- Freeradius-Users - lists.freeradius.org

EAP - TLS Free Radius Configuration question.
by Jeff Ausfeld 26 Jan '16

26 Jan '16

I have been trying to debug this configuration for quite some time and I think it's almost correct but I'm missing something and could really use your help. *****Versions:******* freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 mysql Ver 14.14 Distrib 5.5.46, for debian-linux-gnu (x86_64) using readline 6.3 Ubuntu 14.04 kernel 4.3 64 bit. ******freeradius -XXX******** Sun Jan 24 23:19:39 2016 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 44707, id=0, length=128 User-Name = "chillispot" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000f016368696c6c6973706f74 Message-Authenticator = 0xe86fc9d356c87144c7d115539c17172b Sun Jan 24 23:45:40 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/XXXXXXXX Sun Jan 24 23:45:40 2016 : Info: +- entering group authorize {...} Sun Jan 24 23:45:40 2016 : Info: ++[preprocess] returns ok Sun Jan 24 23:45:40 2016 : Info: [eap] EAP packet type response id 0 length 15 Sun Jan 24 23:45:40 2016 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sun Jan 24 23:45:40 2016 : Info: ++[eap] returns updated Sun Jan 24 23:45:40 2016 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Sun Jan 24 23:45:40 2016 : Info: [sql] expand: -> Sun Jan 24 23:45:40 2016 : Error: [sql] Error generating query; rejecting user Sun Jan 24 23:45:40 2016 : Debug: rlm_sql (sql): Released sql socket id: 1 Sun Jan 24 23:45:40 2016 : Info: ++[sql] returns fail Sun Jan 24 23:45:40 2016 : Info: Using Post-Auth-Type Reject Sun Jan 24 23:45:40 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/XXXXXXX Sun Jan 24 23:45:40 2016 : Info: +- entering group REJECT {...} Sun Jan 24 23:45:40 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> chillispot Sun Jan 24 23:45:40 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sun Jan 24 23:45:40 2016 : Info: ++[attr_filter.access_reject] returns updated Sun Jan 24 23:45:40 2016 : Info: Delaying reject of request 7 for 1 seconds Sun Jan 24 23:45:40 2016 : Debug: Going to the next request Sun Jan 24 23:45:40 2016 : Debug: Waking up in 0.9 seconds. Sun Jan 24 23:45:41 2016 : Info: Sending delayed reject for request 7 Sending Access-Reject of id 0 to 127.0.0.1 port 44707 Sun Jan 24 23:45:41 2016 : Debug: Waking up in 4.9 seconds. Sun Jan 24 23:45:46 2016 : Info: Cleaning up request 7 ID 0 with timestamp +3210 Sun Jan 24 23:45:46 2016 : Info: Ready to process requests. ****** eapol response ********* root@XXXXXXX:/etc/freeradius/sites-available# eapol_test -c /etc/freeradius/eapol_test/eap-tls -a 127.0.0.1 -p 1812 -s testing123Reading configuration file '/etc/freeradius/eapol_test/eap-tls' Line: 7 - start of a new network block key_mgmt: 0x1 eap methods - hexdump(len=16): 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 identity - hexdump_ascii(len=10): **** HEX DUMPS REMOVED **** Authentication server 127.0.0.1:1812 RADIUS local address: 127.0.0.1:44707 ENGINE: Loading dynamic engine ENGINE: Loading dynamic engine EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: KEY_RX entering state NO_KEY_RECEIVE EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE Sending fake EAP-Request-Identity EAPOL: Received EAP-Packet frame EAPOL: SUPP_PAE entering state RESTART EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=0 method=1 vendor=0 vendorMethod=0 EAP: EAP entering state IDENTITY CTRL-EVENT-EAP-STARTED EAP authentication started EAP: Status notification: started (param=) EAP: EAP-Request Identity data - hexdump_ascii(len=0): EAP: using real identity - hexdump_ascii(len=10): 63 68 69 6c 6c 69 73 70 6f 74 chillispot EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=15) TX EAP -> RADIUS - hexdump(len=15): 02 00 00 0f 01 63 68 69 6c 6c 69 73 70 6f 74 Encapsulating EAP message into a RADIUS packet Learned identity from EAP-Response-Identity - hexdump(len=10): 63 68 69 6c 6c 69 73 70 6f 74 Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=0 length=128 Attribute 1 (User-Name) length=12 Value: 'chillispot' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=17 Value: 0200000f016368696c6c6973706f74 Attribute 80 (Message-Authenticator) length=18 Value: e86fc9d356c87144c7d115539c17172b Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 20 bytes from RADIUS server Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=0 length=20 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 1.00 sec Allowing RADIUS Access-Reject without Message-Authenticator since it does not include EAP-Message RADIUS packet matching with station could not extract EAP-Message from RADIUS message EAPOL: EAP key not available EAPOL: EAP Session-Id not available WPA: Clear old PMK and PTK MPPE keys OK: 0 mismatch: 1 FAILURE ***** eap-tls.conf ****** # eapol_test -c eap-tls.conf -s testing123 # # Set also "nostrip" in raddb/proxy.conf, realm "example.com" # And make it a LOCAL realm. # network={ key_mgmt=WPA-EAP eap=TLS identity="chillispot" ca_cert="etc/freeradius/certs/ca.pem" client_cert="etc/freeradius/certs/client.crt" private_key="etc/freeradius/certs/client.key" private_key_passwd="XXXXXXXXXXXXXXXXXX" } mysql, freeradius, and the eapol command were all run from within the same physical server box via ssh. When I expose the file option instead of sql it calls from the users file and it works fine. I have traced mysql and it does not seem to be generating any query. So my guess is this is getting stopped or discarded in the initial security checks before sql somewhere. I have tried this with every permutation I can think of including disabling firewalls. There is not much information I could find on the authenticator but my guess is the packet is not getting formatting correctly as a result of my configuration/setup, or there is something odd with the certs, or something similar and since I have restricted this down to only eap-tls it is causing the failure. If anybody wants the tshark output, just let me know what switches / or how you want it sent. It can get fairly verbose, and I was trying to keep the initial email to under the size of a novel. I am very thankful for your time and for any advice or help you can provide. Regards with thanks, Jeff.

3 5

packages: freeradius vs freeradius-mysql
by Daniel Lopez 25 Jan '16

25 Jan '16

Hi. I'm using Freeradius 2.1.12 in Ubuntu 14.04 with MYSQL and PhpMyadmin. I install only freeradius-mysql package and so far everything has gone well. However recently I've seen some tutorials where they install both freeradius and freeradius-mysql. I was wrong to install only freeradius-mysql package? what features could I miss? Now when I try to install freeradius package it says to me it is already installed, but, for instance, I can't find the *.cnf files in /certs folder. Thanks for your help

4 8

Freeradius LOG problems
by Adem Darguner 24 Jan '16

24 Jan '16

Hi Everyone, We use Ubuntu 15.10 Server (32-bit) We have problem Freeradius + MYSQL log problem.We cannot see Access-Accept , Access-Reject Log in the /var/log/freeradius/ We see only the MYSQL requests to Freeradius log. We want see Access-Accept and Access-Reject log in the /var/log/Freeradius. radias.conf log { destination = files file = ${logdir}/radius.log requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no # msg_goodpass = "" # msg_badpass = "" } I want to see username >> Access-accept and username >> Access-Reject logs. I only see MYSQL request. What is problem? Thank you for your help. Regards root@tokenserver:/var/log/freeradius# radtest adem 00000000066186770941821001 localhost 0 freeradiussecret Sending Access-Request of id 100 to 127.0.0.1 port 1812 User-Name = "adem" User-Password = "00000000066186770941821001" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=100, length=20 root@tokenserver:/var/log/freeradius# MYSQL Reguest in the /var/log/freeradius/ drwxr-x--- 2 freerad freerad 4096 Jan 24 06:48 . drwxrwxr-x 14 root syslog 4096 Jan 24 06:48 .. -rw-r--r-- 1 freerad freerad 1267 Jan 24 16:12 radius.log -rw-r--r-- 1 freerad freerad 10888 Jan 24 06:48 radius.log.1 -rw-r--r-- 1 freerad freerad 900 Jan 17 06:38 radius.log.2.gz -rw-r--r-- 1 freerad freerad 1774 Jan 11 06:28 radius.log.3.gz -rw-r--r-- 1 freerad freerad 336 Jan 3 06:30 radius.log.4.gz -rw-r--r-- 1 freerad freerad 0 Dec 30 09:08 radwtmp radius.log.1 Sun Jan 17 06:38:07 2016 : Info: Loaded virtual server inner-tunnel Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Mon Jan 18 13:05:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #4 Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Mon Jan 18 13:05:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #3 Mon Jan 18 13:07:03 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Mon Jan 18 13:07:03 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Jan 18 13:07:03 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Mon Jan 18 13:07:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Mon Jan 18 13:07:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Tue Jan 19 10:41:29 2016 : Info: Signalled to terminate Tue Jan 19 10:41:29 2016 : Info: Exiting normally. Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 -- Adem DARGÜNER Network Engineer

2 1

Re: Access-Accept and Access-Reject Log problem
by Adem Darguner 24 Jan '16

24 Jan '16

Hi Everyone, We use Ubuntu 15.10 Server (32-bit) We have problem Freeradius + MYSQL log problem.We cannot see Access-Accept , Access-Reject Log in the /var/log/freeradius/ We see only the MYSQL requests to Freeradius log. We want see Access-Accept and Access-Reject log in the /var/log/Freeradius. radias.conf log { destination = files file = ${logdir}/radius.log requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no # msg_goodpass = "" # msg_badpass = "" } I want to see username >> Access-accept and username >> Access-Reject logs. I only see MYSQL request. What is problem? Thank you for your help. Regards root@tokenserver:/var/log/freeradius# radtest adem 00000000066186770941821001 localhost 0 freeradiussecret Sending Access-Request of id 100 to 127.0.0.1 port 1812 User-Name = "adem" User-Password = "00000000066186770941821001" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=100, length=20 root@tokenserver:/var/log/freeradius# MYSQL Reguest in the /var/log/freeradius/ drwxr-x--- 2 freerad freerad 4096 Jan 24 06:48 . drwxrwxr-x 14 root syslog 4096 Jan 24 06:48 .. -rw-r--r-- 1 freerad freerad 1267 Jan 24 16:12 radius.log -rw-r--r-- 1 freerad freerad 10888 Jan 24 06:48 radius.log.1 -rw-r--r-- 1 freerad freerad 900 Jan 17 06:38 radius.log.2.gz -rw-r--r-- 1 freerad freerad 1774 Jan 11 06:28 radius.log.3.gz -rw-r--r-- 1 freerad freerad 336 Jan 3 06:30 radius.log.4.gz -rw-r--r-- 1 freerad freerad 0 Dec 30 09:08 radwtmp radius.log.1 Sun Jan 17 06:38:07 2016 : Info: Loaded virtual server inner-tunnel Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Mon Jan 18 13:05:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #4 Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Mon Jan 18 13:05:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #3 Mon Jan 18 13:07:03 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Mon Jan 18 13:07:03 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Jan 18 13:07:03 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Mon Jan 18 13:07:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Mon Jan 18 13:07:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Tue Jan 19 10:41:29 2016 : Info: Signalled to terminate Tue Jan 19 10:41:29 2016 : Info: Exiting normally. Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 2016-01-24 17:17 GMT+02:00 Adem Darguner <adarguner(a)gmail.com>: > Hi Everyone, > > We use Ubuntu 15.10 Server (32-bit) > > We have problem Freeradius + MYSQL log problem.We cannot see Access-Accept > , Access-Reject Log in the /var/log/freeradius/ > We see only the MYSQL requests to Freeradius log. We want see > Access-Accept and Access-Reject log in the /var/log/Freeradius. > > radias.conf > > log { > destination = files > file = ${logdir}/radius.log requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log > syslog_facility = daemon > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > # msg_goodpass = "" > # msg_badpass = "" > } > > > I want to see username >> Access-accept and username >> Access-Reject > logs. I only see MYSQL request. > > What is problem? > > Thank you for your help. > > Regards > > > root@tokenserver:/var/log/freeradius# *radtest adem > 00000000066186770941821001 localhost 0 freeradiussecret* > Sending Access-Request of id 100 to 127.0.0.1 port 1812 > User-Name = "adem" > User-Password = "00000000066186770941821001" > NAS-IP-Address = 127.0.1.1 > NAS-Port = 0 > Message-Authenticator = 0x00000000000000000000000000000000 > rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=100, > length=20 > root@tokenserver:/var/log/freeradius# > > > > > > > > *MYSQL Reguest in the /var/log/freeradius/* > > drwxr-x--- 2 freerad freerad 4096 Jan 24 06:48 . > drwxrwxr-x 14 root syslog 4096 Jan 24 06:48 .. > -rw-r--r-- 1 freerad freerad 1267 Jan 24 16:12 radius.log > -rw-r--r-- 1 freerad freerad 10888 Jan 24 06:48 radius.log.1 > -rw-r--r-- 1 freerad freerad 900 Jan 17 06:38 radius.log.2.gz > -rw-r--r-- 1 freerad freerad 1774 Jan 11 06:28 radius.log.3.gz > -rw-r--r-- 1 freerad freerad 336 Jan 3 06:30 radius.log.4.gz > -rw-r--r-- 1 freerad freerad 0 Dec 30 09:08 radwtmp > > > > * radius.log.1 * > > Sun Jan 17 06:38:07 2016 : Info: Loaded virtual server inner-tunnel > Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #4 > Mon Jan 18 13:05:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #4 > Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #4 > Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #3 > Mon Jan 18 13:05:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #3 > Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #3 > Mon Jan 18 13:07:03 2016 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #2 > Mon Jan 18 13:07:03 2016 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #2 > Mon Jan 18 13:07:03 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 > Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #1 > Mon Jan 18 13:07:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #1 > Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 > Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #0 > Mon Jan 18 13:07:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #0 > Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 > Tue Jan 19 10:41:29 2016 : Info: Signalled to terminate > Tue Jan 19 10:41:29 2016 : Info: Exiting normally. > Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 > Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 > Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 > Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 > Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 > Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql > (module rlm_sql_mysql) loaded and linked > Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect to > radius@localhost:/radius > Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #0 > Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #0 > Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 > Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #1 > Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #1 > Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 > Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect > rlm_sql_mysql #2 > Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #2 > Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, > #2 > > -- Adem DARGÜNER Network Engineer

1 0

Access-Accept Access-Reject log problem
by Adem Darguner 24 Jan '16

24 Jan '16

Hi Everyone, We use Ubuntu 15.10 Server (32-bit) We have problem Freeradius + MYSQL log problem.We cannot see Access-Accept , Access-Reject Log in the /var/log/freeradius/ We see only the MYSQL requests to Freeradius log. We want see Access-Accept and Access-Reject log in the /var/log/Freeradius. radias.conf log { destination = files file = ${logdir}/radius.log requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no # msg_goodpass = "" # msg_badpass = "" } I want to see username >> Access-accept and username >> Access-Reject logs. I only see MYSQL request. What is problem? Thank you for your help. Regards root@tokenserver:/var/log/freeradius# radtest adem 00000000066186770941821001 localhost 0 freeradiussecret Sending Access-Request of id 100 to 127.0.0.1 port 1812 User-Name = "adem" User-Password = "00000000066186770941821001" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=100, length=20 root@tokenserver:/var/log/freeradius# MYSQL Reguest in the /var/log/freeradius/ drwxr-x--- 2 freerad freerad 4096 Jan 24 06:48 . drwxrwxr-x 14 root syslog 4096 Jan 24 06:48 .. -rw-r--r-- 1 freerad freerad 1267 Jan 24 16:12 radius.log -rw-r--r-- 1 freerad freerad 10888 Jan 24 06:48 radius.log.1 -rw-r--r-- 1 freerad freerad 900 Jan 17 06:38 radius.log.2.gz -rw-r--r-- 1 freerad freerad 1774 Jan 11 06:28 radius.log.3.gz -rw-r--r-- 1 freerad freerad 336 Jan 3 06:30 radius.log.4.gz -rw-r--r-- 1 freerad freerad 0 Dec 30 09:08 radwtmp radius.log.1 Sun Jan 17 06:38:07 2016 : Info: Loaded virtual server inner-tunnel Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Mon Jan 18 13:05:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #4 Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Mon Jan 18 13:05:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Jan 18 13:05:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #3 Mon Jan 18 13:07:03 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Mon Jan 18 13:07:03 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Jan 18 13:07:03 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Mon Jan 18 13:07:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Mon Jan 18 13:07:25 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Jan 18 13:07:25 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Tue Jan 19 10:41:29 2016 : Info: Signalled to terminate Tue Jan 19 10:41:29 2016 : Info: Exiting normally. Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 4 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 3 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 2 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 1 Tue Jan 19 10:41:29 2016 : Info: rlm_sql (sql): Closing sqlsocket 0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #0 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #1 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 Tue Jan 19 10:42:16 2016 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Tue Jan 19 10:42:16 2016 : Info: rlm_sql (sql): Connected new DB handle, #2 -- Adem DARGÜNER Network Engineer

2 1

Device can't get access
by Koenraad Lelong 24 Jan '16

24 Jan '16

Hi, I'm trying to configure a Lantronix Matchport bg Pro to access my wireless network. I seem unable to configure it to give it access, and I don't find why. My freeradius (3.0.10) can authenticate laptops and smartphones, it's only the device that gives problems, so I think I'm doing something wrong on the device. Below is my debug log for the device. I think in section (5) is my problem : (5) eap_peap: ERROR: SSL says: error:1412E152:SSL routines:SSL_PARSE_CLIENTHELLO_TLSEXT:unsafe legacy renegotiation disabled Is it possible to enable SSLv3 (temporarily), so I can see if that really is the problem ? Thanks, Koenraad.

2 1

Multiple FreeRadius servers with one PostgreSQL backend
by Ruslan Kalakutsky 22 Jan '16

22 Jan '16

Hello everyone. I'm trying to create a horizontally scalable VPN service: a lot of IPSEC nodes with FreeRadius server for EAP-auth and accounting. FreeRadius backend is a PostgreSQL server. The question is: "Is it possible to run multiple freeradius services (one on each VPN gateway) with one backend server?" It makes a configuration a really much easier, because I do not need to care about separate radius server performance/scaling and failover - each VPN node has its own server. Best Regards, Ruslan.

3 11

Is vulnerabe the process of sending credentials to a NAS ?
by Daniel Lopez 22 Jan '16

22 Jan '16

Hello. I've got a doubt about the security in authentication process. Suppose we have our Freeradius server configured to authenticate a certain user via password (Cleartext-Password) and MAC address (Calling-Station-Id). When this user tries to authenticate via a NAS (wireless router), and sends it its credentials, is it possible that an attacker could obtain those credentials by sniffing the comunication? And then gain access by mac address spoofing? And if so, How could this be avoided? How to protect this first step? Thanks you very much.

2 1

Why is the upgrade documentation is missing from the website??
by Adamn Schmidth 22 Jan '16

22 Jan '16

Hello list, First of all I wonder why is the upgrade documentation missing from the site: http://networkradius.com/doc/current/upgrading/ I have found a copy of it here but not all pages: https://web.archive.org/web/20150608212504/http://networkradius.com/doc/cur… Right now I still trying to rewrite old Freeradius 2.X configs to work with Radius 3. I didn no start from scratch because in my case there are bunch of configs, sql statements etc which was not written by me and it is not feasible to rewrite them from scratch. I stuck with this error for example: # Loaded module rlm_sqlcounter # Loading module "dailycounter" from file /etc/freeradius/sql/mysql/counter.conf sqlcounter dailycounter { /etc/freeradius/sql/mysql/counter.conf[48]: Configuration item "sql_module_instance" must have a value /etc/freeradius/sql/mysql/counter.conf[48]: Invalid configuration for module "dailycounter" Any ideas what's the problem here? Why did you need to change the syntax at all in version 3? What I would like to know the most is: Will it be require to change anything in the database schema or I can just use the old databases what I used with freeradius 2??? Thank you!

3 2

AW: Local user or DB?
by Cornelius Kölbel 22 Jan '16

22 Jan '16

Basically freeradius does not care where they are located if the users are in the same default privacyidea realm. Kind regardsCornelius Cornelius KölbelCornelius.koelbel(a)netknights.it+49 151 2960 1417 NetKnights GmbHhttp://netknights.itLandgraf-Karl-Str. 19, 34131 Kassel, GermanyTel: +49 561 3166797, Fax: +49 561 3166798 Amtsgericht Kassel, HRB 16405Geschäftsführer: Cornelius Kölbel -------- Ursprüngliche Nachricht -------- Von: Tevfik Ceydeliler <tevfik.ceydeliler(a)astron.yasar.com.tr> Datum: 22.01.2016 07:59 (GMT+01:00) An: freeradius-users(a)lists.freeradius.org Betreff: Local user or DB? Hi, I want to use both local files and mySQL DB to authenticate my user. But How can I tell to freeradius which user is located where local files or DB. Is there any way to do this? Realm can use for this aim? Have you any hint? Regards.. Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz. The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4