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) update outer.session-state { (9) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: MS-CHAP2-Response is incorrect' (9) } # update outer.session-state = noop (9) } # Post-Auth-Type REJECT = updated (9) } # server inner-tunnel (9) Virtual server sending reply (9) MS-CHAP-Error = "\014E=691 R=1 C=4a33d9cc35a85083c14a907490347b3c V=3 M=Authentication failed" (9) EAP-Message = 0x040c0004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_fast: Got tunneled Access-Reject (9) eap_fast: Reject (9) eap: ERROR: Failed continuing EAP FAST (43) session. EAP sub-module failed (9) eap: Sending EAP Failure (code 4) ID 12 length 4 (9) eap: Failed in EAP select (9) [eap] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) Post-Auth-Type REJECT { (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> bob (9) attr_filter.access_reject: Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # Post-Auth-Type REJECT = updated (9) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (9) Sending delayed response (9) Sent Access-Reject Id 121 from 10.30.32.40:1812 to 10.30.32.46:3073 length 44 (9) EAP-Message = 0x040c0004 (9) Message-Authenticator = 0x00000000000000000000000000000000

2 1

How do track the request cache -- 3.0.4
by Mark Williams 04 Oct '16

04 Oct '16

Is there any way to have the server to report/log when it has reached the maximum number of requests which the server keeps track of? The default logging doesn't seem to relay that information. Does the status v-server report such things? I understand the server might hit that value, come down, and hit it again multiple times in a very very short period of time, but the information would be nice to have.

3 2

EAP-FAST failure in v3.0.12
by STE SQE 04 Oct '16

04 Oct '16

Hi, I'm new to RADIUS servers and I'm trying to enable EAP-FAST. Is there a documentation I can use to enable it? I'm using version 3.0.12. Anyway, this is what I've done. EAP file edits: tls-config tls-common { cipher_list = "ALL:!EXPORT:!eNULL:!SSLv2" disable_tlsv1_2 = yes } fast { tls = tls-common pac_lifetime = 604800 authority_identity = "1234" pac_opaque_key = "0123456789abcdef0123456789ABCDEF" virtual_server = inner-tunnel } I don't know where to look at in the debug output but shown below is part of it. (9) eap_fast: Got tunneled Access-Reject (9) eap_fast: Reject (9) eap: ERROR: Failed continuing EAP FAST (43) session. EAP sub-module failed (9) eap: Sending EAP Failure (code 4) ID 12 length 4 (9) eap: Failed in EAP select (9) [eap] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject Are there other files I need to configure before running the RADIUS server? Please tell me what part of the debug output is needed to help with investigation. Kindly help me with the configuration. Best Regards, RT

2 1

Access-Challenge on proxied radius request on eduroam
by Turner, Ryan H 04 Oct '16

04 Oct '16

I am prepared for a lashing, because I am sure I have missed something stupid.. We are running 2.2.8 (yes, I know we should be on 3.X. My systems architect quit and we are hiring another one and one of the first projects will be to get to 3.X. If you want to apply, message me). Eduroam is our primary SSID on campus and we run EAP-TLS. We authenticate 10s of thousands of people on our campus, and people at foreign campuses, every single day. However, there is one school nearby where neither our users can authenticate on their network (using eduroam which proxies back to our campus) nor can their users authenticate on ours. I am totally miffed. If I do a radius -XXX on an attempt (UNC person is at foreign institution connecting which proxies the auth packet to us), this is what I see on our local freeradius server: (Summary: we are sending an access challenge to the user who connects perfectly fine on our own network, but fails to connect on their network- what is going on???) rad_recv: Access-Request packet from host 152.2.X.X port 1814, id=0, length=276 User-Name = "username_removed(a)unc.edu" NAS-IP-Address = 10.229.9.1 NAS-Port = 0 NAS-Identifier = "10.229.9.1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "mac_address_removed" Called-Station-Id = "001A1E00ED18" Service-Type = Framed-User Framed-MTU = 1100 EAP-Message = 0x020800060d00 Aruba-Essid-Name = "eduroam" Aruba-Location-Id = "aEtc3-W" Aruba-AP-Group = "ncssm-hi-avail-hi-density-ap-group" Aruba-Device-Type = "OS X" Message-Authenticator = 0x7afdd181fbc9ca389829bce95736da1f State = 0x16deaa5213d6a791b4d184b49f08d1c8 Vendor-9048-Attr-0 = 0x50726f786965642d42793d544c5253322e656475726f616d2e7573 Proxy-State = 0x313937 Mon Oct 3 16:12:29 2016 : Info: # Executing section authorize from file /opt/unc/freeradius-2.2.8/root/etc/raddb/sites-enabled/default Mon Oct 3 16:12:29 2016 : Info: +group authorize { Mon Oct 3 16:12:29 2016 : Info: ++[preprocess] = ok Mon Oct 3 16:12:29 2016 : Info: ++[chap] = noop Mon Oct 3 16:12:29 2016 : Info: ++[mschap] = noop Mon Oct 3 16:12:29 2016 : Info: ++[digest] = noop Mon Oct 3 16:12:29 2016 : Info: [suffix] Looking up realm "unc.edu" for User-Name = "username_removed(a)unc.edu" Mon Oct 3 16:12:29 2016 : Info: [suffix] Found realm "unc.edu" Mon Oct 3 16:12:29 2016 : Info: [suffix] Adding Realm = "unc.edu" Mon Oct 3 16:12:29 2016 : Info: [suffix] Authentication realm is LOCAL. Mon Oct 3 16:12:29 2016 : Info: ++[suffix] = ok Mon Oct 3 16:12:29 2016 : Info: [eap] EAP packet type response id 8 length 6 Mon Oct 3 16:12:29 2016 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Mon Oct 3 16:12:29 2016 : Info: ++[eap] = updated Mon Oct 3 16:12:29 2016 : Info: [files] users: Matched entry DEFAULT at line 42 Mon Oct 3 16:12:29 2016 : Info: ++[files] = ok Mon Oct 3 16:12:29 2016 : Info: ++[expiration] = noop Mon Oct 3 16:12:29 2016 : Info: ++[logintime] = noop Mon Oct 3 16:12:29 2016 : Info: ++[pap] = noop Mon Oct 3 16:12:29 2016 : Info: +} # group authorize = updated Mon Oct 3 16:12:29 2016 : Info: Found Auth-Type = EAP Mon Oct 3 16:12:29 2016 : Info: # Executing group from file /opt/unc/freeradius-2.2.8/root/etc/raddb/sites-enabled/default Mon Oct 3 16:12:29 2016 : Info: +group authenticate { Mon Oct 3 16:12:29 2016 : Info: [eap] Request found, released from the list Mon Oct 3 16:12:29 2016 : Info: [eap] EAP/tls Mon Oct 3 16:12:29 2016 : Info: [eap] processing type tls Mon Oct 3 16:12:29 2016 : Info: [tls] Authenticate Mon Oct 3 16:12:29 2016 : Info: [tls] processing EAP-TLS Mon Oct 3 16:12:29 2016 : Info: [tls] Received TLS ACK Mon Oct 3 16:12:29 2016 : Info: [tls] ACK handshake fragment handler Mon Oct 3 16:12:29 2016 : Info: [tls] eaptls_verify returned 1 Mon Oct 3 16:12:29 2016 : Info: [tls] eaptls_process returned 13 Mon Oct 3 16:12:29 2016 : Info: ++[eap] = handled Mon Oct 3 16:12:29 2016 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 152.2.X.X port 1814 EAP-Message = 0x010904000dc0000016d755040313056d736361310078307631133011060a0992268993f22c640119160365647531133011060a0992268993f22c6401191603756e6331123010060a0992268993f22c64011916026164313630340603550403132d556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c2053756234003b3039313730350603550403132e556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c20526f6f74330078307631133011060a0992268993f22c640119160365647531133011060a0992268993f22c6401191603756e6331123010 EAP-Message = 0x060a0992268993f22c64011916026164313630340603550403132d556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c205375623300b73081b4310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e312d302b060355040b1324687474703a2f2f63657274732e676f64616464792e636f6d2f7265706f7369746f72792f313330310603550403132a476f2044616464792053656375726520436572746966696361746520417574686f7269747920 Mon Oct 3 16:12:29 2016 : Info: ++[files] = ok Mon Oct 3 16:12:29 2016 : Info: ++[expiration] = noop Mon Oct 3 16:12:29 2016 : Info: ++[logintime] = noop Mon Oct 3 16:12:29 2016 : Info: ++[pap] = noop Mon Oct 3 16:12:29 2016 : Info: +} # group authorize = updated Mon Oct 3 16:12:29 2016 : Info: Found Auth-Type = EAP Mon Oct 3 16:12:29 2016 : Info: # Executing group from file /opt/unc/freeradius-2.2.8/root/etc/raddb/sites-enabled/default Mon Oct 3 16:12:29 2016 : Info: +group authenticate { Mon Oct 3 16:12:29 2016 : Info: [eap] Request found, released from the list Mon Oct 3 16:12:29 2016 : Info: [eap] EAP/tls Mon Oct 3 16:12:29 2016 : Info: [eap] processing type tls Mon Oct 3 16:12:29 2016 : Info: [tls] Authenticate Mon Oct 3 16:12:29 2016 : Info: [tls] processing EAP-TLS Mon Oct 3 16:12:29 2016 : Info: [tls] Received TLS ACK Mon Oct 3 16:12:29 2016 : Info: [tls] ACK handshake fragment handler Mon Oct 3 16:12:29 2016 : Info: [tls] eaptls_verify returned 1 Mon Oct 3 16:12:29 2016 : Info: [tls] eaptls_process returned 13 Mon Oct 3 16:12:29 2016 : Info: ++[eap] = handled Mon Oct 3 16:12:29 2016 : Info: +} # group authenticate = handled Sending Access-Challenge of id 0 to 152.2.X.X port 1814 EAP-Message = 0x010904000dc0000016d755040313056d736361310078307631133011060a0992268993f22c640119160365647531133011060a0992268993f22c6401191603756e6331123010060a0992268993f22c64011916026164313630340603550403132d556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c2053756234003b3039313730350603550403132e556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c20526f6f74330078307631133011060a0992268993f22c640119160365647531133011060a0992268993f22c6401191603756e6331123010 EAP-Message = 0x060a0992268993f22c64011916026164313630340603550403132d556e6976657273697479206f66204e6f727468204361726f6c696e612043686170656c2048696c6c205375623300b73081b4310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e312d302b060355040b1324687474703a2f2f63657274732e676f64616464792e636f6d2f7265706f7369746f72792f313330310603550403132a476f2044616464792053656375726520436572746966696361746520417574686f7269747920 EAP-Message = 0x2d2047320086308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473200653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747900cd3081ca310b300906 EAP-Message = 0x03550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e31333031060355040b132a687474703a2f2f6365727469666963617465732e676f64616464792e636f6d2f7265706f7369746f72793130302e06035504031327476f204461646479205365637572652043657274696669636174696f6e20417574686f726974793111300f06035504051308303739363932383701423082013e3136303406035504030c2d554e432d5365637572652047756573742041636365737320436572746966696361746520417574 EAP-Message = 0x686f72697479313830360603 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x16deaa5210d7a791b4d184b49f08d1c8 Proxy-State = 0x313937 Mon Oct 3 16:12:29 2016 : Info: Finished request 888. Mon Oct 3 16:12:29 2016 : Debug: Going to the next request Mon Oct 3 16:12:29 2016 : Debug: Waking up in 0.3 seconds. Ryan Turner Manager of Network Operations ITS Communication Technologies The University of North Carolina at Chapel Hill r(a)unc.edu<mailto:r@unc.edu> +1 919 445 0113 Office +1 919 274 7926 Mobile

3 8

Simultaneous sessions and deleting stale sessions
by Anirudh Malhotra 04 Oct '16

04 Oct '16

Hi, I have a 2 tier question First would mention the simultaneous verify query for reference simul_verify_query = "\ SELECT \ radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, \ callingstationid, framedprotocol \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" One: I see many posts for deletion of stale sessions not working, One particular post which pretty close to solving the non working problem was: http://lists.freeradius.org/pipermail/freeradius-users/2015-November/080816… The posts conclusion was that fake accounting packet doesnt have the same acct-session-id as that of the stale session that is why it is not able to close it. As acct-unique-session-id(md5 of some attributes including acct-session-id NAS-Identifier etc) comes out to be different. But what i found from a little analysis was that actually the acct-session-id is not the problem but the "NAS-Identifier" is. The NAS-Identifier was being sent in a normal accounting packet(atlease in my case maybe not in somebody else's) but it was not being sent in the "fake accountng query" as it is not present in the radacct table it is not fetched from the table as can be seen in the query above. So the acct-unique-session-id calculated has two different values one in case the normal accounting packet comes and other if fake accounting packet comes, Thus failing over to insertion as updation would not pass. The acct-session-id was coming out to be the same as the stale session's so that was not the problem. Please shed some light on this. Two: I noticed some anomaly in simultaneous verify query in sql and when the attributes are selected to actually delete stale sessions, I am running 3.0.11. which selects radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol. That is 8 attributes from the radacct table. And somehow my stale sessions were all getting acctsessiontime as 0 so on reading the source code which goes like: while (rlm_sql_fetch_row(inst, request, &handle) == 0) { row = handle->row; if (!row) { break; } if (!row[2]){ RDEBUG("Cannot zap stale entry. No username present in entry"); rcode = RLM_MODULE_FAIL; goto finish; } if (!row[1]){ RDEBUG("Cannot zap stale entry. No session id in entry"); rcode = RLM_MODULE_FAIL; goto finish; } if (row[3]) { nas_addr = inet_addr(row[3]); } if (row[4]) { nas_port = atoi(row[4]); } check = rad_check_ts(nas_addr, nas_port, row[2], row[1]); if (check == 0) { /* * Stale record - zap it. */ if (inst->config->delete_stale_sessions == true) { uint32_t framed_addr = 0; char proto = 0; int sess_time = 0; if (row[5]) framed_addr = inet_addr(row[5]); if (row[7]){ if (strcmp(row[7], "PPP") == 0) proto = 'P'; else if (strcmp(row[7], "SLIP") == 0) proto = 'S'; } if (row[8]) sess_time = atoi(row[8]); session_zap(request, nas_addr, nas_port, row[2], row[1], framed_addr, proto, sess_time); } } The code above makes use of 9 attributes last one being(row[8]) acctsessiontime which was not getting fetched in the query. For that reason it always picks the value as 0 for acctsessiontime which is not ideal(a guess). BR, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 5

TLS failure reason as attribute
by Anirudh Malhotra 04 Oct '16

04 Oct '16

Hi, Is there a way to get the TLS failure reason(expired,revoked, invalid like one in the log below) in one of the attributes to be used in linelog? or do I have to check everything manually(unlang) using TLS attributes. Tue Oct 4 12:24:26 2016 : ERROR: (9) eap_tls: ERROR: SSL says error 10 : certificate has expired Tue Oct 4 12:24:26 2016 : ERROR: (9) eap_tls: ERROR: TLS Alert write:fatal:certificate expired Tue Oct 4 12:24:26 2016 : Error: tls: TLS_accept: Error in SSLv3 read client certificate B Tue Oct 4 12:24:26 2016 : Auth: (9) Login incorrect (eap_tls: SSL says error 10 : certificate has expired): [abi] BR, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 2

LDAP, SASL GSSAPI, and group membership, rebind fails
by Tom Carroll 04 Oct '16

04 Oct '16

Hello list, I'm experiencing difficulties with freeradius-3.0.11 when using Ldap-Group and SASL GSSAPI mechanism. rlm_ldap can successfully query for user accounts,binding anonyously and SASL GSSAPI. But when it queries for group membership, rebind operation fails, erroring: Strong(er) authentication required Server said: SASL:[GSSAPI]: Sign or Seal are required.. A subset of ldapsearch -X output: > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Searching for user in group "IPMI Admins" > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Reserved connection (0) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND TMPL XLAT > Thu Sep 29 11:49:54 2016 : Debug: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) > Thu Sep 29 11:49:54 2016 : Debug: Parsed xlat tree: > Thu Sep 29 11:49:54 2016 : Debug: literal --> (sAMAccountName= > Thu Sep 29 11:49:54 2016 : Debug: if { > Thu Sep 29 11:49:54 2016 : Debug: attribute --> Stripped-User-Name > Thu Sep 29 11:49:54 2016 : Debug: } > Thu Sep 29 11:49:54 2016 : Debug: else { > Thu Sep 29 11:49:54 2016 : Debug: attribute --> User-Name > Thu Sep 29 11:49:54 2016 : Debug: } > Thu Sep 29 11:49:54 2016 : Debug: literal --> ) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: --> (sAMAccountName=johndoe) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND TMPL LITERAL > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Performing search in "DC=example,DC=org" with filter "(sAMAccountName=johndoe)", scope "sub" > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Waiting for search result... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Rebinding to URL ldap://example.org/CN=Configuration,DC=example,DC=org > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Starting SASL mech(s): GSSAPI > SASL/GSSAPI authentication started > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL challenge : Authorization Name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL prompt : Please enter your authorization name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL result : RADIUS1$(a)EXAMPLE.ORG > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : `??? *?H??????? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : ???? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech (null)... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : > SASL username: RADIUS1$(a)EXAMPLE.ORG > SASL SSF: 56 > SASL data security layer installed. > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Bind successful > Thu Sep 29 11:49:54 2016 : Debug: (0) files: User object found at DN "CN=johndoe,CN=Users,DC=example,DC=org" > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Checking for user in group objects > Thu Sep 29 11:49:54 2016 : Debug: (&(cn=IPMI Admins)(objectClass=group)(member=%{control:Ldap-UserDn})) > Thu Sep 29 11:49:54 2016 : Debug: Parsed xlat tree: > Thu Sep 29 11:49:54 2016 : Debug: literal --> (&(cn=IPMI Admins)(objectClass=group)(member= > Thu Sep 29 11:49:54 2016 : Debug: attribute --> LDAP-UserDN > Thu Sep 29 11:49:54 2016 : Debug: literal --> )) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND (&(cn=IPMI Admins)(objectClass=group)(member=%{control:Ldap-UserDn})) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: --> (&(cn=IPMI Admins)(objectClass=group)(member=CN\3djohndoe\2cCN\3dUsers\2cDC\3dexample\2cDC\3dorg)) > Thu Sep 29 11:49:54 2016 : Debug: (0) files: EXPAND TMPL LITERAL > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Starting SASL mech(s): GSSAPI > SASL/GSSAPI authentication started > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL challenge : Authorization Name > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL prompt : Please enter your authorization name > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL result : RADIUS1$(a)EXAMPLE.ORG > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL response : `??? *?H??????? > Thu Sep 29 11:49:54 2016 : Debug: (0) files: Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: (0) files: SASL response : ???? > Thu Sep 29 11:49:54 2016 : ERROR: (0) files: Bind with (anonymous) to ldap://ad1.example.org:389 failed: Strong(er) authentication required > Thu Sep 29 11:49:54 2016 : ERROR: (0) files: Server said: SASL:[GSSAPI]: Sign or Seal are required.. > Thu Sep 29 11:49:54 2016 : Info: rlm_ldap (ldap): Deleting connection (0) > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap: Closing libldap handle 0xb46810 > Thu Sep 29 11:49:54 2016 : Info: rlm_ldap (ldap): Need 6 more connections to reach 10 spares > Thu Sep 29 11:49:54 2016 : Info: rlm_ldap (ldap): Opening additional connection (5), 1 of 28 pending slots used > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Connecting to ldap://smbdc0.example.org:389 > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): New libldap handle 0xb46810 > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Starting SASL mech(s): GSSAPI > SASL/GSSAPI authentication started > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL challenge : Authorization Name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL prompt : Please enter your authorization name > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL result : RADIUS1$(a)EXAMPLE.ORG > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : `??? *?H??????? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech GSSAPI... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : ???? > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Continuing SASL mech (null)... > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): SASL response : > SASL username: RADIUS1$(a)EXAMPLE.ORG > SASL SSF: 56 > SASL data security layer installed. > Thu Sep 29 11:49:54 2016 : Debug: rlm_ldap (ldap): Bind successful > Thu Sep 29 11:49:54 2016 : Debug: (0) files: User is not a member of "IPMI Admins"

3 6

Segfault at src/lib/misc.c:1193 in 3.0.4 (3.0.11 looks very similar)
by Mike Ely 04 Oct '16

04 Oct '16

Behavior is similar on two production hosts running Centos 7.2. Radius is setup as proxy only, passes authentication successfully for a time, then abruptly segfaults. Attached gdb to corefile and found this: Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `/usr/sbin/radiusd -d /etc/raddb'. Program terminated with signal 11, Segmentation fault. #0 fr_ipaddr_cmp (a=0x20, b=0x7f3965a30510) at src/lib/misc.c:1193 1193 if (a->af < b->af) return -1; It looks like it's somehow getting the memory address for "a" set to 0x20, which is obviously invalid, and then it segfaults. Where should I look in the configs for where realm acct_pool servers is being set up and what would I expect to see in a configuration that would allow the server to run successfully and then crash abruptly like this? Obviously let me know what other data to provide for debugging this. Thanks, Mike

5 26

insert ips to ippool
by Zubair Ayub 03 Oct '16

03 Oct '16

i want to ask that i have thousands of ips can you please tell me how to add these ips in ippool table .. it will take big effort and time to add one by one is there another way to add those ips like 175.1.2.0/24 .. regards zubair ayub thanks

3 5