- Freeradius-Users - lists.freeradius.org

Fwd: ERROR: pap : Cleartext password does not match "known good" password
by orion doty 11 May '16

11 May '16

I don't understand what is happening to the password as I can see it correctly in the access request. I also would have expected to see the password on this line just before the error: (0) Auth-Type PAP { (0) pap : Login attempt with password [SHOULDN'T THE PASSWORD BE HERE??? IT IS NOT] Here is the full output (minus the IP addresses): Received Access-Request Id 8 from X:18852 to X:1812 length 107 User-Name = '20c9d081bcc3' User-Password = '20c9d081bcc3' NAS-Identifier = '58-B6-33-1A-7D-20' NAS-IP-Address = X Service-Type = Login-User NAS-Port-Type = Wireless-802.11 Message-Authenticator = 0xafa4b69194ca031fd61fa4c300b0198c (0) Received Access-Request packet from host X port 18852, id=8, length=107 (0) User-Name = '20c9d081bcc3' (0) User-Password = '20c9d081bcc3' (0) NAS-Identifier = '58-B6-33-1A-7D-20' (0) NAS-IP-Address = X (0) Service-Type = Login-User (0) NAS-Port-Type = Wireless-802.11 (0) Message-Authenticator = 0xafa4b69194ca031fd61fa4c300b0198c (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) sql : EXPAND %{User-Name} (0) sql : --> 20c9d081bcc3 (0) sql : SQL-User-Name set to '20c9d081bcc3' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '20c9d081bcc3' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '20c9d081bcc3' ORDER BY id' (0) sql : User found in radcheck table (0) sql : Check items matched (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '20c9d081bcc3' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = '20c9d081bcc3' ORDER BY id' (0) sql : User found in radreply table (0) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT groupname FROM radusergroup WHERE username = '20c9d081bcc3' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = '20c9d081bcc3' ORDER BY priority' (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) if (notfound) (0) if (notfound) -> FALSE (0) expiration : Account will expire at 'May 12 2016 13:00:00 UTC' (0) [expiration] = ok (0) if (userlock) (0) if (userlock) -> FALSE (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap : Login attempt with password *(0) ERROR: pap : Cleartext password does not match "known good" password* (0) pap : Passwords don't match (0) [pap] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> 20c9d081bcc3 (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response Waking up in 3.9 seconds. (0) Cleaning up request packet ID 8 with timestamp +6 of note: records in the mysql radcheck table related to the user | 54 | 20C9D081BCC3 | Expiration | := | 12 May 2016 13:00 | | 55 | 20C9D081BCC3 | Cleartext-Password | := | 20C9D081BCC3 | | 56 | 20C9D081BCC3 | Site-Id | := | LAB |

3 3

Issue with cuisql timing out on FR 3.12
by Alex Sharaz 11 May '16

11 May '16

Got a batch of FR server acting as our ORPS servers, two are FR 3.12 and two are 2.2.9. FR 3.12b config based upon 2.2.9 config as that;s been stable and hasn't changed for years. Fr 2.2.9 just works. With 3.12 however, since I brought them on line I've had problems with accessing a mysql CUI table. There's a scheduled backup of our mysql servers at 4:07 every morning. So I'm seeing Tue May 10 04:07:57 2016 : Error: (457308) Ignoring duplicate packet from client roaming1.ja.net port 61546 - ID: 179 due to unfinished request in component post-auth module cuisql and ..... Tue May 10 04:14:14 2016 : Error: rlm_sql (cuisql): No connections available and at max connection limit Tue May 10 04:14:14 2016 : Auth: (457515) Rejected in post-auth: [nagios] (from client systems0 port 0 cli 02-ED-79-28-F8-2A) So the above is happening because of the mysql backups and hence, every morning I get text messages saying both eduroam3 & eduroam4 are down .. which they're not. Guess I could skip the cuisql statements for the healthchecks, but that would be cheating ... Guess you're going to tell me to fix the mysql database access .... or is there something I can do to ignore cui stuff while the database is being backed up? A

4 8

freeRadius instance without Authentication for Accounting
by liran kessel 10 May '16

10 May '16

Hi, I am interested in setting up an instance of freeRadius that will receive cloned data from a Radius Server in a telco operator environment. The purpose of the server is for us to be able to collect usage data and load it into our Datastore for analysis and BI. can anyone assist me in how I would set up the server once installed to prevent the server from performing authentication ,and accepting all messages. In addition we need to load the usage data info received initially into csv files that can then be loaded in to both a relational database (Oracle) and a NoSql (MongoDB) environment? Lastly is there a way to configure filtering of what messages are saved and logged? filtering would be needed to be performed by certain fields in the message , Thanks in advance to everyones time and help. Liran Kessel

3 9

Fwd: Freeradius 2.2.9 eap/peap problem
by Mr Dini 10 May '16

10 May '16

Hi Alan! At the Git page of the project You told me (my nick is MrDini) to use the older freeradius (2.2.9) in my nas. I compiled it and I set up to a mysql database, but it sends Access-reject and something like this: [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: SSLv3 read client certificate A [peap] TLS_accept: Need to read more data: SSLv3 read client key exchange A [peap] TLS_accept: Need to read more data: SSLv3 read client key exchange A Here <http://pastebin.com/TTXY4Ngd> is the full output of the radiusd -X. Is it a compile error? Or what Do You think, What is that? Thanks! Dan

2 6

Authorizing using LDAP attributes
by Clayton Knorr 09 May '16

09 May '16

Running radius 2.1.12 and Openldap (openldap just for testing at this point) Ok, my situation in a nutshell. Trying to solve a problem. Need to provide EAP authentication for wifi to many devices. The freeradius server will be hitting an LDAP directory which is not in my control. I need to be able to have conditional logic to allow only certain users with certain attributes in the LDAP directory connect to certain RADIUS clients. I don't control the LDAP directory so using groups or OUs is not an option. So for example if the ldap user has an attribute Location that equals "A1234" I only want them to connect to one or a subset of Aps/controllers. I have gotten to the point where everything works for EAP, just the LDAP attributes mapping to RADIUS attributes is giving me fits. So I have a test ldap directory in which I have set users up with the attribute businessCategory set to A1000. I have added an entry to the main dictionary file: ATTRIBUTE My-Local-String 3000 string I have added a line to ldap.attrmap: checkItem My-Local-String businessCategory I have the following in my post-auth section in sites-enabled/default: if ( Called-Station-Id == "AC-85-75-46-55-91:Peep" && My-Local-String == "A1000" ) { noop } else { reject } Here are some logs from what happens when I try to log in: ... [ldap] looking for check items in directory... [ldap] businessCategory -> My-Local-String == "A1000" [ldap] userPassword -> Cleartext-Password == "password" [ldap] userPassword -> Password-With-Header == "password" [ldap] looking for reply items in directory... [ldap] user uuserton authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] return ..... # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++? if (Called-Station-Id == "AC-85-75-46-55-91:Peep" && My-Local-String == "A1000" ) ? Evaluating (Called-Station-Id == "AC-86-74-46-65-91:Peep" ) -> TRUE (Attribute My-Local-String was not found) ? Evaluating (My-Local-String == "A1000" ) -> FALSE ++? if (Called-Station-Id == "AC-86-74-46-65-91:Peep" && My-Local-String == "A1000" ) -> FALSE ++- entering else else {...} +++[reject] returns reject ++- else else returns reject Using Post-Auth-Type Reject The baffling part is where it says "Attribute My-Local-String was not found." Am I completely barking up the wrong tree here? Is ldap.attrmap meant to be used for something completely different? Thanks....

2 4

Re: EAP-TLS: Same cert, multiple servers and locations?
by Ted Hyde 07 May '16

07 May '16

>> Can I use a single common name (ie. myglobalsites) for the certificate set >> across my entire domain, and simply copy the entire set, (ca/pem/der/p12) >> from site to site? Does openssl and freeradius together use any hardware >> info (CPU serial, resolved ip addr, etc) that would cause a copied cert to >> crash? > Same server cert across multiple servers is fine. > > The client doesn't see anything about the server when it connects > to an SSID apart from the certificate, so it has no idea which > particular server the response came from. Unlike HTTPS etc there's > no existing network connection and therefore no DNS, so it can't > even check that the "hostname" it's connecting to is the same as > the cert name returned. > > Matthew > > Matthew - many thanks, exactly the answer I was looking for! Ted.

4 5

Re: EAP error
by Alan DeKok 07 May '16

07 May '16

> On May 7, 2016, at 9:52 AM, TOURE Amidou Florian <amidoufloriantoure(a)yahoo.fr> wrote: > > I have read the output and it is the only information that I have. The DEBUG OUTPUT contains the real error. You're just not reading it. The DEBUG OUTPUT YOU POSTED TO THE LIST says that you should go read the REST of the debug output. You clearly understand English, so you should be able to understand that message. Go read the REST of the debug output. Stop complaining. Alan DeKok.

1 0

EAP error
by TOURE Amidou Florian 07 May '16

07 May '16

Hi all ,Ecxuse me to disturb again but I have a problem when I want to authenticate a radius local user on a NAC solution which is Packetfence.I have installed a windows certificate on the client and on my server. But I got this specific error : (8) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1) Is someone know how to solve this? This my radius debug output Regards Amidou 8) eap_peap: This means you need to read the PREVIOUS messages in the debug output (8) eap_peap: to find out the reason why the user was rejected (8) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (8) eap_peap: what went wrong, and how to fix the problem (8) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (8) eap: Sending EAP Failure (code 4) ID 10 length 4 (8) eap: Failed in EAP select (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1) (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence (8) Post-Auth-Type REJECT { (8) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) { (8) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) -> FALSE (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> Administrateur (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) attr_filter.packetfence_post_auth: EXPAND %{User-Name} (8) attr_filter.packetfence_post_auth: --> Administrateur (8) attr_filter.packetfence_post_auth: Matched entry DEFAULT at line 10 (8) [attr_filter.packetfence_post_auth] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (8) linelog: --> messages.Access-Reject (8) linelog: EXPAND %t : [mac:%{Calling-Station-Id}] Rejected user: %{User-Name} (8) linelog: --> Sat May 7 17:23:12 2016 : [mac:00:40:d0:67:d0:b1] Rejected user: Administrateur (8) linelog: EXPAND /usr/local/pf/logs/radius.log (8) linelog: --> /usr/local/pf/logs/radius.log (8) [linelog] = ok (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 54 from 192.168.10.1:1812 to 192.168.1.5:1645 length 44 (8) EAP-Message = 0x040a0004 (8) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. (0) Cleaning up request packet ID 46 with timestamp +3 (1) Cleaning up request packet ID 47 with timestamp +3 (2) Cleaning up request packet ID 48 with timestamp +3 (3) Cleaning up request packet ID 49 with timestamp +3 (4) Cleaning up request packet ID 50 with timestamp +4 (5) Cleaning up request packet ID 51 with timestamp +4 (6) Cleaning up request packet ID 52 with timestamp +4 Waking up in 0.1 seconds. (7) Cleaning up request packet ID 53 with timestamp +4 (8) Cleaning up request packet ID 54 with timestamp +4 Ready to process requests Envoyé depuis Yahoo Mail pour Android

2 1

Radius problem
by TOURE Amidou Florian 06 May '16

06 May '16

Hi all when starting my radius server I got this error/etc/init.d/radiusd: line 23: /lib/lsb/init-functions: No such file or directory How can I solve the problem?Thanks

2 1

EAP-TLS: Same cert, multiple servers and locations?
by Ted Hyde 06 May '16

06 May '16

Greets - I've just recently returned back to the 'ol-RADIUS-game' and was pleasantly surprised to see how much easier it has become. I was able to accelerate through PAP/MD5/LEAP and for the past week have been dancing around full-on EAP-TLS for wireless supplicants, and am happy to be successful. I built our certs using OpenSSL, and have a variety of sup's to deploy, including ipads and windows devices. It dawned on me just now that some of the ipads would like to actually roam amongst different server setups - completely different physical networks, which could be accommodated with different SSIDs and certs, just load them all onto the ipads and go. That seems to be a little bit of a headache to scale up to larger numbers. We did try to anticipate this to some extent as our current wifi setup is a single SSID for all of our wifi networks, regardless of their physical location (spanning different cities even), but we were using WPA2/PSK, so it was pretty easy to administer. I would love to maintain that "walk-and-go" ability that a single SSID and PSK combo gave us. With the certificates, however, they get locked to a common name for installation, and I have traditionally always used the server name for that. For a lot of reasons, the server names are different site to site, so using the server names for common names in the certificates results in many certificates. ie: site01-s1, site02-s1, site03-s1....... Can I use a single common name (ie. myglobalsites) for the certificate set across my entire domain, and simply copy the entire set, (ca/pem/der/p12) from site to site? Does openssl and freeradius together use any hardware info (CPU serial, resolved ip addr, etc) that would cause a copied cert to crash? I am aware of "Cert builder apps" as well as traditional (verisign) SSL-certs that are built off-site that would have no idea of my actual hardware config, so my understanding is that this would work. However I have not used the standalone apps for building, only openssl on the host machine (and prior to this just for VPN security, which was pretty straightforward). I realize this may be a little more openssl-oriented than freeradius specifically, however I'm curious if anyone has experience with the process having a specific relationship or change to freeradius. Thanks in advance! Regards, Ted.

2 1