- Freeradius-Users - lists.freeradius.org

Can't work out HP/Huawei reply attributes
by Joel Bergmark 10 Mar '16

10 Mar '16

Hello all, I've got quite stuck regarding reply-attributes to get privileged when logging on to a HP/Comware firmware switch (HP, Huawei, 3com etc). I run Daloradius as frontend. Basically what I want is to have something similar to the "Cisco AVPair shell:priv-lvl=15". So the radius server is working and I can login to the HP in question, I have googled this for hours and tried much but to no resolution, examples is like: http://certifiedgeek.weebly.com/blog/ssh-radius-authentication-with-hp-comw… Also tried a number of variants including Cisco AVPair, most of time tried variants of this: NAS-Prompt-User Huawei-Exec-Privilege = "3" rlm_sql: Failed to create the pair: Unknown attribute "NAS-Prompt-User" requires a hex string, not "Huawei-Exec-Privilege = "3"" 3Com-User-Access-Level HP-Privelege-Level = 3 rlm_sql: Failed to create the pair: Unknown value HP-Privelege-Level = 3 for attribute 3Com-User-Access-Level 3Com-User-Access-Level HP-Privelege-Level = 3 rlm_sql: Failed to create the pair: Unknown value 3Com-User-Access-Level = 3 for attribute 3Com-User-Access-Level Basically debug gives me same issue, "failed to create the pair: Unknown value <reply attribute> for <attribute> like this: (...) [sql] expand: %{User-Name} -> hua [sql] sql_set_user escaped user --> 'hua' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'hua' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'hua' ORDER BY id rlm_sql: Failed to create the pair: Unknown value Huawei-Exec-Privilege = "3" for attribute Huawei-Exec-Privilege rlm_sql (sql): Error getting data from database [sql] SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 0 ++[sql] returns fail Invalid user: [user/password] (from client dr1.xyz port 0 cli 00-00-00-00-00-00) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> hua attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 39 to X8.X3.3X.65 port 2888 This leads me to believe that there is something with the dictionary not working correct, I have tried to figure out the dictionary stuff but not sure on how to troubleshoot it. And I also have started a thread at the HP-forums to see if anyone not running windows have got it to work. Thanks for any assistance, and if solved I will as before update the wiki :-) Kind regards, Joel

3 4

Possible to have 2 authentications in sequence?
by Andy P. 10 Mar '16

10 Mar '16

Hello, Can someone tell if it is possible to have FreeRADIUS perform (as a proxy) 2 authentications in sequence on a user, such as the 1st - against an AD and if that succeeds - against another RADIUS server? Is it simply a matter of the the Authorization/Authentication sections definition, or requires some development? Thank you! BR

3 7

FR3.0.11 with ldap + 802.1x + dynamic Vlan assignment.
by Vlad Kratsberg 09 Mar '16

09 Mar '16

Hi Freeradius Users, We are using FR3.0.11 and are trying to set up 802.1x authentication. We are using eap-gtc inside peap. Here is what was configured: 1. mods-available/ldap + symlink to mods-enabled/ldap 2. mods-enabled/eap a. EAP section: changed default_eap_type to peap b. PEAP section: changed default_eap_type to gtc 3. mods-config/files/authorize Added the following: DEFAULT Ldap-Group == "juniper-admins" Service-Type = "Login-User", Idle-Timeout = 600, Juniper-Local-User-Name = "admin", Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 505, Filter-Id = "USERS-FILTER" Here is the full debug: http://pastebin.com/Lugmz3yc The result: Ldap works, user gets authenticated, and Access-Accept message is received however Vlan attributes and Filter-id are not present in Access-Accept. Freeradius-2.1.12 version returns attributes just fine. P.S: The reason why i m not using available RPM FR_3.0.4 is because when I perform change number 2.a. (eap section) as described above, freeradius doesn't recognize it and displays default config: ================================================ # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 ================================================= I would appreciate any help or point in the right direction. Thanks Vlad

2 4

3.1.x systemd startup
by Jonathan Gazeley 09 Mar '16

09 Mar '16

I've just built 3.1.x from git head this morning (commit 307c8a9) and while it works properly when executed as radiusd -X, it will not startup when started via systemctl on CentOS 7. [jg4461@radius-el7 ~]$ sudo service radiusd start Redirecting to /bin/systemctl start radiusd.service Job for radiusd.service failed because the control process exited with error code. See "systemctl status radiusd.service" and "journalctl -xe" for details. [jg4461@radius-el7 ~]$ sudo journalctl -xe Mar 09 11:55:58 radius-el7 systemd[1]: Starting FreeRADIUS multi-protocol policy server... -- Subject: Unit radiusd.service has begun start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit radiusd.service has begun starting up. Mar 09 11:55:58 radius-el7 radiusd[1195]: Usage: radiusd [options] Mar 09 11:55:58 radius-el7 radiusd[1195]: Options: Mar 09 11:55:58 radius-el7 radiusd[1195]: -C Check configuration and exit. Mar 09 11:55:58 radius-el7 radiusd[1195]: -d <raddb> Set configuration directory (defaults to /etc/raddb). Mar 09 11:55:58 radius-el7 systemd[1]: radiusd.service: control process exited, code=exited status=1 Mar 09 11:55:58 radius-el7 radiusd[1195]: -D <dictdir> Set main dictionary directory (defaults to /usr/share/freeradius). Mar 09 11:55:58 radius-el7 radiusd[1195]: -f Run as a foreground process, not a daemon. Mar 09 11:55:58 radius-el7 radiusd[1195]: -h Print this help message. Mar 09 11:55:58 radius-el7 radiusd[1195]: -l <log_file> Logging output will be written to this file. Mar 09 11:55:58 radius-el7 radiusd[1195]: -m On SIGINT or SIGQUIT clean up all used memory instead of just exiting. Mar 09 11:55:58 radius-el7 radiusd[1195]: -n <name> Read raddb/name.conf instead of raddb/radiusd.conf. Mar 09 11:55:58 radius-el7 radiusd[1195]: -P Always write out PID, even with -f. Mar 09 11:55:58 radius-el7 radiusd[1195]: -s Do not spawn child processes to handle requests (same as -ft). Mar 09 11:55:58 radius-el7 radiusd[1195]: -t Disable threads. Mar 09 11:55:58 radius-el7 radiusd[1195]: -v Print server version information. Mar 09 11:55:58 radius-el7 radiusd[1195]: -X Turn on full debugging (similar to -tfxxl stdout). Mar 09 11:55:58 radius-el7 radiusd[1195]: -x Turn on additional debugging (-xx gives more debugging). Mar 09 11:55:58 radius-el7 systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. -- Subject: Unit radiusd.service has failed The radiusd.service unit specifies to start with -m, but when I run this by hand... [jg4461@radius-el7 ~]$ sudo radiusd -m Usage: radiusd [options] Options: -C Check configuration and exit. -d <raddb> Set configuration directory (defaults to /etc/raddb). -D <dictdir> Set main dictionary directory (defaults to /usr/share/freeradius). -f Run as a foreground process, not a daemon. -h Print this help message. -l <log_file> Logging output will be written to this file. -m On SIGINT or SIGQUIT clean up all used memory instead of just exiting. -n <name> Read raddb/name.conf instead of raddb/radiusd.conf. -P Always write out PID, even with -f. -s Do not spawn child processes to handle requests (same as -ft). -t Disable threads. -v Print server version information. -X Turn on full debugging (similar to -tfxxl stdout). -x Turn on additional debugging (-xx gives more debugging). Has the -m option been changed or taken away? It still appears in the usage message and the systemd unit. I guess either -m needs to be fixed, or removed from the docs etc. Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

2 2

mschap direct-to-Winbind different behaviour
by Jonathan Gazeley 09 Mar '16

09 Mar '16

Hi folks, I've been investigating switching my mschap authentications from ntlm_auth to use direct Winbind connections with libwbclient. It works fine for user authentications against AD but does not work for machine authentications against the same. The direct Winbind method returns an error from AD. Can anyone explain this? FreeRADIUS 3.1.x built from git Samba 4.2.3 from CentOS 7 Here's my mschap config: mschap eduroammschap { # Either: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} --challenge=%{eduroammschap:Challenge} --nt-response=%{eduroammschap:NT-Response} " # Or: winbind_username = "%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}}" winbind_domain = "%{eduroammschap:NT-Domain}" pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 } allow_retry = no retry_msg = "Verify username and re-enter your password" } Debug using ntlm_auth: (7) Auth-Type eduroamlioneap { (7) eduroamlioneap - Peer sent packet with EAP method MSCHAPv2 (26) (7) eduroamlioneap - Calling submodule eap_mschapv2 to process data (7) eap_mschapv2 - Running Auth-Type MS-CHAP from file /etc/raddb/sites-enabled/eduroamlion-inner (7) eap_mschapv2 - Auth-Type MS-CHAP { (7) eduroammschap - Creating challenge hash with username: MONITOR899307$ (7) eduroammschap - Client is using MS-CHAPv2 (7) eduroammschap - Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} --challenge=%{eduroammschap:Challenge} --nt-response=%{eduroammschap:NT-Response} : (7) eduroammschap - EXPAND --username=%{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} (7) eduroammschap - --> --username=MONITOR899307$ (7) eduroammschap - EXPAND --challenge=%{eduroammschap:Challenge} (7) eduroammschap - Creating challenge hash with username: MONITOR899307$ (7) eduroammschap - --> --challenge=d6341cfb2d2e480e (7) eduroammschap - EXPAND --nt-response=%{eduroammschap:NT-Response} (7) eduroammschap - --> --nt-response=843e30991be16db3f688bff168572cb202bf0582b0713189 (7) eduroammschap - Program returned code (0) and output 'NT_KEY: 4B6BB21FE18F7D003EFD4D39CFC5939A' (7) eduroammschap - Adding MS-CHAPv2 MPPE keys (7) eduroammschap (ok) Debug using direct Winbind: (27) Auth-Type eduroamlioneap { (27) eduroamlioneap - Peer sent packet with EAP method MSCHAPv2 (26) (27) eduroamlioneap - Calling submodule eap_mschapv2 to process data (27) eap_mschapv2 - Running Auth-Type MS-CHAP from file /etc/raddb/sites-enabled/eduroamlion-inner (27) eap_mschapv2 - Auth-Type MS-CHAP { (27) eduroammschap - Creating challenge hash with username: MONITOR899307$ (27) eduroammschap - Client is using MS-CHAPv2 (27) eduroammschap - EXPAND %{%{Stripped-User-Name}:-%{eduroammschap:User-Name}} (27) eduroammschap - --> MONITOR899307$ (27) eduroammschap - EXPAND %{eduroammschap:NT-Domain} (27) eduroammschap - --> UOB (27) eduroammschap - Reserved connection (1) (27) eduroammschap - sending authentication request user='MONITOR899307$' domain='UOB' (27) eduroammschap - Released connection (1) (27) eduroammschap - ERROR: No logon workstation trust account [0xC0000199] (27) eduroammschap - ERROR: Password has expired. User should retry authentication (27) eduroammschap (reject) Thanks, Jonathan -- Jonathan Gazeley Senior Systems Administrator IT Services University of Bristol

4 11

Proxy realms and home_server_pool fallback not working
by Peter Lambrechtsen 08 Mar '16

08 Mar '16

Hi I'm looking to add more robustness into my proxy architecture and noticed in the home_server_pool there is the option for "fallback = virtualrealm" so if all home servers fail then a last resort home_server is used with some config locally to always accept / reject customers based on the realm they are coming from. I'm not using the status_check as some of the downstream clients don't support status-server, but I will look into that to see if it makes a difference. However for this situation I would expect if you are using or not using Status server checks shouldn't have any impact on how the fallback server works. In the proxy.conf I have configured: home_server ProxyDest { type = auth+acct ipaddr = 192.168.1.113 port = 1812 secret = password response_window = 1 require_message_authenticator = no zombie_period = 5 revive_interval = 10 status_check = none #status_check = status-server # username = "test_user_please_reject_me" # password = "this is really secret" check_interval = 10 num_answers_to_alive = 3 max_outstanding = 65536 } home_server cacheuser { virtual_server = cacheuser } # Main server pool # home_server_pool ProxyDestPool { type = fail-over home_server = ProxyDest # home_server = cacheuser fallback = cacheuser } Then in my virtual server I have configured: server cacheuser { authorize { accept } So when the Destination server is up life is good. (0) Proxying request to home server 192.168.1.113 port 1812 timeout 1.000000 (0) Sent Access-Request Id 26 from 0.0.0.0:58512 to 192.168.1.113:1812 length 337 ... Waking up in 0.3 seconds. (0) Marking home server 192.168.1.113 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Accept Id 26 from 192.168.1.113:1812 to 192.168.1.116:58512 length 55 But if the server is down the first request I get a reject as expected due to the home server being down. (2) Proxying request to home server 192.168.1.113 port 1812 timeout 1.000000 (2) Sent Access-Request Id 17 from 0.0.0.0:47755 to 192.168.1.113:1812 length 337 ... Waking up in 0.3 seconds. (2) Expecting proxy response no later than 0.669753 seconds from now Waking up in 0.4 seconds. (2) No proxy response, giving up on request and marking it done Marking home server 192.168.1.113 port 1812 as zombie (it has not responded in 1.000000 seconds). (2) ERROR: Failing proxied request for user "peter", due to lack of any response from home server 192.168.1.113 port 1812 (2) Clearing existing &reply: attributes But the second and subsequent request I would expect to get proxied to the local fallback virtual server as the home_server has been marked as zombie. But that never seems to happen. It keeps on rejecting the requests and fallback never seems to be used. If I configure a second home server in the pool. home_server_pool ProxyDestPool { type = fail-over home_server = ProxyDest home_server = cacheuser fallback = cacheuser } Then the second server is failed over to when the first fails. Which is all good if I wanted to use the type fail-over, but if I wanted to use load-balance then I can't have my fallback server as a home server otherwise a percentage of requests will always be local which isn't ideal. The other interesting thing with the failover is I set the check_interval to 10 seconds, or 30 seconds. But it only seems that the first client is re-checked after 60 seconds and assumed to be back up. Waking up in 0.2 seconds. Marking home server 192.168.1.113 port 1812 alive again... we have no idea if it really is alive or not. Waking up in 1.0 seconds. I would have thought that zombie_period = 5 revive_interval = 10 check_interval = 10 Would mean that the client would be re-checked in 10 seconds. Am I mis-understanding how fallback is supposed to work? Cheers Peter

2 7

Acct-Interim-Interval - Help is needed
by Bacsó Márton Károly 08 Mar '16

08 Mar '16

Dear Freeradius users, We have been using Freeradius with Daloradius on a Raspberry Pi for almost a year now. Until now everything worked perfectly, but because of a faulty SD card I had to reinstall the system at the weeekend. Now acct-interim-interval doesn’t work. I do get usage data, but only on stops. I checked my config files from the original installation and it seems that I managed to replicate all of my settings. Radtest gives back the reply attributes and I didn’t change anything on my APs.. Old system: Raspbian Wheezy, Freeradius 2.x (1.8??, I don’t remember). SQL New system: Raspbian Jessie, Freeradius 2.2.5, SQL Most of our APs are TPLINK901NDs, running OpenWRT. I have attached the the result of freeradius -X. Any help would be greatly appriciated!!! Radtest:Sending Access-Request of id 186 to 127.0.0.1 port 1812 User-Name = "bacsom" User-Password = "MB1237" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=186, length=32 Acct-Interim-Interval = 60 Idle-Timeout = 600 Marton Bacsó Márton Károly bacsom(a)hotmail.com bacsom(a)thankaroly.hu M.: +36 20 3315753 http://digilecke.com http://www.bacsomarton.com

2 2

how to authorize ldap users
by MichaelLeung 08 Mar '16

08 Mar '16

hi list who can i define policys on freeradius to authorize those users belong to speacific group which exsist on openldap server i google lot , but fine nothing , most of them are talking how to initial freeradius with internal user database

2 1

can linelog log passwords?
by Stefano Zanmarchi 08 Mar '16

08 Mar '16

Hello, I know that the log section of radiusd.conf allows to log passwords, by setting auth_badpass and auth_goodpass to "yes" or"no". But what I need is to log passwords only using the linelog module. More precisely, I'd like to keep auth_badpass = no auth_goodpass =yes destination = syslog in the log section of radiusd.conf and occasionally activate password logging on a local file via linelog for debugging purposes (and not have password be sent to syslog). Is this possible? If not with linelog, is there another way to keep on logging via syslog, while logging only password to a file? Thanks in advance, Stefano

3 2

TTLS Issue after Ubuntu upgrade
by Arjan Sinnige 07 Mar '16

07 Mar '16

Hi all, For months I had a working server on Ubuntu 14.10 with a build from source freeradius 2.2.9. As Ubuntu 14.10 was running out of support, I decided to upgrade. As openSSL version was changed I had to rebuild freeradius from source again. I stumbled into 2 issues during the build : - I had to disable ikev2 in debian/rules with --without-rlm_eap_ikev2 because it would not finish the build with it. - I had to disable iodbc in debian/rules with --without-rlm_sql_iodbc because it would not finish the build with it. As I am running LDAP as backend the second I could care less about but the first gave me a few frowns. Now when clients try to connect, most of them succeed (probably because they are using TLS / PEAP ) but I had a few apple products that would not connect. Some IOS and some versions of OSX. All PCs were ok, android were ok etc.. So I traced it down to TTLS - pap configurations which seem to fail (I think) but I cannot find out why ? Probably because of TLS Length issues but I cannot find an answer on the list how to solve it. I "fixed" it temporarily by forcing eap { default_eap_type = "peap" } But I would like to know what is going on. I will probably upgrade to v3.0 when Ubuntu 16.04.1 is out but for now I am stuck with this. I've chopped a few parts out as this was a live system with 200 users and edited the passwords and domain. Hope I did not screw that up.. Any ideas ? Arjan Sinnige root@studentserv:/etc/freeradius# freeradius -X freeradius: FreeRADIUS Version 2.2.9, for host x86_64-pc-linux-gnu, built on Mar 6 2016 at 20:52:16 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "root" group = "root" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 51200 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "Password" nastype = "other" } client 192.168.112.100 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-RestArea" nastype = "other" } client 192.168.112.101 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-2-PracticalArea" nastype = "other" } client 192.168.112.102 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-3-HLOffice" nastype = "other" } client 192.168.112.103 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-4-Test" nastype = "other" } client 192.168.112.104 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-5-Classroom" nastype = "other" } client 192.168.112.105 { require_message_authenticator = no secret = "Password" shortname = "TestWifi2" nastype = "other" } client 192.168.112.106 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-6-Classroom1" nastype = "other" } client 192.168.112.107 { require_message_authenticator = no secret = "Password" shortname = "AMS-AP-7-TestWifi2" nastype = "other" } client 192.168.110.0/24 { require_message_authenticator = no secret = "Password" shortname = "Admin-Switch-Test" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Auth-Type = LDAP Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/modules/ldap ldap { server = "127.0.0.1" port = 389 password = "Password" expect_password = yes identity = "cn=admin,dc=domain,dc=com" net_timeout = 1 timeout = 4 timelimit = 3 max_uses = 0 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "ou=Users,dc=domain,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x28090b0 Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 2048 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "peap" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no escape_filenames = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 46610 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=244, length=152 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0204000b016a6b6c6f6d70 Message-Authenticator = 0x3232b6337d14a535a22e851f877b629c # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [ldap] performing user authorization for jklomp [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> jklomp [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jklomp) [ldap] expand: ou=Users,dc=domain,dc=com -> ou=Users,dc=domain,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Users,dc=domain,dc=com, with filter (uid=jklomp) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}llBem5VF9 PASSWORD IR4pE1r4FoeaC" [ldap] sambaNtPassword -> NT-Password == 0x43333444444446443545 PASSWORD 54236454144363038464632453336 [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 244 to 192.168.112.103 port 65528 EAP-Message = 0x010500061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa864765a58fb7dc9e26e92fa4d Finished request 153. Going to the next request Waking up in 2.3 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=245, length=311 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0205009815800000008e160301008901000085030156dd8dbcbd6ce79975595ea9dd76603c1efecca658dbd8a96bb0ef52252f8a1c00004a00ffc024c023c00ac009c007c008c028c027c014c013c011c012c026c025c02ac029c005c004c002c003c00fc00ec00cc00d003d003c002f000500040035000a0067006b00330039001601000012000a00080006001700180019000b00020100 State = 0x64734fa864765a58fb7dc9e26e92fa4d Message-Authenticator = 0x61c50a4ed101236a4fb26298dfcbd7b2 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 152 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 142 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< Unknown TLS version [length 0005] [ttls] <<< TLS 1.0 Handshake [length 0089], ClientHello [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 0039], ServerHello [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 083e], Certificate [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] TLS_accept: Need to read more data: unknown state [ttls] TLS_accept: Need to read more data: unknown state In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 245 to 192.168.112.103 port 65528 EAP-Message = 0x0106040015c0000009da16030100390200003503016f7cd2530342d027d7e4ba0bda86b76a4759c3c68f4c58f76cfceadf0ee9f42500c01400000dff01000100000b000403000102160301083e0b00083a0008370004203082041c30820304a003020102020101300d06092a864886f70d01010b050030819c310b3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d310b3009060355040b0c0249543125302306035504030c1c73747564656e74736572762e736165616d7374657264616d2e636f6d3120301e06092a864886 EAP-Message = 0xf70d0109011611612e73696e6e696765407361652e656475301e170d3135303330323131323334325a170d3335303232353131323334325a308188310b3009060355040613024e4c310b300906035504080c024e4831163014060355040a0c0d53414520416d7374657264616d310b3009060355040b0c0249543125302306035504030c1c73747564656e74736572762e736165616d7374657264616d2e636f6d3120301e06092a864886f70d0109011611612e73696e6e696765407361652e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100c76004cdcb06fcb74bce3805c09ebe17282b9cd96927e6bfc1 EAP-Message = 0xab41c4a1f0a648c21520d148f8508afe67612d874dbbfdc37bb5d2c2b09e0b4a1046ae62d1d176de4d8174d1cc48369d07fffda97973d9778ec84990b3707df6e539ed51ab897e865aebfca87344b043edcbe089f07381176ecdac490a3401c8050563b4057b997ed61a469fb41645b0154c4aa9b5dd006af37218b6062adc8a30c3bc7de2c1da7f46892ff53307f5b694db237a885ea91fd2da99e2097697002415212570a7a9694ffddb64d715f2281a10fb0ca316f0158582e63863bdf9d75526fcb4d0be6e1ae1aca1da5b2f3083841da3af6df40168f6b2499192a7015da2088a58fdf6ab0203010001a37b307930090603551d1304023000302c EAP-Message = 0x06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414816c6f35c114a96b985a08623ff393e24214853d301f0603551d230418301680142cfa18f7883dcd9d155090d65d150b83d383b7f2300d06092a864886f70d01010b050003820101009c067332f471e54de7e4f9a47ccda16f57845aefa95d18555f906599eaff46d5631264aff3331b82bcd43f5c664e8019a2abee96715bdbdf65aaf11889d7e329383dc0f7586a91a144664156ee5cd46b7485883835cb786964fa9c48d1a26948cc04bc4328679d9263503624361cc299b9121488269bfa69167ea783e3 EAP-Message = 0xc6883c3fa35b3ecb9fa3eec7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa865755a58fb7dc9e26e92fa4d Finished request 154. Going to the next request Waking up in 2.3 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=246, length=165 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020600061500 State = 0x64734fa865755a58fb7dc9e26e92fa4d Message-Authenticator = 0x9f3d287f3f67bf96b8531b783b37c359 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 246 to 192.168.112.103 port 65528 EAP-Message = 0x0107040015c0000009daaba29398f826982d45762f90dabf8040dff8ba33fd01a66cbbbf265fcc3a72dc7c0af33a9f2866b5e159f4d3f661da918c6ea78dfb6940ed5d11f2e7cc4ea71d5ae8065edcb0b64ef09c125015edacbd262fe80692eb5a24a1052b2c06fd6af221b19ce3039061969dd4c176c5dcda3a86ee913998410e0004113082040d308202f5a003020102020900cafefe4577df2257300d06092a864886f70d01010b050030819c310b3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d310b3009060355040b EAP-Message = 0x0c0249543125302306035504030c1c73747564656e74736572762e736165616d7374657264616d2e636f6d3120301e06092a864886f70d0109011611612e73696e6e696765407361652e656475301e170d3135303330323131313430305a170d3335303232353131313430305a30819c310b3009060355040613024e4c310b300906035504080c024e483112301006035504070c09416d7374657264616d31163014060355040a0c0d53414520416d7374657264616d310b3009060355040b0c0249543125302306035504030c1c73747564656e74736572762e736165616d7374657264616d2e636f6d3120301e06092a864886f70d0109011611612e EAP-Message = 0x73696e6e696765407361652e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100e11800b0bbe3444cd3b693e054f2cf7d7f9b13deca592e169766cda08bf1de158bde6dd215417051fddc32277030e19bc60c2c5fc1d3ff73a2f70bda312d70f24bde61951f85b908896bba6528ee39828691f64e854bf60855b901db2a4731cfb65fc42641de5328e5f5904edeaa55514c130b354574eefbbc11fbcdf36908a5c810298f5d1f36773f23a8933b338a6258b1068b0af11902f41147a36f877512001683b8eeb17c708e4bf815d417aca8255a27af2e9451019d9f4d3b99ccb3bce8aaf4a84a35e47a03e8817826 EAP-Message = 0x3d886270c8f6791a2d5a886d74da1ad1ab67c3b7e2ea915be7d7bf622b4d1977bacba0d45223acc23edc0e12b5f39e15188e430203010001a350304e301d0603551d0e041604142cfa18f7883dcd9d155090d65d150b83d383b7f2301f0603551d230418301680142cfa18f7883dcd9d155090d65d150b83d383b7f2300c0603551d13040530030101ff300d06092a864886f70d01010b05000382010100d5e3812906be81a4eda4400cf52b2d8b0323d33c6355020704390b58480ac3ff34fe125c6cafb0c77e0afff9a2cd99267e0d71b1461e67c0e7092c89eb6bb1a0c8d7071056b3549ca70b808be49c7aaec2b4278fcbdfd6f612df6bad7ab2c4 EAP-Message = 0xbfb6dcb06a90bf20feddbda5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa866745a58fb7dc9e26e92fa4d Finished request 155. Going to the next request Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=247, length=165 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020700061500 State = 0x64734fa866745a58fb7dc9e26e92fa4d Message-Authenticator = 0x5988184f00ae2bedef7b30d46c4a893e # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 247 to 192.168.112.103 port 65528 EAP-Message = 0x010801f81580000009da2037165fe68bb780b62d77bb0229e415a82b2805a0e4e4fcf3e95e77dc2954c0b9e2d23b3668be4ae5b324c3b6236b65670acc7f16c9c3e43819fe3a19470edebdd5c1bdcd4a6e032cb61308bd52d368f292a8a6c60101fa30cc1cd541e3344a5c58143375914c8b6c68963e87eb0af0cebd5b47111269fabc5e8a674e972ddc0a975253be159911be90589f9e897ad58cf474bef9160301014b0c000147030017410446637b8b54084745ae7c65ae7cebf6f6f0862226a7741788b45fa83b6a60182671273a13782a8793b9ac843f001a8977c8632936689f32e67473fa592386ef0d01005504c6a225f1766b948853a9d326 EAP-Message = 0x9c4095cbf95fa1dd6aeaaf3b40a9fc4fbfbea88eb95323dba9adbca7b3b04c2686601b210287b9e561b769ebe02b92bdd5183ba33ef57022c262e23616329a87ce568fd4dfa7a286f2bb1aeda42b234b72539a8b8b7059de94061a96a23602adf117d97989b33aff32195e28a36423dfec36bbbc60597274565c3a848925a17a33a234d8d23e9415e5a045641e853fa8a99ddef03cdbb7d94df5466f95280c07c1955fe5c2812013f3d9bebadf20bf45a70f4e981c681e851a07a1ff376f646575853101113fa212d4f885e3016f28c1c7c4c97403070f2994d16a07a322710605bde1a8cd96df726c59adf10da82290ad2e16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa8677b5a58fb7dc9e26e92fa4d Finished request 156. Going to the next request rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=248, length=303 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020800901580000000861603010046100000424104a223bbaa71fe2ed39f74f1301e6ac0c3576eccd0d960573e9c0a27ae2f2729b000d8590dc38a075da5529ef00a9586efde3666ab8c22d93858d9fdce62a844531403010001011603010030a88619ab87f1d095c41d1f81f5746c7b8ec9af68d8fe9e7ff81a12eb2171ea53d1d048de8730d045e9dc8f8106bf7154 State = 0x64734fa8677b5a58fb7dc9e26e92fa4d Message-Authenticator = 0xefcc0e4362978abf61cfcaff33c113a8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 8 length 144 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 134 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< Unknown TLS version [length 0005] [ttls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] <<< Unknown TLS version [length 0005] [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< Unknown TLS version [length 0005] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: unknown state [ttls] >>> Unknown TLS version [length 0005] [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: unknown state [ttls] TLS_accept: unknown state [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 248 to 192.168.112.103 port 65528 EAP-Message = 0x0109004515800000003b140301000101160301003028333450e9283ceb9da0d25d4d8cf007557f10fc07ac0f1650b36f3c62930461415acedab4bb2940cc8d588ff492039b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa8607a5a58fb7dc9e26e92fa4d Finished request 157. Going to the next request Waking up in 2.4 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=249, length=318 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0209009f1580000000951703010090359451bedeb5bc07e07b321e50ee73176f2c5cdc3a885af614316d5c171c94ac4d3a86363f41498298a699e5cf7344bc1c8abdbb742ee55d7296e85b57388d3f0ac2dab18e88825bc5914c8ef5d4ec275a16214ce0d00aa062269283d2791cf6679e3618bac6c627072620b7ee55ef4e0e7c32cda51a17bea0d4063fac69220740658af2214e4a3512903089db147cfb State = 0x64734fa8607a5a58fb7dc9e26e92fa4d Message-Authenticator = 0xd63dc4932627eb1ff878a9768bd65415 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 9 length 159 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 149 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< Unknown TLS version [length 0005] [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "jklomp" MS-CHAP-Challenge = 0x16d14d2b3d24edda4c389fa4cfc1969c MS-CHAP2-Response = 0x9c008afbe33218827ffcc6fb348cf840d0eb0000000000000000431508b1e60c95a4c535288f42ff0f06a3565780c5ec7a18 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "jklomp" MS-CHAP-Challenge = 0x16d14d2b3d24edda4c389fa4cfc1969c MS-CHAP2-Response = 0x9c008afbe33218827ffcc6fb348cf840d0eb0000000000000000431508b1e60c95a4c535288f42ff0f06a3565780c5ec7a18 FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] = ok [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop [ldap] performing user authorization for jklomp [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> jklomp [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jklomp) [ldap] expand: ou=Users,dc=domain,dc=com -> ou=Users,dc=domain,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Users,dc=domain,dc=com, with filter (uid=jklomp) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}llBem5VF92aO PASSWORD R4pE1r4FoeaC" [ldap] sambaNtPassword -> NT-Password == 0x43333444444446443545443 PASSWORD 36454144363038464632453336 [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok ++[expiration] = noop ++[logintime] = noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = ok Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group MS-CHAP { [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Creating challenge hash with username: jklomp [mschap] Client is using MS-CHAPv2 for jklomp, we need NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] = ok +} # group MS-CHAP = ok Login OK: [jklomp] (from client AMS-AP-4-Test port 0 via TLS tunnel) WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel } # server inner-tunnel [ttls] Got tunneled reply code Access-Accept MS-CHAP2-Success = 0x9c533d33383837444136454433443939314545394643363631373336464144394534423732413444423132 MS-MPPE-Recv-Key = 0x952807638f14573bdc5017b5129b35a6 MS-MPPE-Send-Key = 0xf6672997d235901f0ab3d32439733f30 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. [ttls] >>> Unknown TLS version [length 0005] ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 249 to 192.168.112.103 port 65528 EAP-Message = 0x010a005f15800000005517030100508771ba9f57012a44867992b71c9ca682898b14690dbe3c15370db3e2dbc3fcd82ac2a84dff1bd58bce9f726b239510ea16359b665a1b5b6db4debbfbda13ee1417acbe034b97d186350d68f39c241c0b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64734fa861795a58fb7dc9e26e92fa4d Finished request 158. Going to the next request Waking up in 2.3 seconds. rad_recv: Access-Request packet from host 192.168.112.103 port 65528, id=250, length=165 User-Name = "jklomp" NAS-IP-Address = 192.168.112.103 NAS-Port = 0 Called-Station-Id = "00-1C-B3-AD-B0-CC:SAE-Wifi" Calling-Station-Id = "E0-F8-47-FB-E0-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020a00061500 State = 0x64734fa861795a58fb7dc9e26e92fa4d Message-Authenticator = 0x0944fef5966c1129212adfb8f7ae102a # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "jklomp", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 10 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK default [ttls] Invalid ACK received: 0 [ttls] eaptls_verify returned 4 [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Login incorrect: [jklomp] (from client AMS-AP-4-Test port 0 cli E0-F8-47-FB-E0-61) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> jklomp attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 159 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 159 Sending Access-Reject of id 250 to 192.168.112.103 port 65528 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.3 seconds.

2 1