- Freeradius-Users - lists.freeradius.org

Re: User login restrictions based on SSID
by Eby Mani 24 May '16

24 May '16

I can login to mysql with the credentials used in sql.conf, yet not sure why it gives Mysql error. i have even restarted the server and getting same error. Eby Tue May 24 20:35:21 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue May 24 20:35:21 2016 : Info: rlm_sql (sql): Attempting to connect to root@localhost:3306/radius Tue May 24 20:35:21 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Tue May 24 20:35:21 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Tue May 24 20:35:21 2016 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius Tue May 24 20:35:21 2016 : Error: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.so' Tue May 24 20:35:21 2016 : Error: rlm_sql (sql): Failed to connect DB handle #0 Tue May 24 20:35:21 2016 : Error: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 Tue May 24 20:35:21 2016 : Error: Failed to load clients from SQL. Tue May 24 20:35:21 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Tue May 24 20:35:21 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Tue May 24 20:35:21 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Tue May 24 20:35:21 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Tue May 24 20:35:21 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 Tue May 24 20:35:21 2016 : Error: /etc/freeradius/sql.conf[22]: Instantiation failed for module "sql" Tue May 24 20:35:21 2016 : Error: /etc/freeradius/sites-enabled/default[122]: Failed to load module "sql". Tue May 24 20:35:21 2016 : Error: /etc/freeradius/sites-enabled/default[69]: Errors parsing authorize section. Tue May 24 20:35:21 2016 : Error: Failed to load virtual server <default> Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Attempting to connect to root@localhost:3306/radius Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Tue May 24 20:35:22 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Tue May 24 20:35:22 2016 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius Tue May 24 20:35:22 2016 : Error: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.so' Tue May 24 20:35:22 2016 : Error: rlm_sql (sql): Failed to connect DB handle #0 Tue May 24 20:35:22 2016 : Error: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 Tue May 24 20:35:22 2016 : Error: Failed to load clients from SQL. Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 Tue May 24 20:35:22 2016 : Error: /etc/freeradius/sql.conf[22]: Instantiation failed for module "sql" Tue May 24 20:35:22 2016 : Error: /etc/freeradius/sites-enabled/default[122]: Failed to load module "sql". Tue May 24 20:35:22 2016 : Error: /etc/freeradius/sites-enabled/default[69]: Errors parsing authorize section. Tue May 24 20:35:22 2016 : Error: Failed to load virtual server <default> Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Attempting to connect to root@localhost:3306/radius Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Tue May 24 20:35:22 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Tue May 24 20:35:22 2016 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius Tue May 24 20:35:22 2016 : Error: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.so' Tue May 24 20:35:22 2016 : Error: rlm_sql (sql): Failed to connect DB handle #0 Tue May 24 20:35:22 2016 : Error: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 Tue May 24 20:35:22 2016 : Error: Failed to load clients from SQL. Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Tue May 24 20:35:22 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 Tue May 24 20:35:22 2016 : Error: /etc/freeradius/sql.conf[22]: Instantiation failed for module "sql" Tue May 24 20:35:22 2016 : Error: /etc/freeradius/sites-enabled/default[122]: Failed to load module "sql". Tue May 24 20:35:22 2016 : Error: /etc/freeradius/sites-enabled/default[69]: Errors parsing authorize section. Tue May 24 20:35:22 2016 : Error: Failed to load virtual server <default> Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Attempting to connect to root@localhost:3306/radius Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Tue May 24 20:35:23 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Tue May 24 20:35:23 2016 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius Tue May 24 20:35:23 2016 : Error: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.so' Tue May 24 20:35:23 2016 : Error: rlm_sql (sql): Failed to connect DB handle #0 Tue May 24 20:35:23 2016 : Error: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 Tue May 24 20:35:23 2016 : Error: Failed to load clients from SQL. Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 Tue May 24 20:35:23 2016 : Error: /etc/freeradius/sql.conf[22]: Instantiation failed for module "sql" Tue May 24 20:35:23 2016 : Error: /etc/freeradius/sites-enabled/default[122]: Failed to load module "sql". Tue May 24 20:35:23 2016 : Error: /etc/freeradius/sites-enabled/default[69]: Errors parsing authorize section. Tue May 24 20:35:23 2016 : Error: Failed to load virtual server <default> Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Attempting to connect to root@localhost:3306/radius Tue May 24 20:35:23 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Tue May 24 20:35:23 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Tue May 24 20:35:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Tue May 24 20:35:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Tue May 24 20:35:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Tue May 24 20:35:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Tue May 24 20:35:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Tue May 24 20:35:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Tue May 24 20:35:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 Tue May 24 20:35:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Tue May 24 20:35:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Tue May 24 20:35:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #3 Tue May 24 20:35:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Tue May 24 20:35:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Tue May 24 20:35:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #4 Tue May 24 20:35:25 2016 : Info: Loaded virtual server <default> Tue May 24 20:35:25 2016 : Info: Loaded virtual server inner-tunnel Tue May 24 20:35:25 2016 : Info: ... adding new socket proxy address * port 40350 Tue May 24 20:35:25 2016 : Info: Ready to process requests. Tue May 24 20:38:05 2016 : Info: Signalled to terminate Tue May 24 20:38:05 2016 : Info: Exiting normally. Tue May 24 20:38:05 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Tue May 24 20:38:05 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Tue May 24 20:38:05 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Tue May 24 20:38:05 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Tue May 24 20:38:05 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 -------------------------------------------- On Mon, 23/5/16, Alan DeKok <aland(a)deployingradius.com> wrote: If only there was some kind of debug log, where you could see what the server was doing. Alan DeKok.

2 1

Re: EAP-SIM Error "Failed continuing EAP SIM (18) session. EAP sub-module failed"
by Li Zhaoxing 24 May '16

24 May '16

Hi, sorry to reply after such a long time, since I have tried many methods to fix the bug. >> Hi, I am new here and here is my problem: >> I am using FreeRADIUS version 3.0.4 > You should probably upgrade. I upgraded to 3.0.11 and still failed...sigh>_< >> (8) authenticate { >> (8) eap: Expiring EAP session with state 0x14c723b2157231b1 >> (8) eap: Finished EAP session with state 0x14c723b2157231b1 >> (8) eap: Previous EAP request found for state 0x14c723b2157231b1, released from the list >> (8) eap: Peer sent packet with method EAP SIM (18) >> (8) eap: Calling submodule eap_sim to process data >> (8) eap: ERROR: Failed continuing EAP SIM (18) session. EAP sub-module failed >> (8) eap: Sending EAP Failure (code 4) ID 181 length 4 > > That's not good. It would be nice to get a message as to *why* it failed. > > I've pushed some additional debug messages. Please try the v3.0.x branch from git: > >https://github.com/FreeRADIUS/freeradius-server/archive/v3.0.x.zip > > Alan DeKok. Thank you so much , and I have downloaded the source and installed ,exactly the same bug appears and output log about the bug is the same, which includes only one line telling"Failed continuing EAP session". I didn't get more log about the bug in my test using a read sim card, BUT something goes wrong when I run radeapclient to test my radius server: when I use a radeapclient to perform an authentication, I will get Access-Accept, but there is an error in the log. After checking the MAC successfully, the Radius server failed to decode the EAP package, with the Error log:"(28) eap_sim: ERROR: Failed decoding EAP-SIM packet: ". But server still send the EAP Success. Maybe there is something related between the two bugs. Here is the full log: (26) Received Access-Request Id 147 from 127.0.0.1:59677 to 127.0.0.1:1812 length 161 (26) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (26) NAS-IP-Address = 127.0.0.1 (26) Message-Authenticator = 0xbefb520ad5d6083aeaa7d71c51b74237 (26) NAS-Port = 0 (26) EAP-Message = 0x022b0038013132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f7267 (26) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (26) authorize { (26) policy filter_username { (26) if (&User-Name) { (26) if (&User-Name) -> TRUE (26) if (&User-Name) { (26) if (&User-Name =~ / /) { (26) if (&User-Name =~ / /) -> FALSE (26) if (&User-Name =~ /@[^@]*@/ ) { (26) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (26) if (&User-Name =~ /\.\./ ) { (26) if (&User-Name =~ /\.\./ ) -> FALSE (26) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (26) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (26) if (&User-Name =~ /\.$/) { (26) if (&User-Name =~ /\.$/) -> FALSE (26) if (&User-Name =~ /(a)\./) { (26) if (&User-Name =~ /(a)\./) -> FALSE (26) } # if (&User-Name) = notfound (26) } # policy filter_username = notfound (26) [preprocess] = ok (26) [chap] = noop (26) [mschap] = noop (26) [digest] = noop (26) suffix: Checking for suffix after "@" (26) suffix: Looking up realm "wlan.mnc093.mcc208.3gppnetwork.org" for User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (26) suffix: No such realm "wlan.mnc093.mcc208.3gppnetwork.org" (26) [suffix] = noop (26) files: users: Matched entry 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org at line 4 (26) [files] = ok (26) eap: Peer sent EAP Response (code 2) ID 43 length 56 (26) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (26) [eap] = ok (26) } # authorize = ok (26) Found Auth-Type = eap (26) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (26) authenticate { (26) eap: Peer sent packet with method EAP Identity (1) (26) eap: Calling submodule eap_sim to process data (26) eap: Sending EAP Request (code 1) ID 1 length 20 (26) eap: EAP session adding &reply:State = 0x1140333a11412123 (26) [eap] = handled (26) } # authenticate = handled (26) Using Post-Auth-Type Challenge (26) Post-Auth-Type sub-section not found. Ignoring. (26) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (26) Sent Access-Challenge Id 147 from 127.0.0.1:1812 to 127.0.0.1:59677 length 0 (26) EAP-Message = 0x01010014120a00000f0200020001000011010171 (26) Message-Authenticator = 0x00000000000000000000000000000000 (26) State = 0x1140333a11412123fb61540a5217ec47 (26) Finished request Waking up in 4.9 seconds. (27) Received Access-Request Id 221 from 127.0.0.1:59677 to 127.0.0.1:1812 length 211 (27) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (27) NAS-IP-Address = 127.0.0.1 (27) Message-Authenticator = 0xa9602d366f22e9b1872f6bb0e8be92e3 (27) NAS-Port = 0 (27) EAP-Message = 0x02010058120a00001001000107050000be93130ac98c40bcaf65ba75d30c3e270e0e00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 (27) State = 0x1140333a11412123fb61540a5217ec47 (27) session-state: No cached attributes (27) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (27) authorize { (27) policy filter_username { (27) if (&User-Name) { (27) if (&User-Name) -> TRUE (27) if (&User-Name) { (27) if (&User-Name =~ / /) { (27) if (&User-Name =~ / /) -> FALSE (27) if (&User-Name =~ /@[^@]*@/ ) { (27) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (27) if (&User-Name =~ /\.\./ ) { (27) if (&User-Name =~ /\.\./ ) -> FALSE (27) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (27) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (27) if (&User-Name =~ /\.$/) { (27) if (&User-Name =~ /\.$/) -> FALSE (27) if (&User-Name =~ /(a)\./) { (27) if (&User-Name =~ /(a)\./) -> FALSE (27) } # if (&User-Name) = notfound (27) } # policy filter_username = notfound (27) [preprocess] = ok (27) [chap] = noop (27) [mschap] = noop (27) [digest] = noop (27) suffix: Checking for suffix after "@" (27) suffix: Looking up realm "wlan.mnc093.mcc208.3gppnetwork.org" for User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (27) suffix: No such realm "wlan.mnc093.mcc208.3gppnetwork.org" (27) [suffix] = noop (27) files: users: Matched entry 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org at line 4 (27) [files] = ok (27) eap: Peer sent EAP Response (code 2) ID 1 length 88 (27) eap: No EAP Start, assuming it's an on-going EAP conversation (27) [eap] = updated (27) [expiration] = noop (27) [logintime] = noop (27) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (27) pap: WARNING: Authentication will fail unless a "known good" password is available (27) [pap] = noop (27) } # authorize = updated (27) Found Auth-Type = eap (27) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (27) authenticate { (27) eap: Expiring EAP session with state 0x1140333a11412123 (27) eap: Finished EAP session with state 0x1140333a11412123 (27) eap: Previous EAP request found for state 0x1140333a11412123, released from the list (27) eap: Peer sent packet with method EAP SIM (18) (27) eap: Calling submodule eap_sim to process data (27) eap_sim: EAP-SIM decoded packet (27) eap_sim: User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (27) eap_sim: NAS-IP-Address = 127.0.0.1 (27) eap_sim: Message-Authenticator = 0xa9602d366f22e9b1872f6bb0e8be92e3 (27) eap_sim: NAS-Port = 0 (27) eap_sim: EAP-Message = 0x02010058120a00001001000107050000be93130ac98c40bcaf65ba75d30c3e270e0e00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 (27) eap_sim: State = 0x1140333a11412123fb61540a5217ec47 (27) eap_sim: Event-Timestamp = "May 24 2016 14:56:01 CST" (27) eap_sim: EAP-Type = SIM (27) eap_sim: EAP-Sim-Subtype = Start (27) eap_sim: EAP-Sim-SELECTED_VERSION = 0x0001 (27) eap_sim: EAP-Sim-NONCE_MT = 0x0000be93130ac98c40bcaf65ba75d30c3e27 (27) eap_sim: EAP-Sim-IDENTITY = 0x00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 (27) eap: Sending EAP Request (code 1) ID 2 length 80 (27) eap: EAP session adding &reply:State = 0x1140333a10422123 (27) [eap] = handled (27) } # authenticate = handled (27) Using Post-Auth-Type Challenge (27) Post-Auth-Type sub-section not found. Ignoring. (27) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (27) Sent Access-Challenge Id 221 from 127.0.0.1:1812 to 127.0.0.1:59677 length 0 (27) EAP-Message = 0x01020050120b0000010d0000952f4f7ced3f2525a6f6feda2352d2a2c05f33c78f0f84dc8ed8ed6cf3b683af88e58d47a71cdaf83ad0427b150a6a930b0500004d181d7cdee6ce8198babe34a81d81ea (27) Message-Authenticator = 0x00000000000000000000000000000000 (27) State = 0x1140333a10422123fb61540a5217ec47 (27) Finished request Waking up in 4.9 seconds. (28) Received Access-Request Id 99 from 127.0.0.1:59677 to 127.0.0.1:1812 length 151 (28) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (28) NAS-IP-Address = 127.0.0.1 (28) Message-Authenticator = 0x8327774ed80c7e34c6b92cb44a1fdaad (28) NAS-Port = 0 (28) State = 0x1140333a10422123fb61540a5217ec47 (28) EAP-Message = 0x0202001c120b00000b050000e1bbad6ef008ebe1e2d4a489c7cb12a7 (28) session-state: No cached attributes (28) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (28) authorize { (28) policy filter_username { (28) if (&User-Name) { (28) if (&User-Name) -> TRUE (28) if (&User-Name) { (28) if (&User-Name =~ / /) { (28) if (&User-Name =~ / /) -> FALSE (28) if (&User-Name =~ /@[^@]*@/ ) { (28) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (28) if (&User-Name =~ /\.\./ ) { (28) if (&User-Name =~ /\.\./ ) -> FALSE (28) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (28) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (28) if (&User-Name =~ /\.$/) { (28) if (&User-Name =~ /\.$/) -> FALSE (28) if (&User-Name =~ /(a)\./) { (28) if (&User-Name =~ /(a)\./) -> FALSE (28) } # if (&User-Name) = notfound (28) } # policy filter_username = notfound (28) [preprocess] = ok (28) [chap] = noop (28) [mschap] = noop (28) [digest] = noop (28) suffix: Checking for suffix after "@" (28) suffix: Looking up realm "wlan.mnc093.mcc208.3gppnetwork.org" for User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (28) suffix: No such realm "wlan.mnc093.mcc208.3gppnetwork.org" (28) [suffix] = noop (28) files: users: Matched entry 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org at line 4 (28) [files] = ok (28) eap: Peer sent EAP Response (code 2) ID 2 length 28 (28) eap: No EAP Start, assuming it's an on-going EAP conversation (28) [eap] = updated (28) [expiration] = noop (28) [logintime] = noop (28) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (28) pap: WARNING: Authentication will fail unless a "known good" password is available (28) [pap] = noop (28) } # authorize = updated (28) Found Auth-Type = eap (28) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (28) authenticate { (28) eap: Expiring EAP session with state 0x1140333a10422123 (28) eap: Finished EAP session with state 0x1140333a10422123 (28) eap: Previous EAP request found for state 0x1140333a10422123, released from the list (28) eap: Peer sent packet with method EAP SIM (18) (28) eap: Calling submodule eap_sim to process data (28) eap_sim: MAC check succeed (28) eap_sim: ERROR: Failed decoding EAP-SIM packet: (28) eap: Sending EAP Success (code 3) ID 3 length 4 (28) eap: Freeing handler (28) [eap] = ok (28) } # authenticate = ok (28) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (28) post-auth { (28) update { (28) No attributes updated (28) } # update = noop (28) [exec] = noop (28) policy remove_reply_message_if_eap { (28) if (&reply:EAP-Message && &reply:Reply-Message) { (28) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (28) else { (28) [noop] = noop (28) } # else = noop (28) } # policy remove_reply_message_if_eap = noop (28) } # post-auth = noop (28) Sent Access-Accept Id 99 from 127.0.0.1:1812 to 127.0.0.1:59677 length 0 (28) MS-MPPE-Recv-Key = 0x3e595d1f242073e0ca72dcc4ab8330d8412dab890100d75f2c07bd9d108a8907 (28) MS-MPPE-Send-Key = 0xbb480dc076472f57534eec21ac7d3e8acbcab8d687acc1e9ca743e333d6053e2 (28) EAP-Message = 0x03030004 (28) Message-Authenticator = 0x00000000000000000000000000000000 (28) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (28) Finished request Waking up in 4.9 seconds. (26) Cleaning up request packet ID 147 with timestamp +529 (27) Cleaning up request packet ID 221 with timestamp +529 (28) Cleaning up request packet ID 99 with timestamp +529 Ready to process requests and my radeapclient get access-accept: lzx@lzx-ThinkPad-Edge-E440:~/Documents/eapsim-03$ radeapclient -x 127.0.0.1:1812 auth testing123 <eapsim-realin.txt Loading input data... Read 1 element(s) from input: stdin Loaded: 1 input element(s). Adding new socket: src: 0.0.0.0:0, dst: 127.0.0.1:1812 Added new socket: 5 (num sockets: 1) Transaction: 0, sending packet: 0 (id: 147)... Sent Access-Request Id 147 from 0.0.0.0:59677 to 127.0.0.1:1812 length 161 User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" NAS-IP-Address = 127.0.0.1 EAP-Code = Response EAP-Type-Identity = 0x3132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x30 NAS-Port = 0 EAP-Sim-Rand1 = 0x952f4f7ced3f2525a6f6feda2352d2a2 EAP-Sim-SRES1 = 0x0bce7fec EAP-Sim-KC1 = 0xc54c5eddc4daa000 EAP-Sim-Rand2 = 0xc05f33c78f0f84dc8ed8ed6cf3b683af EAP-Sim-SRES2 = 0x54045fe1 EAP-Sim-KC2 = 0x347fd8b31c52c000 EAP-Sim-Rand3 = 0x88e58d47a71cdaf83ad0427b150a6a93 EAP-Sim-SRES3 = 0x3cc3655a EAP-Sim-KC3 = 0x1ceac0d78b418c00 EAP-Message = 0x022b0038013132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f7267 Transaction: 0, received packet (id: 147). Received Access-Challenge Id 147 from 127.0.0.1:1812 to 0.0.0.0:59677 length 78 EAP-Message = 0x01010014120a00000f0200020001000011010171 Message-Authenticator = 0xf5738cc29c0afea9df93645c8ea1845d State = 0x1140333a11412123fb61540a5217ec47 EAP-Id = 1 EAP-Code = Request EAP-Type-SIM = 0x0a00000f0200020001000011010171 Transaction: 0, sending packet: 1 (id: 221)... Sent Access-Request Id 221 from 0.0.0.0:59677 to 127.0.0.1:1812 length 211 User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" NAS-IP-Address = 127.0.0.1 EAP-Code = Response Message-Authenticator = 0x30 NAS-Port = 0 EAP-Sim-Rand1 = 0x952f4f7ced3f2525a6f6feda2352d2a2 EAP-Sim-SRES1 = 0x0bce7fec EAP-Sim-KC1 = 0xc54c5eddc4daa000 EAP-Sim-Rand2 = 0xc05f33c78f0f84dc8ed8ed6cf3b683af EAP-Sim-SRES2 = 0x54045fe1 EAP-Sim-KC2 = 0x347fd8b31c52c000 EAP-Sim-Rand3 = 0x88e58d47a71cdaf83ad0427b150a6a93 EAP-Sim-SRES3 = 0x3cc3655a EAP-Sim-KC3 = 0x1ceac0d78b418c00 EAP-Sim-State = 1 EAP-Sim-Subtype = Start EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-NONCE_MT = 0x0000be93130ac98c40bcaf65ba75d30c3e27 EAP-Sim-IDENTITY = 0x00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f7267 EAP-Id = 1 EAP-Message = 0x02010058120a00001001000107050000be93130ac98c40bcaf65ba75d30c3e270e0e00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 State = 0x1140333a11412123fb61540a5217ec47 Transaction: 0, received packet (id: 221). Received Access-Challenge Id 221 from 127.0.0.1:1812 to 0.0.0.0:59677 length 138 EAP-Message = 0x01020050120b0000010d0000952f4f7ced3f2525a6f6feda2352d2a2c05f33c78f0f84dc8ed8ed6cf3b683af88e58d47a71cdaf83ad0427b150a6a930b0500004d181d7cdee6ce8198babe34a81d81ea Message-Authenticator = 0x92805d7b3830f49e9ea3e4aed09b0019 State = 0x1140333a10422123fb61540a5217ec47 EAP-Id = 2 EAP-Code = Request EAP-Type-SIM = 0x0b0000010d0000952f4f7ced3f2525a6f6feda2352d2a2c05f33c78f0f84dc8ed8ed6cf3b683af88e58d47a71cdaf83ad0427b150a6a930b0500004d181d7cdee6ce8198babe34a81d81ea Input was: identity: (len=51)3132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f7267 nonce_mt: be93130ac98c40bcaf65ba75d30c3e27 rand0: 00000000000000000000000000000000 rand1: 00000000000000000000000000000000 rand2: 00000000000000000000000000000000 sres0: 0bce7fec sres1: 54045fe1 sres2: 3cc3655a Kc0: c54c5eddc4daa000 Kc1: 347fd8b31c52c000 Kc2: 1ceac0d78b418c00 versionlist[2]: 0001 select 00 01 Output mk: 6650dc9d_bb45dfb6_874073da_f1f0d096_5814acf9 K_aut: 826899db_b5f04b65_99b7dd0b_4be31da5 K_encr: 21545ec5_64dea6e6_b2fda708_653dc4a7 msk: 3e595d1f_242073e0_ca72dcc4_ab8330d8_412dab89 0100d75f_2c07bd9d_108a8907_bb480dc0_76472f57 534eec21_ac7d3e8a_cbcab8d6_87acc1e9_ca743e33 3d6053e2 emsk: 2a5800e2_61055f79_a31e2f46_7387892a_7e8c5ff8 c53c490f_05fa1c2b_2a09de83_992cfdd3_cfce6fad f7079c8a_b5d52cd9_1dee6702_8f5cfc76_86f6101b 4ac5d3a3 MAC check succeed Transaction: 0, sending packet: 2 (id: 99)... Sent Access-Request Id 99 from 0.0.0.0:59677 to 127.0.0.1:1812 length 151 User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" NAS-IP-Address = 127.0.0.1 EAP-Code = Response Message-Authenticator = 0x30 NAS-Port = 0 EAP-Sim-Rand1 = 0x952f4f7ced3f2525a6f6feda2352d2a2 EAP-Sim-SRES1 = 0x0bce7fec EAP-Sim-KC1 = 0xc54c5eddc4daa000 EAP-Sim-Rand2 = 0xc05f33c78f0f84dc8ed8ed6cf3b683af EAP-Sim-SRES2 = 0x54045fe1 EAP-Sim-KC2 = 0x347fd8b31c52c000 EAP-Sim-Rand3 = 0x88e58d47a71cdaf83ad0427b150a6a93 EAP-Sim-SRES3 = 0x3cc3655a EAP-Sim-KC3 = 0x1ceac0d78b418c00 EAP-Sim-State = 1 EAP-Sim-Subtype = Challenge EAP-Id = 2 State = 0x1140333a10422123fb61540a5217ec47 EAP-Sim-MAC = 0x0bce7fec54045fe13cc3655a EAP-Sim-KEY = 0x826899dbb5f04b6599b7dd0b4be31da5 EAP-Message = 0x0202001c120b00000b050000e1bbad6ef008ebe1e2d4a489c7cb12a7 Transaction: 0, received packet (id: 99). Received Access-Accept Id 99 from 127.0.0.1:1812 to 0.0.0.0:59677 length 213 MS-MPPE-Recv-Key = 0x3e595d1f242073e0ca72dcc4ab8330d8412dab890100d75f2c07bd9d108a8907 MS-MPPE-Send-Key = 0xbb480dc076472f57534eec21ac7d3e8acbcab8d687acc1e9ca743e333d6053e2 EAP-Message = 0x03030004 Message-Authenticator = 0xe7d68322630318e6c791574cd504bfda User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" EAP-Id = 3 EAP-Code = Success Main loop: done. Is there any posibility that my read sim card or my mobile device get something wrong with EAP-SIM? But I have tested in two different devices with EAP-SIM capability and get the same result as told above. Or Is there anything I can do to locate the bug? Thank you so much and hoping for your reply~

2 1

User login restrictions based on SSID
by Eby Mani 24 May '16

24 May '16

I'm trying to set login restrictions based on SSID. For example users in Sales Group should only connect a particular SSID, etc.. and Support Team should be able to login to any SSID. We have Aruba Controller, which provide SSID in Aruba-Essid-Name attribute in Access-Request and using daloradius for user management. First i've tried the following to get this working without adding any sql code; "Aruba-Essid-Name := ssid_name" in User Group Check attributes - didn't work "Aruba-Essid-Name := ssid_name" in User Check attributes - didn't work And finally using the 'address' column in 'userinfo' TABLE to store SSID info. And have put the following in authorize {} sites-enabled/default ; if ("%{sql:SELECT COUNT(*) FROM userinfo WHERE userinfo.username= '%{User-Name}' AND userinfo.address= '%{Aruba-Essid-Name}'} >0") { ok } else { reject } sql No mater which SSID, i'm able to connect. Thanks, Eby

3 2

Max-All-Session not present reject
by Joaquin Alzola 24 May '16

24 May '16

Hi Guys, I have the following output form the radiusd -X: (0) expired_Xh: WARNING: Couldn't find check attribute, control:Max-All-Session, doing nothing... (0) [expired_Xh] = noop <-- noop here is telling to continue (The roblem is normal because I have not put it on the DB) I just want that in case the radius doesn't find the Max-All-Session on the sql server that it will reject the login. I have try multiple options on the authorize{} with unlang (not an expert on it anyway). authorize{ expired_Xh if (&reply:Max-All-Session == "") { reject } } (of course I have a parsing error) Just the counter: sqlcounter expired_Xh { sql_module_instance = sql #dialect = ${modules.sql.dialect} dialect = mysql counter_name = Max-All-Session-Time check_name = Max-All-Session key = User-Name reset = never $INCLUDE ${modconfdir}/sql/counter/${dialect}/${.:instance}.conf } This email is confidential and may be subject to privilege. If you are not the intended recipient, please do not copy or disclose its content but contact the sender immediately upon receipt.

2 2

radtest OK ssh NOK
by Joaquin Alzola 24 May '16

24 May '16

HI Guys Doing an integration on te freeradiuos 3.0.11 into a OpenSuse Linux. I got a successful on radtest. testbedocg:/usr/local/etc/raddb/sites-enabled # radtest dop "dop" 172.16.173.31 1812 Lebara321 Sent Access-Request Id 212 from 0.0.0.0:56392 to 172.16.173.31:1812 length 73 User-Name = "dop" User-Password = "dop" NAS-IP-Address = 192.168.23.31 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "dop" Received Access-Accept Id 212 from 172.16.173.31:1812 to 0.0.0.0:0 length 26 Session-Timeout = 86101 testbedocg:/usr/local/etc/raddb/sites-enabled # client 172.16 { ipaddr = 172.16.0.0/16 secret = Lebara321 nas_type = other } But not successful on ssh. It clearly says that the passwords do not match but checking in SQL I have this line: +----+----------+--------------------+----+------------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+------------------------------------+ | 42 | dop | Max-All-Session | := | 1464051644 | | 41 | dop | Cleartext-Password | := | dop | (4) Received Access-Request Id 3 from 172.16.173.31:52494 to 172.16.173.31:1812 length 84 (4) User-Name = "dop" (4) User-Password = "\010\n\r\177INCORRECT" (4) NAS-IP-Address = 192.168.23.31 (4) NAS-Identifier = "sshd" (4) NAS-Port = 92450 (4) NAS-Port-Type = Virtual (4) Service-Type = Authenticate-Only (4) Calling-Station-Id = "127.0.0.1" (4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "dop", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: No EAP-Message, not doing EAP (4) [eap] = noop (4) [files] = noop (4) sql: EXPAND %{User-Name} (4) sql: --> dop (4) sql: SQL-User-Name set to 'dop' rlm_sql (sql): Reserved connection (8) (4) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (4) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dop' ORDER BY id (4) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dop' ORDER BY id (4) sql: User found in radcheck table (4) sql: Conditional check items matched, merging assignment check items (4) sql: Cleartext-Password := "dop" (4) sql: Max-All-Session := 1464051644 (4) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (4) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dop' ORDER BY id (4) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dop' ORDER BY id (4) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (4) sql: --> SELECT groupname FROM radusergroup WHERE username = 'dop' ORDER BY priority (4) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'dop' ORDER BY priority (4) sql: User not found in any groups rlm_sql (sql): Released connection (8) rlm_sql (sql): Need 1 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (10), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.0.67, protocol version 10 (4) [sql] = ok sqlcounter_expand: 'select UNIX_TIMESTAMP(sysdate()) - value from raduser_connection_time where username='%{User-Name}';' (4) expired_Xh: EXPAND %{User-Name} (4) expired_Xh: --> dop (4) expired_Xh: SQL-User-Name set to 'dop' rlm_sql (sql): Reserved connection (9) (4) expired_Xh: Executing select query: select UNIX_TIMESTAMP(sysdate()) - value from raduser_connection_time where username='dop'; rlm_sql (sql): Released connection (9) (4) expired_Xh: EXPAND %{sql:select UNIX_TIMESTAMP(sysdate()) - value from raduser_connection_time where username='%{User-Name}';} (4) expired_Xh: --> 1463966096 (4) expired_Xh: Allowing user, &control:Max-All-Session value (1464051644) is greater than counter value (1463966096) (4) expired_Xh: Setting &reply:Session-Timeout value to 85548 (4) [expired_Xh] = ok (4) [expiration] = noop (4) [logintime] = noop (4) [pap] = updated (4) } # authorize = updated (4) Found Auth-Type = PAP (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) Auth-Type PAP { (4) pap: Login attempt with password (4) pap: Comparing with "known good" Cleartext-Password (4) pap: ERROR: Cleartext password "dop" does not match "known good" password (4) pap: Passwords don't match (4) [pap] = reject (4) } # Auth-Type PAP = reject (4) Failed to authenticate the user (4) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! (4) Using Post-Auth-Type Reject (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) Post-Auth-Type REJECT { (4) sql: EXPAND .query (4) sql: --> .query (4) sql: Using query template 'query' rlm_sql (sql): Reserved connection (8) (4) sql: EXPAND %{User-Name} (4) sql: --> dop (4) sql: SQL-User-Name set to 'dop' (4) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (4) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'dop', '=3D08=5Cn=3D0D=3D7FINCORRECT', 'Access-Reject', '2016-05-24 02:14:56') (4) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'dop', '=3D08=5Cn=3D0D=3D7FINCORRECT', 'Access-Reject', '2016-05-24 02:14:56') (4) sql: SQL query returned: success (4) sql: 1 record(s) updated rlm_sql (sql): Released connection (8) (4) [sql] = ok (4) attr_filter.access_reject: EXPAND %{User-Name} (4) attr_filter.access_reject: --> dop (4) attr_filter.access_reject: Matched entry DEFAULT at line 11 (4) [attr_filter.access_reject] = updated (4) [eap] = noop (4) policy remove_reply_message_if_eap { (4) if (&reply:EAP-Message && &reply:Reply-Message) { (4) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (4) else { (4) [noop] = noop (4) } # else = noop (4) } # policy remove_reply_message_if_eap = noop (4) } # Post-Auth-Type REJECT = updated (4) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (5) Received Access-Request Id 39 from 127.0.0.1:52494 to 127.0.0.1:1812 length 84 (5) User-Name = "dop" (5) User-Password = "\010\n\r\177INCORRECT" (5) NAS-IP-Address = 192.168.23.31 (5) NAS-Identifier = "sshd" (5) NAS-Port = 92450 (5) NAS-Port-Type = Virtual (5) Service-Type = Authenticate-Only (5) Calling-Station-Id = "127.0.0.1" (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "dop", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: No EAP-Message, not doing EAP (5) [eap] = noop (5) [files] = noop (5) sql: EXPAND %{User-Name} (5) sql: --> dop (5) sql: SQL-User-Name set to 'dop' rlm_sql (sql): Reserved connection (10) (5) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (5) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dop' ORDER BY id (5) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'dop' ORDER BY id (5) sql: User found in radcheck table (5) sql: Conditional check items matched, merging assignment check items (5) sql: Cleartext-Password := "dop" (5) sql: Max-All-Session := 1464051644 (5) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (5) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dop' ORDER BY id (5) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'dop' ORDER BY id (5) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (5) sql: --> SELECT groupname FROM radusergroup WHERE username = 'dop' ORDER BY priority (5) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'dop' ORDER BY priority (5) sql: User not found in any groups rlm_sql (sql): Released connection (10) (5) [sql] = ok sqlcounter_expand: 'select UNIX_TIMESTAMP(sysdate()) - value from raduser_connection_time where username='%{User-Name}';' (5) expired_Xh: EXPAND %{User-Name} (5) expired_Xh: --> dop (5) expired_Xh: SQL-User-Name set to 'dop' rlm_sql (sql): Reserved connection (9) (5) expired_Xh: Executing select query: select UNIX_TIMESTAMP(sysdate()) - value from raduser_connection_time where username='dop'; rlm_sql (sql): Released connection (9) (5) expired_Xh: EXPAND %{sql:select UNIX_TIMESTAMP(sysdate()) - value from raduser_connection_time where username='%{User-Name}';} (5) expired_Xh: --> 1463966097 (5) expired_Xh: Allowing user, &control:Max-All-Session value (1464051644) is greater than counter value (1463966097) (5) expired_Xh: Setting &reply:Session-Timeout value to 85547 (5) [expired_Xh] = ok (5) [expiration] = noop (5) [logintime] = noop (5) [pap] = updated (5) } # authorize = updated (5) Found Auth-Type = PAP (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) Auth-Type PAP { (5) pap: Login attempt with password (5) pap: Comparing with "known good" Cleartext-Password (5) pap: ERROR: Cleartext password "dop" does not match "known good" password (5) pap: Passwords don't match (5) [pap] = reject (5) } # Auth-Type PAP = reject (5) Failed to authenticate the user (5) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! (5) Using Post-Auth-Type Reject (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) Post-Auth-Type REJECT { (5) sql: EXPAND .query (5) sql: --> .query (5) sql: Using query template 'query' rlm_sql (sql): Reserved connection (8) (5) sql: EXPAND %{User-Name} (5) sql: --> dop (5) sql: SQL-User-Name set to 'dop' (5) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (5) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'dop', '=3D08=5Cn=3D0D=3D7FINCORRECT', 'Access-Reject', '2016-05-24 02:14:57') (5) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'dop', '=3D08=5Cn=3D0D=3D7FINCORRECT', 'Access-Reject', '2016-05-24 02:14:57') (5) sql: SQL query returned: success (5) sql: 1 record(s) updated rlm_sql (sql): Released connection (8) (5) [sql] = ok (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> dop (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) [eap] = noop (5) policy remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) { (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else { (5) [noop] = noop (5) } # else = noop (5) } # policy remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1.000000 seconds (4) Sending delayed response (4) Sent Access-Reject Id 3 from 172.16.173.31:1812 to 172.16.173.31:52494 length 20 Waking up in 0.3 seconds. Waking up in 0.6 seconds. (5) Sending delayed response (5) Sent Access-Reject Id 39 from 127.0.0.1:1812 to 127.0.0.1:52494 length 20 Waking up in 3.0 seconds. (4) Cleaning up request packet ID 3 with timestamp +169 Waking up in 0.9 seconds. (5) Cleaning up request packet ID 39 with timestamp +170 Ready to process requests This email is confidential and may be subject to privilege. If you are not the intended recipient, please do not copy or disclose its content but contact the sender immediately upon receipt.

3 4

EAP-TLS support on D-Link DAP 2360
by Prosenjit Chatterjee 23 May '16

23 May '16

Hi, I was trying to set-up freeRADIUS server with EAP-TLS support. We have used Dlink DAP 2360 as a controller. I did the following. *In the wifi supplicant (Windows 7 Professional 64 bit) * 1. I have installed CA certificate and signed public and private key. 2. In adapter settings I have added a new SSID with selecting WEP2-Enterprise security. Ref:: https://documentation.meraki.com/zGeneral_Administration/Other_Topics/Freer… *Controller (Dlink DAP 2360)* *1. *Use wireless authentication mode as WPA-Enterprise. 2. WPA Mode: AUTO 3. radius server details. *RADIUS SERVER (FreeRADIUS Version 2.2.6)* *1. *In eap.conf "default_eap_type = tls" and certificate details with path. 2. In users file --- put user detaill. 3. In clients.conf file -- Add details of the controller (DAP). While trying to connect from wifi supplicant, we couldn't getting any packet in the RADIUS server(Runnig in debug mode). Please let me know if I have done anything wrong. Please help me -- Regards, Prosenjit

3 2

3GPP data in mysql radacct table
by liran kessel 23 May '16

23 May '16

Hi, I have activated a freeradius server to collect accounting info from a GGSN. The server is up and running and storing "GPRS-PDP-Context” data in to the radacct table. However there are some important 3GPP fields that aren’t written to the table. for example we want to store the 3GPP-IMSI-MCC-MNC and 3GPP-Location-Info data in the DB. Is it possible to configure the sql_log to write this info into the DB? and obviously this would require also to add the fields to the table. In addition is there a function to translate the 3GPP-Location-Info from hex to decimal data? Thanks in Advance. Liran

2 16

limiting login for particular purpose
by dump＠gmx.info 22 May '16

22 May '16

Dear list. I have the following scenario: Access to a WLAN is granted by freeradius using MySQL as backend. For administration purposes apache with php is running. Users are able to change their passwords via a simple web page. The authentication is performed via a php radius module and direct connection to the inner-tunnel. I want to add a small administration page and I want to use radius via php too for authentication of the admin. But I want to ensure that the administration account can only be used for login into the administration section and not for login into the WiFi-net. I don't want to use realms for this purpose. I thought using the Auth-Type directive in the radcheck or radgroupcheck table and forbidding EAP authentication could be a possibility. But I don't know how to arrange this. Does somebody have some hints or another possibility for achieving the described above? Jens

2 1

Re: TLS: assigning certificates to username
by Stefan Paetow 21 May '16

21 May '16

>I'm sure it is already documented, how to assign certificates to a >dedicated username. But I so far didn't find it. To my knowledge a TLS certificate will contain a username (a NAI) in TLS-Client-Cert-Common-Name. You can always check that if the TLS name does not match the username specified, you reject the request? :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc¹s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. >

7 15

Simultaneous EC/RSA Certificates
by Adam Bishop 20 May '16

20 May '16

NGINX has just added support for serving an ECDSA and an RSA certificate simultaneously, keyed off the cipher selected with ECDSA as the preferred option. Obviously there's significant differences between HTTP and RADIUS, but could this be implemented in FreeRADIUS for EAP/RadSec? Regards, Adam Bishop Systems Development Specialist gpg: 0x6609D460 t: +44 (0)1235 822 245 xmpp: adamb(a)jabber.dev.ja.net jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.

2 1