- Freeradius-Users - lists.freeradius.org

Ldap searches don't seem to honour connect_timeout
by Franks Andy (IT Technical Architecture Manager) 14 May '16

14 May '16

Hi all, FR 3.1.0 git#64aa7f9 I've been doing some testing around HA and servers looking at multiple ldap sources. For the most part everything is fine and dandy, but when the ldap search can't be made (e.g. one of the round robin dns entries goes off line), the connection timeout doesn't seem to behave. I've tried setting the connect_timeout ldap option, and also the NETWORK_TIMEOUT option in /etc/ldap/ldap.conf, but to no avail; connection timeouts take at least a minute or more. Using ldapsearch does seem to honour the latter perfectly. It's difficult to show the behaviour in a debug readout, since Are there any known issues with FR or the ldap library version that would cause this? Am I missing something!? Config: rlm_ldap (ldap_sath): Couldn't find configuration for accounting, will return NOOP for calls from this section rlm_ldap (ldap_sath): Couldn't find configuration for post-auth, will return NOOP for calls from this section rlm_ldap (ldap_sath): Initialising connection pool pool { start = 0 min = 4 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 20 connect_timeout = 3.000000 retry_delay = 1 spread = no FR output: Tue May 10 17:46:39 2016 : Info: rlm_ldap (ldap_sath): Opening additional connection (2), 1 of 10 pending slots used Tue May 10 17:46:39 2016 : Debug: rlm_ldap (ldap_sath): Connecting to ldaps://sath.nhs.uk:636 Tue May 10 17:46:39 2016 : Debug: rlm_ldap (ldap_sath): New libldap handle 0x2a2ea10 Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Waiting for bind result... Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Bind successful Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Reserved connection (2) Tue May 10 17:48:46 2016 : Debug: (3) Performing search in "dc=SATH,dc=nhs,dc=uk" with filter "sAMAccountName=989096b80618", scope "sub" Tue May 10 17:48:46 2016 : Debug: (3) Waiting for search result... Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Released connection (2) Tue May 10 17:48:46 2016 : Info: rlm_ldap (ldap_sath): Need 3 more connections to reach 3 spares Tue May 10 17:48:46 2016 : Info: rlm_ldap (ldap_sath): Opening additional connection (3), 1 of 9 pending slots used Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): Connecting to ldaps://sath.nhs.uk:636 Tue May 10 17:48:46 2016 : Debug: rlm_ldap (ldap_sath): New libldap handle 0x2aa2d00 Ldapsearch (it's set to 6 seconds here, but 3 in FR, I was seeing which took precendence. Not setting the ldap.conf, i.e. commenting out gives same result btw). time ldapsearch -x -H ldaps://10.128.176.1 -D "ldapquery" -b "OU=Phones,OU=MAC Addresses,OU=Trust owned,OU=Wired 802.1x MAC,OU=SATHNetwork,DC=SATH,DC=nhs,DC=uk" -s sub "(cn=*)" cn mail sn dn -w <hidden> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) real 0m6.009s user 0m0.000s sys 0m0.000s Thanks Andy

9 28

Templating sections :-)
by Stefan Paetow 13 May '16

13 May '16

Hi! A quick question for you guys... I'm trying to help out a site with redundant load balancing and went back into my archive to dig up Jonathan's thread the other day about this. In it Arran mentioned templating... can you expand on that? How do we set up templates? The page says" templates { target_stanza { directives ... } } How would you define the ldap configuration items? Something like this? templates { ldap { base_dn = '...' } ldap.update { control:NT-Password := '...' } : } Or am I misunderstanding the format? Any help is much appreciated :-) With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

4 4

Updates to the web sites
by Alan DeKok 13 May '16

13 May '16

We've put a lot of work over the past few months into web site updates. More will be coming in the future. The Wiki has a new theme / look: http://wiki.freeradius.org/Home It uses a newly generated logo (not one that's 10 years old). It has more consistent colours / fonts throughout. We've also used a public certificate for the packages: https://packages.networkradius.com/debian/ This should make it easier for people to use debian / ubuntu updates. The packages on the server are old (sorry). We're working on getting them updated. Alan DeKok.

1 0

EAP-SIM Error "Failed continuing EAP SIM (18) session. EAP sub-module failed"
by Li Zhaoxing 13 May '16

13 May '16

Hi, I am new here and here is my problem: I am using FreeRADIUS version 3.0.4 and I am working on configure the FreeRADIUS as a local RADIUS server in hotspot2.0 network. I am now in trouble with EAP-SIM authentication. I have configure the EAP-SIM in the file eap under /mods-enabled, and change the order of "eap" after "files" in authorize part in the file default under /sites-enabled. I have tested the EAP-SIM using radeapclient successfully. I tested EAP-TTLS with MSCHAPv2 authentication in my experimental network successfully which use an username and password. Everything seems going well until I tested the EAP-SIM in the hotspot2.0 network. I tested the EAP-SIM authentication using a real smartphone with a SIM card in which I specified an Ki by myself. The AP(the NAI of RADIUS) is a hostspot2.0-supported wireless access point running hostapd on it. and when I try to access the network through AP I got ERROR "Failed continuing EAP SIM (18) session. EAP sub-module failed". Here is my configurations and debug output In users file my account is: 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org EAP-Type := SIM, EAP-Sim-KI := 0x8baf473f2f8fd09487cccbd7097c6862, EAP-Sim-Algo-Version := 1 Here is the radiusd -X debug output when I require to access the network: (6) Received Access-Request Id 20 from 192.168.0.129:45017 to 192.168.0.200:1812 length 249 (6) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (6) NAS-IP-Address = 192.168.0.129 (6) Called-Station-Id = "00-14-D5-91-C0-FD:hs20" (6) NAS-Port-Type = Wireless-802.11 (6) NAS-Port = 1 (6) Calling-Station-Id = "68-3E-34-9B-32-C7" (6) Connect-Info = "CONNECT 54Mbps 802.11g" (6) Framed-MTU = 1400 (6) EAP-Message = 0x02330038013132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f7267 (6) HS20-AP-Version = 1 (6) Message-Authenticator = 0x440d0fe99fb6058bc76eb93698cf224d (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: Looking up realm "wlan.mnc093.mcc208.3gppnetwork.org" for User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (6) suffix: No such realm "wlan.mnc093.mcc208.3gppnetwork.org" (6) [suffix] = noop (6) files: users: Matched entry 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org at line 3 (6) [files] = ok (6) eap: Peer sent EAP Response (code 2) ID 51 length 56c (6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) authenticate { (6) eap: Peer sent packet with method EAP Identity (1) (6) eap: Calling submodule eap_sim to process data (6) eap_sim: Generated following triplets for round 0: (6) eap_sim: RAND : 0x872b74dc0e5582cdd217f486e088008e (6) eap_sim: SRES : 0x2d989648 (6) eap_sim: Kc : 0xff85b4f6889f9800 (6) eap_sim: Generated following triplets for round 1: (6) eap_sim: RAND : 0xf3fe491aaf74d6b894e94af1ada52ca6 (6) eap_sim: SRES : 0x056b09ed (6) eap_sim: Kc : 0xdbf228d55f6fcc00 (6) eap_sim: Generated following triplets for round 2: (6) eap_sim: RAND : 0xaf2c073cb54b1861ee429fe7a3e3f60b (6) eap_sim: SRES : 0xe1445dc1 (6) eap_sim: Kc : 0x65a776abc0f43c00 (6) eap: Sending EAP Request (code 1) ID 180 length 20 (6) eap: EAP session adding &reply:State = 0x14c723b2147331b1 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) Post-Auth-Type sub-section not found. Ignoring. (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) Sent Access-Challenge Id 20 from 192.168.0.200:1812 to 192.168.0.129:45017 length 0 (6) EAP-Message = 0x01b40014120a00000f0200020001000011010100 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x14c723b2147331b1a0c3c29e8d6db7ba (6) Finished request Waking up in 4.9 seconds. (7) Received Access-Request Id 21 from 192.168.0.129:45017 to 192.168.0.200:1812 length 299 (7) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (7) NAS-IP-Address = 192.168.0.129 (7) Called-Station-Id = "00-14-D5-91-C0-FD:hs20" (7) NAS-Port-Type = Wireless-802.11 (7) NAS-Port = 1 (7) Calling-Station-Id = "68-3E-34-9B-32-C7" (7) Connect-Info = "CONNECT 54Mbps 802.11g" (7) Framed-MTU = 1400 (7) EAP-Message = 0x02b40058120a000007050000ef994301bfa74fda8473e5ce391e2bc5100100010e0e00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 (7) State = 0x14c723b2147331b1a0c3c29e8d6db7ba (7) HS20-AP-Version = 1 (7) Message-Authenticator = 0xd9cb8b33b442579671f1b5ebe828ff41 (7) session-state: No cached attributes (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: Looking up realm "wlan.mnc093.mcc208.3gppnetwork.org" for User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (7) suffix: No such realm "wlan.mnc093.mcc208.3gppnetwork.org" (7) [suffix] = noop (7) files: users: Matched entry 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org at line 3 (7) [files] = ok (7) eap: Peer sent EAP Response (code 2) ID 180 length 88 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [expiration] = noop (7) [logintime] = noop (7) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (7) pap: WARNING: Authentication will fail unless a "known good" password is available (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = eap (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x14c723b2147331b1 (7) eap: Finished EAP session with state 0x14c723b2147331b1 (7) eap: Previous EAP request found for state 0x14c723b2147331b1, released from the list (7) eap: Peer sent packet with method EAP SIM (18) (7) eap: Calling submodule eap_sim to process data (7) eap_sim: EAP-SIM decoded packet (7) eap_sim: User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (7) eap_sim: NAS-IP-Address = 192.168.0.129 (7) eap_sim: Called-Station-Id = "00-14-D5-91-C0-FD:hs20" (7) eap_sim: NAS-Port-Type = Wireless-802.11 (7) eap_sim: NAS-Port = 1 (7) eap_sim: Calling-Station-Id = "68-3E-34-9B-32-C7" (7) eap_sim: Connect-Info = "CONNECT 54Mbps 802.11g" (7) eap_sim: Framed-MTU = 1400 (7) eap_sim: EAP-Message = 0x02b40058120a000007050000ef994301bfa74fda8473e5ce391e2bc5100100010e0e00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 (7) eap_sim: State = 0x14c723b2147331b1a0c3c29e8d6db7ba (7) eap_sim: HS20-AP-Version = 1 (7) eap_sim: Message-Authenticator = 0xd9cb8b33b442579671f1b5ebe828ff41 (7) eap_sim: Event-Timestamp = "May 13 2016 14:52:36 CST" (7) eap_sim: EAP-Type = SIM (7) eap_sim: EAP-Sim-Subtype = Start (7) eap_sim: EAP-Sim-NONCE_MT = 0x0000ef994301bfa74fda8473e5ce391e2bc5 (7) eap_sim: EAP-Sim-SELECTED_VERSION = 0x0001 (7) eap_sim: EAP-Sim-IDENTITY = 0x00333132303839333030303030303030303140776c616e2e6d6e633039332e6d63633230382e336770706e6574776f726b2e6f726700 (7) eap: Sending EAP Request (code 1) ID 181 length 80 (7) eap: EAP session adding &reply:State = 0x14c723b2157231b1 (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) Post-Auth-Type sub-section not found. Ignoring. (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) Sent Access-Challenge Id 21 from 192.168.0.200:1812 to 192.168.0.129:45017 length 0 (7) EAP-Message = 0x01b50050120b0000010d0000872b74dc0e5582cdd217f486e088008ef3fe491aaf74d6b894e94af1ada52ca6af2c073cb54b1861ee429fe7a3e3f60b0b0500006ccc60941e49dc60ae915c9edba32357 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x14c723b2157231b1a0c3c29e8d6db7ba (7) Finished request Waking up in 4.9 seconds. (8) Received Access-Request Id 22 from 192.168.0.129:45017 to 192.168.0.200:1812 length 223 (8) User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (8) NAS-IP-Address = 192.168.0.129 (8) Called-Station-Id = "00-14-D5-91-C0-FD:hs20" (8) NAS-Port-Type = Wireless-802.11 (8) NAS-Port = 1 (8) Calling-Station-Id = "68-3E-34-9B-32-C7" (8) Connect-Info = "CONNECT 54Mbps 802.11g" (8) Framed-MTU = 1400 (8) EAP-Message = 0x02b5000c120e000016010000 (8) State = 0x14c723b2157231b1a0c3c29e8d6db7ba (8) HS20-AP-Version = 1 (8) Message-Authenticator = 0x602535e3fc71889877b3e8ff37557d10 (8) session-state: No cached attributes (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "wlan.mnc093.mcc208.3gppnetwork.org" for User-Name = "1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org" (8) suffix: No such realm "wlan.mnc093.mcc208.3gppnetwork.org" (8) [suffix] = noop (8) files: users: Matched entry 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org at line 3 (8) [files] = ok (8) eap: Peer sent EAP Response (code 2) ID 181 length 12 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (8) pap: WARNING: Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x14c723b2157231b1 (8) eap: Finished EAP session with state 0x14c723b2157231b1 (8) eap: Previous EAP request found for state 0x14c723b2157231b1, released from the list (8) eap: Peer sent packet with method EAP SIM (18) (8) eap: Calling submodule eap_sim to process data (8) eap: ERROR: Failed continuing EAP SIM (18) session. EAP sub-module failed (8) eap: Sending EAP Failure (code 4) ID 181 length 4 (8) eap: Failed in EAP select (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> 1208930000000001(a)wlan.mnc093.mcc208.3gppnetwork.org (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 22 from 192.168.0.200:1812 to 192.168.0.129:45017 length 44 (8) EAP-Message = 0x04b50004 (8) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.6 seconds. (6) Cleaning up request packet ID 20 with timestamp +61 (7) Cleaning up request packet ID 21 with timestamp +61 Waking up in 0.3 seconds. (8) Cleaning up request packet ID 22 with timestamp +61 It seems that my radius server failed in calling EAP SIM module to process the MAC Challenge response. Anyone gets some ideas? Since the log gets only one line ERROR, I can't tell what's going wrong. Thank you for your attention and if any information is required to locate my error I am very pleased to offer my configuration and logs. Li Zhaoxing Beijing University of Posts and Telecommunications

2 1

free radius authentication query not working as expected
by Amardeep Singh 13 May '16

13 May '16

Hi, Greetings. Hope you all are doing great! I want to achieve zone migration using Nomadix with free Radius. I have made the desired settings on the Nomadix for zone migration. However when I switch between the SSIDs it does not redirect me to the AAA page. Although I get authenticated on Nomadix but the redirection is not working. I have added the authentication query on free radius as (/etc/raddb/sites-enabled/default):- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' and \ vlan_id='%{NAS-Port}'}" } if (&Tmp-String-0 != "") { update request { Tmp-String-1 := "%{sql: update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } else { reject } } I stopped the radius daemon - '/etc/init.d/radiusd stop' and then ran the radius in debug mode - radiusd -X. After enabling the zone migration I tried again switching the SSIDs with no portal page redirection. Now when I see the radius log file - (radius_log_switch.txt attached) both the times while switching SSIDs I got Auth: Login OK response. Then I reviewed the radius debug window (radius_debug_log.txt attached) on line 16 it seems that even the authentication query returns nothing still the update query ran and sets the username to null value. So I believe the condition “if (&Tmp-String-0 != "") { “ in the authentication query is not working as expected. And while switching the authentication query is making the groupname column empty. Please suggest. mysql> select * from radusergroup; +------------------------+----------------+----------+ | username | groupname | priority | +------------------------+----------------+----------+ | 78-9E-D0-31-29-7E | | 1 | +------------------------+----------------+----------+ raduserzone is a custom table :- mysql> select * from raduserzone ; +----+---------+-------------------+---------+-------------------+ | id | site_id | mac_address | vlan_id | radius_group_name | +----+---------+-------------------+---------+-------------------+ | 1 | 100051 | 78-9E-D0-31-29-7E | 99 | 78-9E-D0-31-29-7E | +----+---------+-------------------+---------+-------------------+ I am using custom radius table here to track the guest data, while switching , in the database. Afer switching the SSIDs I did not get any portal page (AAA , authentication URL) but I got authenticated on Nomadix and the only thing that changed on Nomadix is that the Port and Room changed from 93 to 77. Can you please share your thoughts here and guide me if I am going in the right direction? Thanks a lot in advance!! Amardeep Singh

2 3

request log line items
by Betibeteka Beranduetxea 12 May '16

12 May '16

Hi, first post here, We are using FreeRADIUS Version 2.1.12 and PEAP auth for wifi clients since a quite long time. It has ben satisfactory, but now we are trying to log requests and I fear I'm possibly wrong. Could you explain what the lines in the log means? i.e, I'm getting lines like this one: Thu May 12 11:56:39 2016 : Auth: Login OK: [xxx.xxx] (from client xxxx08 port 0 cli C0-38-96-26-37-B3) Which obviously means that user has sucessful logon and comes from NAS xxxx08. I guess the "port" part means the port at NAS, but this is less clear for me, since we use freeradius exclusively for wifi access and I'm getting some log lines with other ports. But the main problem for me is the "cli" part, I guessed this would be some MAC address, may be the user's device one, may be NAS one, maybe some NATing router's one, but none of these possibilities are yet confirmed. After logging from my own laptop, that logged "MAC addres" is not my laptop's one, nor NAS or router one so I'm now quite puzzled Any pointers to documentation would be greatly appreciated, I have been unable to get good results from any google search including mailing list, so I fear I'm not getting it right at all. TIA, Roman

2 2

Problem expanding "%{Calling-Station-Id}"
by Ana Gallardo Gómez 11 May '16

11 May '16

Hello all :) I'm using FreeRADIUS Version 3.0.8in a debian 8. I want to exec a sql query to return a value in Reply-Message, but I don't know why freeradius doesn't expand Calling-Station-Id every time... I use: Reply-Message := "%{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1}" My log: Wed May 4 11:48:37 2016 : Debug: (0) Received Access-Request Id 215 from 192.168.1.15:47353 to 192.168.1.3:1812 length 80 Wed May 4 11:48:37 2016 : Debug: (0) User-Name = 'nodowifi(a)nodo.unex.es' Wed May 4 11:48:37 2016 : Debug: (0) User-Password = 'password' Wed May 4 11:48:37 2016 : Debug: (0) Calling-Station-Id = 'f0:f6:1c:58:da:cd' Wed May 4 11:48:37 2016 : Debug: (0) session-state: No State attribute Wed May 4 11:48:37 2016 : Debug: (0) # Executing section authorize from file /etc/freeradius/sites-enabled/captive In Hints, freeradius doesn't expand Calling-Station-Id: DEFAULT Realm == "nodo.unex.es" Reply-Message = "%{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1}", Log: Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: Examining Reply-Message Wed May 4 11:48:37 2016 : Debug: %{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1} Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: xlat --> sqllocal Wed May 4 11:48:37 2016 : Debug: { Wed May 4 11:48:37 2016 : Debug: literal --> SELECT username FROM radpostauth WHERE client like 'PA Wed May 4 11:48:37 2016 : Debug: literal --> % Wed May 4 11:48:37 2016 : Debug: literal --> ' and reply='Access-Accept' and mac=' Wed May 4 11:48:37 2016 : Debug: attribute --> Calling-Station-Id Wed May 4 11:48:37 2016 : Debug: literal --> ' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1 Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: if { Wed May 4 11:48:37 2016 : Debug: attribute --> Stripped-User-Name Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: else { Wed May 4 11:48:37 2016 : Debug: if { Wed May 4 11:48:37 2016 : Debug: attribute --> User-Name Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: else { Wed May 4 11:48:37 2016 : Debug: literal --> DEFAULT Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: (0) preprocess: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed May 4 11:48:37 2016 : Debug: (0) preprocess: --> nodowifi(a)nodo.unex.es Wed May 4 11:48:37 2016 : Debug: (0) preprocess: SQL-User-Name set to ' nodowifi(a)nodo.unex.es' Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: FROM 1 TO 1 MAX 2 Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: Examining SQL-User-Name Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: APPENDING SQL-User-Name FROM 0 TO 1 Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: TO in 1 out 2 Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: to[0] = User-Name Wed May 4 11:48:37 2016 : Debug: (0) preprocess: ::: to[1] = SQL-User-Name Wed May 4 11:48:37 2016 : Debug: rlm_sql (sqllocal): Reserved connection (4) Wed May 4 11:48:37 2016 : Debug: /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: literal --> /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) preprocess: EXPAND /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) preprocess: --> /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) preprocess: Executing select query: SELECT username FROM radpostauth WHERE client like 'PA%' and reply='Access-Accept' and mac='' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1 Wed May 4 11:48:37 2016 : Debug: (0) preprocess: SQL query returned no results In users, freeradius expand Calling-Station-Id: nodowifi Cleartext-Password := "password" Reply-Message := "%{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1}" Wed May 4 11:48:37 2016 : Debug: (0) files: ::: Examining Reply-Message Wed May 4 11:48:37 2016 : Debug: %{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1} Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: xlat --> sqllocal Wed May 4 11:48:37 2016 : Debug: { Wed May 4 11:48:37 2016 : Debug: literal --> SELECT username FROM radpostauth WHERE client like 'PA Wed May 4 11:48:37 2016 : Debug: literal --> % Wed May 4 11:48:37 2016 : Debug: literal --> ' and reply='Access-Accept' and mac=' Wed May 4 11:48:37 2016 : Debug: attribute --> Calling-Station-Id Wed May 4 11:48:37 2016 : Debug: literal --> ' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1 Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: if { Wed May 4 11:48:37 2016 : Debug: attribute --> Stripped-User-Name Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: else { Wed May 4 11:48:37 2016 : Debug: if { Wed May 4 11:48:37 2016 : Debug: attribute --> User-Name Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: else { Wed May 4 11:48:37 2016 : Debug: literal --> DEFAULT Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: } Wed May 4 11:48:37 2016 : Debug: (0) files: EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed May 4 11:48:37 2016 : Debug: (0) files: --> nodowifi Wed May 4 11:48:37 2016 : Debug: (0) files: SQL-User-Name set to 'nodowifi' Wed May 4 11:48:37 2016 : Debug: (0) files: ::: FROM 1 TO 9 MAX 10 Wed May 4 11:48:37 2016 : Debug: (0) files: ::: Examining SQL-User-Name Wed May 4 11:48:37 2016 : Debug: (0) files: ::: APPENDING SQL-User-Name FROM 0 TO 9 Wed May 4 11:48:37 2016 : Debug: (0) files: ::: TO in 9 out 10 Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[0] = User-Name Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[1] = User-Password Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[2] = Calling-Station-Id Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[3] = Stripped-User-Name Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[4] = Realm Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[5] = Event-Timestamp Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[6] = NAS-IP-Address Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[7] = Reply-Message Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[8] = Tipo-Usuario Wed May 4 11:48:37 2016 : Debug: (0) files: ::: to[9] = SQL-User-Name Wed May 4 11:48:37 2016 : Debug: rlm_sql (sqllocal): Reserved connection (4) Wed May 4 11:48:37 2016 : Debug: /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: Parsed xlat tree: Wed May 4 11:48:37 2016 : Debug: literal --> /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) files: EXPAND /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) files: --> /var/log/freeradius/sqllog.sql Wed May 4 11:48:37 2016 : Debug: (0) files: Executing select query: SELECT username FROM radpostauth WHERE client like 'PA%' and reply='Access-Accept' and mac='f0:f6:1c:58:da:cd' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1 Wed May 4 11:48:37 2016 : Debug: rlm_sql (sqllocal): Released connection (4) Wed May 4 11:48:37 2016 : Debug: (0) files: EXPAND %{sqllocal:SELECT username FROM radpostauth WHERE client like 'PA%%' and reply='Access-Accept' and mac='%{Calling-Station-Id}' and authdate > (SELECT DATE_SUB(NOW(),INTERVAL 1 DAY)) order by authdate desc limit 1} Wed May 4 11:48:37 2016 : Debug: (0) files: --> 961621qb(a)nodo.unex.es Thank you very much in advance. :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

4 10

Unable to authenticate a user
by TOURE Amidou Florian 11 May '16

11 May '16

Hi all I'm using a NAC solution which is Packetefcence and I want to authenticate an Active Directory user but I got this 3 specifics errors,please I need help :(16) mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)'(16) mschap: External script failed(16) mschap: ERROR: External script says: Logon failure (0xc000006d)(16) mschap: ERROR: MS-CHAP2-Response is incorrect Ans this is my full radius debug file FreeRADIUS-Proxied-To = 127.0.0.1(21) User-Name = "Administrateur"(21) State = 0x42fe33fd42f7296034bd9bd88f2ca30f(21) Service-Type = Framed-User(21) Framed-MTU = 1500(21) Calling-Station-Id := "00:40:d0:67:d0:b1"(21) Cisco-AVPair = "audit-session-id=C0A801050000003200BCDD37"(21) NAS-Port-Type = Ethernet(21) NAS-Port = 50003(21) NAS-Port-Id = "FastEthernet0/3"(21) NAS-IP-Address = 192.168.1.5(21) Called-Station-Id := "ec:44:76:87:f0:83"(21) Event-Timestamp = "May 10 2016 16:57:28 CEST"(21) WARNING: Outer and inner identities are the same. User privacy is compromised.(21) server packetfence-tunnel {(21) session-state: No cached attributes(21) # Executing section authorize from file /usr/local/pf/raddb//sites-enabled/packetfence-tunnel(21) authorize {(21) policy filter_username {(21) if (&User-Name) {(21) if (&User-Name) -> TRUE(21) if (&User-Name) {(21) if (&User-Name =~ / /) {(21) if (&User-Name =~ / /) -> FALSE(21) if (&User-Name =~ /@[^@]*@/ ) {(21) if (&User-Name =~ /@[^@]*@/ ) -> FALSE(21) if (&User-Name =~ /\.\./ ) {(21) if (&User-Name =~ /\.\./ ) -> FALSE(21) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(21) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(21) if (&User-Name =~ /\.$/) {(21) if (&User-Name =~ /\.$/) -> FALSE(21) if (&User-Name =~ /(a)\./) {(21) if (&User-Name =~ /(a)\./) -> FALSE(21) } # if (&User-Name) = notfound(21) } # policy filter_username = notfound(21) [mschap] = noop(21) suffix: Checking for suffix after "@"(21) suffix: No '@' in User-Name = "Administrateur", skipping NULL due to config.(21) [suffix] = noop(21) ntdomain: Checking for prefix before "\"(21) ntdomain: No '\' in User-Name = "Administrateur", looking up realm NULL(21) ntdomain: No such realm "NULL"(21) [ntdomain] = noop(21) update control {(21) &Proxy-To-Realm := LOCAL(21) } # update control = noop(21) eap: Peer sent EAP Response (code 2) ID 9 length 73(21) eap: No EAP Start, assuming it's an on-going EAP conversation(21) [eap] = updated(21) policy rewrite_called_station_id {(21) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) {(21) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) -> TRUE(21) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) {(21) update request {(21) &Called-Station-Id !* ANY(21) EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}(21) --> ec:44:76:87:f0:83(21) &Called-Station-Id := ec:44:76:87:f0:83(21) } # update request = noop(21) if ("%{8}") {(21) EXPAND %{8}(21) --> (21) if ("%{8}") -> FALSE(21) elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) {(21) elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE(21) elsif (Aruba-Essid-Name) {(21) elsif (Aruba-Essid-Name) -> FALSE(21) elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) {(21) EXPAND %{Cisco-AVPair}(21) --> audit-session-id=C0A801050000003200BCDD37(21) elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE(21) [updated] = updated(21) } # if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) = updated(21) ... skipping else for request 21: Preceding "if" was taken(21) } # policy rewrite_called_station_id = updated(21) [pap] = noop(21) } # authorize = updated(21) Found Auth-Type = eap(21) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence-tunnel(21) authenticate {(21) eap: Expiring EAP session with state 0x42fe33fd42f72960(21) eap: Finished EAP session with state 0x42fe33fd42f72960(21) eap: Previous EAP request found for state 0x42fe33fd42f72960, released from the list(21) eap: Peer sent packet with method EAP MSCHAPv2 (26)(21) eap: Calling submodule eap_mschapv2 to process data(21) eap_mschapv2: # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence-tunnel(21) eap_mschapv2: Auth-Type MS-CHAP {(21) packetfence: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'Administrateur'(21) packetfence: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '192.168.1.5'(21) packetfence: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '50003'(21) packetfence: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User'(21) packetfence: $RAD_REQUEST{'Framed-MTU'} = &request:Framed-MTU -> '1500'(21) packetfence: $RAD_REQUEST{'State'} = &request:State -> '0x42fe33fd42f7296034bd9bd88f2ca30f'(21) packetfence: $RAD_REQUEST{'Called-Station-Id'} = &request:Called-Station-Id -> 'ec:44:76:87:f0:83'(21) packetfence: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '00:40:d0:67:d0:b1'(21) packetfence: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Ethernet'(21) packetfence: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'May 10 2016 16:57:28 CEST'(21) packetfence: $RAD_REQUEST{'EAP-Message'} = &request:EAP-Message -> '0x020900491a0209004431eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a1410041646d696e697374726174657572'(21) packetfence: $RAD_REQUEST{'NAS-Port-Id'} = &request:NAS-Port-Id -> 'FastEthernet0/3'(21) packetfence: $RAD_REQUEST{'Cisco-AVPair'} = &request:Cisco-AVPair -> 'audit-session-id=C0A801050000003200BCDD37'(21) packetfence: $RAD_REQUEST{'FreeRADIUS-Proxied-To'} = &request:FreeRADIUS-Proxied-To -> '127.0.0.1'(21) packetfence: $RAD_REQUEST{'MS-CHAP-Challenge'} = &request:MS-CHAP-Challenge -> '0xc3bbd40002f9ff77a7078554def335eb'(21) packetfence: $RAD_REQUEST{'MS-CHAP2-Response'} = &request:MS-CHAP2-Response -> '0x0964eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141'(21) packetfence: $RAD_REQUEST{'EAP-Type'} = &request:EAP-Type -> 'MSCHAPv2'(21) packetfence: $RAD_REQUEST{'MS-CHAP-User-Name'} = &request:MS-CHAP-User-Name -> 'Administrateur'(21) packetfence: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'eap'(21) packetfence: $RAD_CHECK{'Proxy-To-Realm'} = &control:Proxy-To-Realm -> 'LOCAL'(21) packetfence: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'eap'(21) packetfence: $RAD_CONFIG{'Proxy-To-Realm'} = &control:Proxy-To-Realm -> 'LOCAL'(21) packetfence: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Ethernet'(21) packetfence: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User'(21) packetfence: &request:Called-Station-Id = $RAD_REQUEST{'Called-Station-Id'} -> 'ec:44:76:87:f0:83'(21) packetfence: &request:State = $RAD_REQUEST{'State'} -> '0x42fe33fd42f7296034bd9bd88f2ca30f'(21) packetfence: &request:FreeRADIUS-Proxied-To = $RAD_REQUEST{'FreeRADIUS-Proxied-To'} -> '127.0.0.1'(21) packetfence: &request:EAP-Type = $RAD_REQUEST{'EAP-Type'} -> 'MSCHAPv2'(21) packetfence: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '192.168.1.5'(21) packetfence: &request:NAS-Port-Id = $RAD_REQUEST{'NAS-Port-Id'} -> 'FastEthernet0/3'(21) packetfence: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '00:40:d0:67:d0:b1'(21) packetfence: &request:MS-CHAP-User-Name = $RAD_REQUEST{'MS-CHAP-User-Name'} -> 'Administrateur'(21) packetfence: &request:MS-CHAP-Challenge = $RAD_REQUEST{'MS-CHAP-Challenge'} -> '0xc3bbd40002f9ff77a7078554def335eb'(21) packetfence: &request:Cisco-AVPair = $RAD_REQUEST{'Cisco-AVPair'} -> 'audit-session-id=C0A801050000003200BCDD37'(21) packetfence: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'Administrateur'(21) packetfence: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'May 10 2016 16:57:28 CEST'(21) packetfence: &request:EAP-Message = $RAD_REQUEST{'EAP-Message'} -> '0x020900491a0209004431eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a1410041646d696e697374726174657572'(21) packetfence: &request:MS-CHAP2-Response = $RAD_REQUEST{'MS-CHAP2-Response'} -> '0x0964eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141'(21) packetfence: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '50003'(21) packetfence: &request:Framed-MTU = $RAD_REQUEST{'Framed-MTU'} -> '1500'(21) packetfence: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'eap'(21) packetfence: &control:Proxy-To-Realm = $RAD_CHECK{'Proxy-To-Realm'} -> 'LOCAL'(21) [packetfence] = noop(21) if (PacketFence-Domain) {(21) if (PacketFence-Domain) -> FALSE(21) else {(21) mschap: Creating challenge hash with username: Administrateur(21) mschap: Client is using MS-CHAPv2(21) mschap: Executing: /usr/local/pf/bin/ntlm_auth_wrapper -- --request-nt-key --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}:(21) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}}(21) mschap: --> --username=Administrateur(21) mschap: Creating challenge hash with username: Administrateur(21) mschap: EXPAND --challenge=%{mschap:Challenge:-00}(21) mschap: --> --challenge=c330d9e5a3d1ecdf(21) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}(21) mschap: --> --nt-response=fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141(21) mschap: ERROR: Abnormal child exit: No error(21) mschap: External script failed(21) mschap: ERROR: External script says: Logon failure (0xc000006d)(21) mschap: ERROR: MS-CHAP2-Response is incorrect(21) [mschap] = reject(21) } # else = reject(21) } # Auth-Type MS-CHAP = reject(21) eap: Sending EAP Failure (code 4) ID 9 length 4(21) eap: Freeing handler(21) [eap] = reject(21) } # authenticate = reject(21) Failed to authenticate the user(21) Login incorrect (mschap: Abnormal child exit: No error): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1 via TLS tunnel)(21) Using Post-Auth-Type Reject(21) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence-tunnel(21) Post-Auth-Type REJECT {(21) policy request-timing {(21) if (control:PacketFence-Request-Time != 0) {(21) ERROR: Failed retrieving values required to evaluate condition(21) } # policy request-timing = noop(21) sql_reject: EXPAND type.reject.query(21) sql_reject: --> type.reject.query(21) sql_reject: Using query template 'query'rlm_sql (sql): Reserved connection (6)(21) sql_reject: EXPAND %{User-Name}(21) sql_reject: --> Administrateur(21) sql_reject: SQL-User-Name set to 'Administrateur'(21) sql_reject: EXPAND INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '%{request:Calling-Station-Id}', '%{request:Framed-IP-Address}', '%{%{control:PacketFence-Computer-Name}:-N/A}', '%{request:User-Name}', '%{request:Stripped-User-Name}', '%{request:Realm}', 'Radius-Access-Request', '%{%{control:PacketFence-Switch-Id}:-N/A}', '%{%{control:PacketFence-Switch-Mac}:-N/A}', '%{%{control:PacketFence-Switch-Ip-Address}:-N/A}', '%{Packet-Src-IP-Address}', '%{request:Called-Station-Id}', '%{request:Calling-Station-Id}', '%{request:NAS-Port-Type}', '%{request:Called-Station-SSID}', '%{request:NAS-Port-Id}', '%{%{control:PacketFence-IfIndex}:-N/A}', '%{request:NAS-Port}', '%{%{control:PacketFence-Connection-Type}:-N/A}', '%{request:NAS-IP-Address}', '%{request:NAS-Identifier}', 'Reject', '%{request:Module-Failure-Message}', '%{control:Auth-Type}', '%{request:EAP-Type}', '%{%{control:PacketFence-Role}:-N/A}', '%{%{control:PacketFence-Status}:-N/A}', '%{%{control:PacketFence-Profile}:-N/A}', '%{%{control:PacketFence-Source}:-N/A}', '%{%{control:PacketFence-AutoReg}:-N/A}', '%{%{control:PacketFence-IsPhone}:-N/A}', '%{request:PacketFence-Domain}', '', '%{pairs:&request:[*]}','%{pairs:&reply:[*]}', '%{%{control:PacketFence-Request-Time}:-N/A}')(21) sql_reject: --> INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '00:40:d0:67:d0:b1', '', 'N/A', 'Administrateur', '', '', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '192.168.1.5', 'ec:44:76:87:f0:83', '00:40:d0:67:d0:b1', 'Ethernet', '', 'FastEthernet0/3', 'N/A', '50003', 'N/A', '192.168.1.5', '', 'Reject', 'mschap: Abnormal child exit: No error', 'eap', 'MSCHAPv2', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', '', '', 'NAS-Port-Type =3D Ethernet=2C Service-Type =3D Framed-User=2C Called-Station-Id =3D =22ec:44:76:87:f0:83=22=2C State =3D 0x42fe33fd42f7296034bd9bd88f2ca30f=2C FreeRADIUS-Proxied-To =3D 127.0.0.1=2C EAP-Type =3D MSCHAPv2=2C NAS-IP-Address =3D 192.168.1.5=2C NAS-Port-Id =3D =22FastEthernet0/3=22=2C Calling-Station-Id =3D =2200:40:d0:67:d0:b1=22=2C MS-CHAP-User-Name =3D =22Administrateur=22=2C MS-CHAP-Challenge =3D 0xc3bbd40002f9ff77a7078554def335eb=2C Cisco-AVPair =3D =22audit-session-id=3DC0A801050000003200BCDD37=22=2C User-Name =3D =22Administrateur=22=2C Event-Timestamp =3D =22May 10 2016 16:57:28 CEST=22=2C EAP-Message =3D 0x020900491a0209004431eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a1410041646d696e697374726174657572=2C MS-CHAP2-Response =3D 0x0964eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141=2C NAS-Port =3D 50003=2C Framed-MTU =3D 1500=2C Module-Failure-Message =3D =22mschap: Abnormal child exit: No error=22=2C Module-Failure-Message =3D =22mschap: External script says: Logon failure =280xc000006d=29=22=2C Module-Failure-Message =3D =22mschap: MS-CHAP2-Response is incorrect=22=2C Module-Failure-Message =3D =22Failed retrieving values required to evaluate condition=22=2C SQL-User-Name =3D =22Administrateur=22','MS-CHAP-Error =3D =22=5CtE=3D691 R=3D0 C=3D45ea37e23aa1e0bb6635a42ede246a62 V=3D3 M=3DAuthentication failed=22=2C EAP-Message =3D 0x04090004=2C Message-Authenticator =3D 0x00000000000000000000000000000000', 'N/A')(21) sql_reject: Executing query: INSERT INTO radius_audit_log ( mac, ip, computer_name, user_name, stripped_user_name, realm, event_type, switch_id, switch_mac, switch_ip_address, radius_source_ip_address, called_station_id, calling_station_id, nas_port_type, ssid, nas_port_id, ifindex, nas_port, connection_type, nas_ip_address, nas_identifier, auth_status, reason, auth_type, eap_type, role, node_status, profile, source, auto_reg, is_phone, pf_domain, uuid, radius_request, radius_reply, request_time) VALUES ( '00:40:d0:67:d0:b1', '', 'N/A', 'Administrateur', '', '', 'Radius-Access-Request', 'N/A', 'N/A', 'N/A', '192.168.1.5', 'ec:44:76:87:f0:83', '00:40:d0:67:d0:b1', 'Ethernet', '', 'FastEthernet0/3', 'N/A', '50003', 'N/A', '192.168.1.5', '', 'Reject', 'mschap: Abnormal child exit: No error', 'eap', 'MSCHAPv2', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', 'N/A', '', '', 'NAS-Port-Type =3D Ethernet=2C Service-Type =3D Framed-User=2C Called-Station-Id =3D =22ec:44:76:87:f0:83=22=2C State =3D 0x42fe33fd42f7296034bd9bd88f2ca30f=2C FreeRADIUS-Proxied-To =3D 127.0.0.1=2C EAP-Type =3D MSCHAPv2=2C NAS-IP-Address =3D 192.168.1.5=2C NAS-Port-Id =3D =22FastEthernet0/3=22=2C Calling-Station-Id =3D =2200:40:d0:67:d0:b1=22=2C MS-CHAP-User-Name =3D =22Administrateur=22=2C MS-CHAP-Challenge =3D 0xc3bbd40002f9ff77a7078554def335eb=2C Cisco-AVPair =3D =22audit-session-id=3DC0A801050000003200BCDD37=22=2C User-Name =3D =22Administrateur=22=2C Event-Timestamp =3D =22May 10 2016 16:57:28 CEST=22=2C EAP-Message =3D 0x020900491a0209004431eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a1410041646d696e697374726174657572=2C MS-CHAP2-Response =3D 0x0964eb4ca34aee1ad514b736c229c9e0798a0000000000000000fa1cb5436a574339be984a38670c37bd8554f4e5afe4a141=2C NAS-Port =3D 50003=2C Framed-MTU =3D 1500=2C Module-Failure-Message =3D =22mschap: Abnormal child exit: No error=22=2C Module-Failure-Message =3D =22mschap: External script says: Logon failure =280xc000006d=29=22=2C Module-Failure-Message =3D =22mschap: MS-CHAP2-Response is incorrect=22=2C Module-Failure-Message =3D =22Failed retrieving values required to evaluate condition=22=2C SQL-User-Name =3D =22Administrateur=22','MS-CHAP-Error =3D =22=5CtE=3D691 R=3D0 C=3D45ea37e23aa1e0bb6635a42ede246a62 V=3D3 M=3DAuthentication failed=22=2C EAP-Message =3D 0x04090004=2C Message-Authenticator =3D 0x00000000000000000000000000000000', 'N/A')(21) sql_reject: SQL query returned: success(21) sql_reject: 1 record(s) updatedrlm_sql (sql): Released connection (6)rlm_sql (sql): Need 1 more connections to reach 10 sparesrlm_sql (sql): Opening additional connection (8), 1 of 62 pending slots usedrlm_sql_mysql: Starting connect to MySQL serverrlm_sql_mysql: Connected to database 'pf' on Localhost via UNIX socket, server version 5.1.73, protocol version 10(21) [sql_reject] = ok(21) attr_filter.access_reject: EXPAND %{User-Name}(21) attr_filter.access_reject: --> Administrateur(21) attr_filter.access_reject: Matched entry DEFAULT at line 11(21) [attr_filter.access_reject] = updated(21) update outer.session-state {(21) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: Abnormal child exit: No error'(21) } # update outer.session-state = noop(21) } # Post-Auth-Type REJECT = updated(21) } # server packetfence-tunnel(21) Virtual server sending reply(21) MS-CHAP-Error = "\tE=691 R=0 C=45ea37e23aa1e0bb6635a42ede246a62 V=3 M=Authentication failed"(21) EAP-Message = 0x04090004(21) Message-Authenticator = 0x00000000000000000000000000000000(21) eap_peap: Got tunneled reply code 3(21) eap_peap: MS-CHAP-Error = "\tE=691 R=0 C=45ea37e23aa1e0bb6635a42ede246a62 V=3 M=Authentication failed"(21) eap_peap: EAP-Message = 0x04090004(21) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000(21) eap_peap: Got tunneled reply RADIUS code 3(21) eap_peap: MS-CHAP-Error = "\tE=691 R=0 C=45ea37e23aa1e0bb6635a42ede246a62 V=3 M=Authentication failed"(21) eap_peap: EAP-Message = 0x04090004(21) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000(21) eap_peap: Tunneled authentication was rejected(21) eap_peap: FAILURE(21) eap: Sending EAP Request (code 1) ID 10 length 43(21) eap: EAP session adding &reply:State = 0x951d7ff092176631(21) [eap] = handled(21) } # authenticate = handled(21) Using Post-Auth-Type Challenge(21) Post-Auth-Type sub-section not found. Ignoring.(21) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence(21) session-state: Saving cached attributes(21) Module-Failure-Message := "mschap: Abnormal child exit: No error"(21) Sent Access-Challenge Id 232 from 192.168.10.1:1812 to 192.168.1.5:1645 length 0(21) EAP-Message = 0x010a002b190017030100201ed3bed6b95fc062e4214f5873237f64dd93b7c3d63baf0b3d3f4768bb2e1c53(21) Message-Authenticator = 0x00000000000000000000000000000000(21) State = 0x951d7ff092176631b7716540afc4a8a1(21) Finished requestWaking up in 4.8 seconds.(22) Received Access-Request Id 233 from 192.168.1.5:1645 to 192.168.10.1:1812 length 251(22) User-Name = "Administrateur"(22) Service-Type = Framed-User(22) Framed-MTU = 1500(22) Called-Station-Id = "EC-44-76-87-F0-83"(22) Calling-Station-Id = "00-40-D0-67-D0-B1"(22) EAP-Message = 0x020a002b190017030100208dd4569e8656380cf464c8a46b0823720880d6c90e1207ec982375a8254bc4ff(22) Message-Authenticator = 0xaae91e23d504d18abb24df64cae111ce(22) Cisco-AVPair = "audit-session-id=C0A801050000003200BCDD37"(22) NAS-Port-Type = Ethernet(22) NAS-Port = 50003(22) NAS-Port-Id = "FastEthernet0/3"(22) State = 0x951d7ff092176631b7716540afc4a8a1(22) NAS-IP-Address = 192.168.1.5(22) Restoring &session-state(22) &session-state:Module-Failure-Message := "mschap: Abnormal child exit: No error"(22) # Executing section authorize from file /usr/local/pf/raddb//sites-enabled/packetfence(22) authorize {(22) update {(22) EXPAND %{Packet-Src-IP-Address}(22) --> 192.168.1.5(22) &request:FreeRADIUS-Client-IP-Address := 192.168.1.5(22) &control:PacketFence-RPC-Server = 127.0.0.1(22) &control:PacketFence-RPC-Port = 7070(22) &control:PacketFence-RPC-User = (22) &control:PacketFence-RPC-Pass = (22) &control:PacketFence-RPC-Proto = http(22) EXPAND %l(22) --> 1462892248(22) &control:Tmp-Integer-0 := 1462892248(22) &control:PacketFence-Request-Time := 0(22) } # update = noop(22) policy rewrite_calling_station_id {(22) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {(22) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE(22) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {(22) update request {(22) EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}(22) --> 00:40:d0:67:d0:b1(22) &Calling-Station-Id := 00:40:d0:67:d0:b1(22) } # update request = noop(22) [updated] = updated(22) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated(22) ... skipping else for request 22: Preceding "if" was taken(22) } # policy rewrite_calling_station_id = updated(22) policy rewrite_called_station_id {(22) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) {(22) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) -> TRUE(22) if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) {(22) update request {(22) &Called-Station-Id !* ANY(22) EXPAND %{tolower:%{1}:%{2}:%{3}:%{4}:%{5}:%{6}}(22) --> ec:44:76:87:f0:83(22) &Called-Station-Id := ec:44:76:87:f0:83(22) } # update request = noop(22) if ("%{8}") {(22) EXPAND %{8}(22) --> (22) if ("%{8}") -> FALSE(22) elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) {(22) elsif ( (Colubris-AVPair) && "%{Colubris-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE(22) elsif (Aruba-Essid-Name) {(22) elsif (Aruba-Essid-Name) -> FALSE(22) elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) {(22) EXPAND %{Cisco-AVPair}(22) --> audit-session-id=C0A801050000003200BCDD37(22) elsif ( (Cisco-AVPair) && "%{Cisco-AVPair}" =~ /^ssid=(.*)$/i) -> FALSE(22) [updated] = updated(22) } # if ((&Called-Station-Id) && (&Called-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})(:(.+))?$/i)) = updated(22) ... skipping else for request 22: Preceding "if" was taken(22) } # policy rewrite_called_station_id = updated(22) policy filter_username {(22) if (&User-Name) {(22) if (&User-Name) -> TRUE(22) if (&User-Name) {(22) if (&User-Name =~ / /) {(22) if (&User-Name =~ / /) -> FALSE(22) if (&User-Name =~ /@[^@]*@/ ) {(22) if (&User-Name =~ /@[^@]*@/ ) -> FALSE(22) if (&User-Name =~ /\.\./ ) {(22) if (&User-Name =~ /\.\./ ) -> FALSE(22) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(22) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(22) if (&User-Name =~ /\.$/) {(22) if (&User-Name =~ /\.$/) -> FALSE(22) if (&User-Name =~ /(a)\./) {(22) if (&User-Name =~ /(a)\./) -> FALSE(22) } # if (&User-Name) = updated(22) } # policy filter_username = updated(22) policy filter_password {(22) if (&User-Password && (&User-Password != "%{string:User-Password}")) {(22) if (&User-Password && (&User-Password != "%{string:User-Password}")) -> FALSE(22) } # policy filter_password = updated(22) [preprocess] = ok(22) suffix: Checking for suffix after "@"(22) suffix: No '@' in User-Name = "Administrateur", skipping NULL due to config.(22) [suffix] = noop(22) ntdomain: Checking for prefix before "\"(22) ntdomain: No '\' in User-Name = "Administrateur", looking up realm NULL(22) ntdomain: No such realm "NULL"(22) [ntdomain] = noop(22) eap: Peer sent EAP Response (code 2) ID 10 length 43(22) eap: Continuing tunnel setup(22) [eap] = ok(22) } # authorize = ok(22) Found Auth-Type = eap(22) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence(22) authenticate {(22) eap: Expiring EAP session with state 0x951d7ff092176631(22) eap: Finished EAP session with state 0x951d7ff092176631(22) eap: Previous EAP request found for state 0x951d7ff092176631, released from the list(22) eap: Peer sent packet with method EAP PEAP (25)(22) eap: Calling submodule eap_peap to process data(22) eap_peap: Continuing EAP-TLS(22) eap_peap: [eaptls verify] = ok(22) eap_peap: Done initial handshake(22) eap_peap: [eaptls process] = ok(22) eap_peap: Session established. Decoding tunneled attributes(22) eap_peap: PEAP state send tlv failure(22) eap_peap: Received EAP-TLV response(22) eap_peap: The users session was previously rejected: returning reject (again.)(22) eap_peap: This means you need to read the PREVIOUS messages in the debug output(22) eap_peap: to find out the reason why the user was rejected(22) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you(22) eap_peap: what went wrong, and how to fix the problem(22) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed(22) eap: Sending EAP Failure (code 4) ID 10 length 4(22) eap: Failed in EAP select(22) [eap] = invalid(22) } # authenticate = invalid(22) Failed to authenticate the user(22) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [Administrateur] (from client 192.168.1.5 port 50003 cli 00:40:d0:67:d0:b1)(22) Using Post-Auth-Type Reject(22) # Executing group from file /usr/local/pf/raddb//sites-enabled/packetfence(22) Post-Auth-Type REJECT {(22) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) {(22) if (! EAP-Type || (EAP-Type != TTLS && EAP-Type != PEAP) ) -> FALSE(22) attr_filter.access_reject: EXPAND %{User-Name}(22) attr_filter.access_reject: --> Administrateur(22) attr_filter.access_reject: Matched entry DEFAULT at line 11(22) [attr_filter.access_reject] = updated(22) attr_filter.packetfence_post_auth: EXPAND %{User-Name}(22) attr_filter.packetfence_post_auth: --> Administrateur(22) attr_filter.packetfence_post_auth: Matched entry DEFAULT at line 10(22) [attr_filter.packetfence_post_auth] = updated(22) [eap] = noop(22) policy remove_reply_message_if_eap {(22) if (&reply:EAP-Message && &reply:Reply-Message) {(22) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE(22) else {(22) [noop] = noop(22) } # else = noop(22) } # policy remove_reply_message_if_eap = noop(22) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default}(22) linelog: --> messages.Access-Reject(22) linelog: EXPAND %t : [mac:%{Calling-Station-Id}] Rejected user: %{User-Name}(22) linelog: --> Tue May 10 16:57:28 2016 : [mac:00:40:d0:67:d0:b1] Rejected user: Administrateur(22) linelog: EXPAND /usr/local/pf/logs/radius.log(22) linelog: --> /usr/local/pf/logs/radius.log(22) [linelog] = ok(22) } # Post-Auth-Type REJECT = updated(22) Delaying response for 1.000000 secondsWaking up in 0.3 seconds.Waking up in 0.6 seconds.(22) Sending delayed response(22) Sent Access-Reject Id 233 from 192.168.10.1:1812 to 192.168.1.5:1645 length 44(22) EAP-Message = 0x040a0004(22) Message-Authenticator = 0x00000000000000000000000000000000Waking up in 3.7 seconds.(14) Cleaning up request packet ID 225 with timestamp +160(15) Cleaning up request packet ID 226 with timestamp +160(16) Cleaning up request packet ID 227 with timestamp +160(17) Cleaning up request packet ID 228 with timestamp +160(18) Cleaning up request packet ID 229 with timestamp +160(19) Cleaning up request packet ID 230 with timestamp +160(20) Cleaning up request packet ID 231 with timestamp +160Waking up in 0.1 seconds.(21) Cleaning up request packet ID 232 with timestamp +160(22) Cleaning up request packet ID 233 with timestamp +160Ready to process requests

2 1

Parse error for non-hex characters in users file
by Derek Wuelfrath 11 May '16

11 May '16

Hello list, Working with a FreeRADIUS 2.2.8 (I know, it’s “old” but for the moment, upgrade is not really a possible way) I am getting the following error when trying to start radiusd. Error: Parse error (check) for entry my_awesome_username: Non-hex characters at gX The users file specified by the error message does contains some “hex characters” as the “hashed password” for a user entry. ie: “my_awesome_username” MD5-Password := “0X………" It looks to me like FreeRADIUS is trying to interpret the password as an hexadecimal value and then breaks… I found out that there may be a fix for this exact “issue” introduced in FreeRADIUS 3.0.6 (https://lists.freeradius.org/pipermail/freeradius-users/2015-February/07588… <https://lists.freeradius.org/pipermail/freeradius-users/2015-February/07588…>) Handle NT-Hash in rlm_pap. This allows passwords to have backslashes in them. I was wondering if someone could point me to the patch file / the fix itself so that I can evaluate if it is something possible to port that fix onto my 2.2.8 version. Thanks! Cheers! -dw. — Derek Wuelfrath dwuelfrath(a)inverse.ca :: +1.514.447.4918 (x110) :: +1.866.353.6153 (x110) Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

3 3

Fwd: ERROR: pap : Cleartext password does not match "known good" password
by orion doty 11 May '16

11 May '16

I don't understand what is happening to the password as I can see it correctly in the access request. I also would have expected to see the password on this line just before the error: (0) Auth-Type PAP { (0) pap : Login attempt with password [SHOULDN'T THE PASSWORD BE HERE??? IT IS NOT] Here is the full output (minus the IP addresses): Received Access-Request Id 8 from X:18852 to X:1812 length 107 User-Name = '20c9d081bcc3' User-Password = '20c9d081bcc3' NAS-Identifier = '58-B6-33-1A-7D-20' NAS-IP-Address = X Service-Type = Login-User NAS-Port-Type = Wireless-802.11 Message-Authenticator = 0xafa4b69194ca031fd61fa4c300b0198c (0) Received Access-Request packet from host X port 18852, id=8, length=107 (0) User-Name = '20c9d081bcc3' (0) User-Password = '20c9d081bcc3' (0) NAS-Identifier = '58-B6-33-1A-7D-20' (0) NAS-IP-Address = X (0) Service-Type = Login-User (0) NAS-Port-Type = Wireless-802.11 (0) Message-Authenticator = 0xafa4b69194ca031fd61fa4c300b0198c (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) sql : EXPAND %{User-Name} (0) sql : --> 20c9d081bcc3 (0) sql : SQL-User-Name set to '20c9d081bcc3' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '20c9d081bcc3' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = '20c9d081bcc3' ORDER BY id' (0) sql : User found in radcheck table (0) sql : Check items matched (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = '20c9d081bcc3' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = '20c9d081bcc3' ORDER BY id' (0) sql : User found in radreply table (0) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT groupname FROM radusergroup WHERE username = '20c9d081bcc3' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = '20c9d081bcc3' ORDER BY priority' (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) if (notfound) (0) if (notfound) -> FALSE (0) expiration : Account will expire at 'May 12 2016 13:00:00 UTC' (0) [expiration] = ok (0) if (userlock) (0) if (userlock) -> FALSE (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap : Login attempt with password *(0) ERROR: pap : Cleartext password does not match "known good" password* (0) pap : Passwords don't match (0) [pap] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> 20c9d081bcc3 (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response Waking up in 3.9 seconds. (0) Cleaning up request packet ID 8 with timestamp +6 of note: records in the mysql radcheck table related to the user | 54 | 20C9D081BCC3 | Expiration | := | 12 May 2016 13:00 | | 55 | 20C9D081BCC3 | Cleartext-Password | := | 20C9D081BCC3 | | 56 | 20C9D081BCC3 | Site-Id | := | LAB |

3 3