- Freeradius-Users - lists.freeradius.org

SQL Counter query buffer limit freeradius 3.0.10
by Michal Tomaszewski 24 Sep '15

24 Sep '15

Hi, SQL Counter has a hardcoded limit for the length of SQL query to probably 1024 bytes. When query string is longer freeradius debug shows: "sql: Insufficient query buffer space" It seems to be not sufficient in the case of longer, more sophisticated queries, e.g. when the timezone conversions must be applied few times in the single query string or query logic shall contain other data subsets. Some our queries reach almost 1500 bytes... Is there any other way to define 'long query' SQL statement to be correctly processed by sqlcounter module? Regards, Mike ________________________________________ Uwaga: Tre?? niniejszej wiadomo?ci mo?e by? poufna i obj?ta zakazem jej ujawniania. Je?li czytelnik tej wiadomo?ci nie jest jej zamierzonym adresatem, pracownikiem lub po?rednikiem upowa?nionym do jej przekazania adresatowi, informujemy ?e wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomo?ci jest zabronione. Je?li otrzyma?e? t? wiadomo?? omy?kowo, prosz? bezzw?ocznie odes?a? j? nadawcy, a sam? wiadomo?? usun?? z komputera. Dzi?kujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

4 8

Log problem
by Marian Pandoranum 24 Sep '15

24 Sep '15

Hello, I have set auth=yes in log section from radiusd.conf file in order to be able to see all the logs for authentication requests, in radius.log file from /var/log/radius directory. Unfrortunately, I can't see them. Is there an other setting that I have to do ? thank you for any help you can provide !

3 2

WPA2 enterprise and NAS-Identifier
by Lorenzo Milesi 24 Sep '15

24 Sep '15

hi. I'm trying to setup WPA2 authentication, and I mostly succeded, I can authenticate users which are in MySQL on FR2. What I am missing is the ability to restrict some users access using the NAS-Identifier attribute. >From what I could see the request (made from a DDWRT AP) doesn't include that attribute, so when it comes to radius it rejects the access because of that. Is it somehow possible to update the request (like it can be done for dynamic clients) and add the attribute there? thanks I'm attaching here a sample debug failed login session freeradius: FreeRADIUS Version 2.2.6, for host x86_64-pc-linux-gnu, built on Feb 12 2015 at 12:10:02 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/sql/mysql/ippool-dhcp.conf including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/raw including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/control-socket including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/status including configuration file /etc/freeradius/sites-enabled/inav-dynclients including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm NULL { authhost = LOCAL accthost = LOCAL } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "secret" shortname = "localhost" nastype = "other" } client dymamic { ipaddr = 0.0.0.0 netmask = 0 require_message_authenticator = no dynamic_clients = "dynamic_client_server" lifetime = 12600 } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = yes input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_raw Module: Instantiating module "raw" from file /etc/freeradius/modules/raw } radiusd: #### Loading Virtual Servers #### server { # from file modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "key_pwd" dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! WARNING: Fix this by running the OpenSSL command listed in eap.conf Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "peap" copy_request_to_tunnel = yes use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 25 lifetime = 0 max_queries = 0 sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' OR groupname = '%{NAS-Identifier}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' OR groupname = '%{NAS-Identifier}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = 'NAS-Reboot', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND calledstationid = '%{Called-Station-Id}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server status { # from file /etc/freeradius/sites-enabled/status modules { Module: Creating Autz-Type = Status-Server Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "ok" from file /etc/freeradius/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } } # modules } # server server dynamic_client_server { # from file /etc/freeradius/sites-enabled/inav-dynclients modules { Module: Checking authorize {...} for more modules to load } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/freeradius/freeradius.sock" } } listen { type = "status" ipaddr = 127.0.0.1 port = 18121 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "secret" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 44008 ... adding new socket proxy address * port 44894 ... adding new socket proxy address * port 40436 ... adding new socket proxy address * port 35552 ... adding new socket proxy address * port 59182 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/freeradius/freeradius.sock Listening on status address 127.0.0.1 port 18121 as server status Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=21, length=162 server dynamic_client_server { rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x rlm_sql (sql): Reserving sql socket id: 24 rlm_sql (sql): Released sql socket id: 24 rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x rlm_sql (sql): Reserving sql socket id: 23 rlm_sql (sql): Released sql socket id: 23 rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x rlm_sql (sql): Reserving sql socket id: 22 rlm_sql (sql): Released sql socket id: 22 } # server dynamic_client_server - Added client 18.15.2.96 with shared secret wpa01 rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=21, length=162 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x0267000e01575041544553543031 Message-Authenticator = 0x23e19f9af7e17d88f9a44dc2a43a30f8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 103 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{Stripped-User-Name} -> WPATEST01 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01 [sql] sql_set_user escaped user --> 'WPATEST01' rlm_sql (sql): Reserving sql socket id: 21 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'WPATEST01' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'WPATEST01' ORDER BY priority rlm_sql (sql): Released sql socket id: 21 [sql] User WPATEST01 not found ++[sql] = notfound ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 21 to 18.15.2.96 port 39821 EAP-Message = 0x016800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8be7f3fa8b8feaec49bb7390043eac56 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=22, length=374 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x026800d01980000000c616030100c1010000bd0301c710875ecf8c341d7c1945550fbc4239200d59aaaff94bf25a57da64ae6f6db5000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011 State = 0x8be7f3fa8b8feaec49bb7390043eac56 Message-Authenticator = 0x6f447c173ae2e57d28738de915aa2076 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 104 length 208 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 00c1], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0a44], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 22 to 18.15.2.96 port 39821 EAP-Message = 0x0169040019c000000a8816030100310200002d03015602b0867fde8c9987d87d8b8f834e9f2d369fc1ea7b1ab97c09196b5f116ab6000035000005ff010001001603010a440b000a40000a3d0004fb308204f7308203dfa003020102020101300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a060355040313 EAP-Message = 0x23496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323031335a170d3235303930363133323031335a307c310b300906035504061302495431123010060355040813094c6f6d626172646961311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3110300e06035504031307465220636572743128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100a4afeca0af0c867558f514da8309f7cf1a2a772738c3c0e0fd9e EAP-Message = 0x4b83717de37e6fc95c6a00afc83ccd3d5a980c6ae732fccd004aea22afa08826f1419e012553054eafa018dd201f6591a5c5a78da76010fe30d1dd1d28956bb7f393b2ca66373f34cf3a2eebd81854ef8173eb801b149c209808a871a16ad279ef8f08b849eafb80f129a4010e1a4f7617168edfcec40dd4a1a928a06205fe85f7f25234b8f1947beaf29be481dc8719d38294c81ef9f6e42cc223286a3edeb4b5fe9eb064e9cce2e7d79eb9a0c95534553c89b7567e311602900011fb6a9227b85b191ebcd3fa152f7bd504f4bc862b551b7661f07b0de5c543c6e3d2c24f086b3c96e92c56970250840eff1d261e29ec8109f75c4d198a5115612101 EAP-Message = 0x884de35e51d349512874a73ff8ea1fcf390035ac5d044dfa2fce3f77979b61f634cf228ab9fa28680adad86952c50bf05730bc9b73c9cbdec210659b3e6bfc738797f810c6c0203159805b0e0f3d87a86c62ba7800fa3a30e7c2d2c506a47a88b13970f2fbf2cf5a0b64a601a8f5ffb640a6368f95fe21e793c5ce64b48130365cdbd3c190c21829ee4823667e607f18d251bc214251bf1b16f290644f14b590757500b694266a81ee784bd55472eb6e9a052daf4328f30b973adabcd8913fedd1140e7b8fdd7f81f4ea429393cd685cd9d50fa9f6028493c7b0cf2b4ce8fc87801ffa2becde0be62d0203010001a34f304d30130603551d25040c300a EAP-Message = 0x06082b060105050703013036 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8be7f3fa8a8eeaec49bb7390043eac56 Finished request 1. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=23, length=172 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x026900061900 State = 0x8be7f3fa8a8eeaec49bb7390043eac56 Message-Authenticator = 0xdf899447a17ff487fd72c74230d2b448 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 105 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 23 to 18.15.2.96 port 39821 EAP-Message = 0x016a03fc19400603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010063fd16c3ec75c7e00d8e15c07929d20f75430b2ae796be3bea47ee94075f94c69ab384cd359b73f0e9f70040e5fddf7075c62cefd4f9ec416ea544105b9ee1b179a2c66c99adfeea1dc55b8f7a50c2619bfb22b8ef5a081c8a9c821bf7d609b3aea8c7dce6e8a936a98c29ebb1e9e8e3ec8ff98e62429c0a536d56f1829229c9f1cc73a9420a8babc7e090472b91b7899c898df93e1f180ed2d4e10c07e7ae2b15d56f86c425928e929c1df694 EAP-Message = 0x8481a70cfeee2a035fa1dd513cab51319b11cdcae1e0947348a89905694c65c9d81cc8372ba4ad15f78e6f05c7eee90a9b4c47542f401ccc646d97460f6fd51ae316718406630f8999c30f80f01dc3c7f3130300053c3082053830820420a003020102020900f36684f36b9057e7300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172 EAP-Message = 0x652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323030385a170d3235303930363133323030385a3081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520 EAP-Message = 0x417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d2da114e3c65d1a6d5af105f21e12a6e10f8f563bef1dcc697bdb47d41e2382bcbc78e661170ca75c488a79f17bf9b3917b41779c6f7c5c76bbb34d8c00bbfc4cdcac10131216d120495fbd475275adfcb950c447f0e70852120760b6fc3979fb810fdd0af3d6b611317c3f2582abb6bad7c320fac36317c011027908fdb8ae803abaed0ac8b2d03c5fe313ccec14845a7818a1c13b83646b8f4a5ae2cd0d745b7d65dbd9bb81dc3a861caa48bd67e5a02aa0445e01c5c19667b466077d9fb4100f58f78b149288459cc16ae484cebed6891ba EAP-Message = 0x3b5d949a7f258f97 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8be7f3fa898deaec49bb7390043eac56 Finished request 2. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=24, length=172 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x026a00061900 State = 0x8be7f3fa898deaec49bb7390043eac56 Message-Authenticator = 0xa440bf143ec9e6c26c28d8391d02a978 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 106 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 24 to 18.15.2.96 port 39821 EAP-Message = 0x016b02a21900f2a1fd1b024e31eda43d00c39a8957a21d16c384ba6f1c63be668c3abc95085b6bb71ec2690203010001a38201513082014d301d0603551d0e04160414279a85d9f9cf9f8457de3c73852d320e2db97dcf3081e50603551d230481dd3081da8014279a85d9f9cf9f8457de3c73852d320e2db97dcfa181b6a481b33081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e6176 EAP-Message = 0x69676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479820900f36684f36b9057e7300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010042885b349b6b9cd176de3c166109cac40e03a3e01a0b4c6dada2fdea3d768ec6d05499cceeb5c12840ec273d6294187f5951580755b89f4373e0b8cdea5c03709356e7e3f452faaca711084daa283d4a4fca87a13fa6c956eac1a34a1e2e22e0dc EAP-Message = 0x67c494914cca1cf6973b176665a630e5488c37707f1cdfe6ee4e43dfac65c13556df847fdc301f2ae0d71740ec3ad962f623e53865c510ab3f67f4c9d3fce9051610882c4244ec103dbd379e8e5dfc7a53dd4d839a6ee2d248e70ed1e69d1bfc77e1f2efd78b016f30ac2d6da9c9ac01366b69f6248f737463b9634ecb9b512dcd9e13cfe4683a57f5fedc49b98ce2d0dbb37b4e6627dd804f7a543a6680e416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8be7f3fa888ceaec49bb7390043eac56 Finished request 3. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=25, length=762 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x026b02501980000002461603010206100002020200044154ee5dd5a7a703e9a12246cfaf05f8f9073178356fc1089cab52609e78c805911540cd4cdc68c9761b6d41af05104b84b2f38bda64b0e52bc0d10ed64ad35fe3920fa5c6030cfa66d7dc25a24e324417dea12829de39425719faa49e2c5927a1db68e3e99198c03b93943afdcd0654371c7e8aa886ea996d00fa2d9ae830c01dee85cd42f979cb6af349a59deff53c74808fced7d6864691b43fb1a6eacded1baacb6d31837839c192276f32c8cf9fbabcd78d502d8310064daeb9a8d59406b192bc8608e49212b18a633f0da2ed355bb0b3e305ea6251dc200c7ec9dd88303e9fefca7822f5 EAP-Message = 0xc7dde6ae460a4e8697cee9d1a918f0b3498c8255373ab7cc8231f412a3a0665ffed1b065e0e76d5b4d118f7c8a2e17c7d9d5b0e800fe23332c993fdc6345cd79946f5f857569b6720e4c7a0cd36844f3a5e234c520cdb806d73530b724fafc3a0eda613689082a82e57b07e8504fb3c1a14b184a45ffd9adc5f471ab23e20192e8859fcdc99ca43e552f55876f6abc4cee8ce181cfcd576f36dc83a2bf5a8a33dfec51b746b8ea8ede9696a9502d236ed7fd98de7a2cdccf401ea51749874c1ad692dc9ef19400fa2857d7ba35c1dd0a1acdab294c7a80aa049e4bd1721fb1df2bae7d0026b89c1fe69e895f6ac2d04911a15be0014da0ed395f8bda60 EAP-Message = 0xea725490158670bfbcb30938a730dce3245c941ebb75ac8c6f8f331403010001011603010030deca47943704a7bbbb320eaba31d4658446217d4e3b2dea8c317d20463d241a76a5e5fe208b72b2bab182ce6d49c128f State = 0x8be7f3fa888ceaec49bb7390043eac56 Message-Authenticator = 0x4c10f7b2c345b19e8e590332a99b4dcf # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 107 length 253 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 582 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 25 to 18.15.2.96 port 39821 EAP-Message = 0x016c004119001403010001011603010030b756af8e04ec1177da7cdba3a8e46ce9c9a03753f3ed6de7041c7851249ba593ad8e4ca087a8a12e0c0837eef32ef7e2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8be7f3fa8f8beaec49bb7390043eac56 Finished request 4. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=26, length=172 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x026c00061900 State = 0x8be7f3fa8f8beaec49bb7390043eac56 Message-Authenticator = 0x7f95d93bb8a3e3680d805e01ef24c433 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 108 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 26 to 18.15.2.96 port 39821 EAP-Message = 0x016d002b19001703010020e0a71dcaf1dd947689d81035169b60f8edc2f23a6d623dc0b5bf36882e084778 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8be7f3fa8e8aeaec49bb7390043eac56 Finished request 5. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=27, length=209 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x026d002b19001703010020e6c9ea37a34dcf8b44c72525c4da21e5ed75a845d5936b83fef1f2be29ae9a5f State = 0x8be7f3fa8e8aeaec49bb7390043eac56 Message-Authenticator = 0x9de3d03912efbbc6f557c3db393fdee9 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 109 length 43 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - WPATEST01 [peap] Got inner identity 'WPATEST01' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x026d000e01575041544553543031 server { [peap] Setting User-Name to WPATEST01 Sending tunneled request EAP-Message = 0x026d000e01575041544553543031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "WPATEST01" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok ++update control { ++} # update control = noop [eap] EAP packet type response id 109 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{Stripped-User-Name} -> WPATEST01 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01 [sql] sql_set_user escaped user --> 'WPATEST01' rlm_sql (sql): Reserving sql socket id: 20 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'WPATEST01' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'WPATEST01' ORDER BY priority rlm_sql (sql): Released sql socket id: 20 [sql] User WPATEST01 not found ++[sql] = notfound ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] = handled +} # group authenticate = handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x016e00231a016e001e101e157a2b3c0548f7806819a21b8d5ada575041544553543031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x82d2aee482bcb4d70ca1911950ec56f8 [peap] Got tunneled reply RADIUS code Access-Challenge EAP-Message = 0x016e00231a016e001e101e157a2b3c0548f7806819a21b8d5ada575041544553543031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x82d2aee482bcb4d70ca1911950ec56f8 [peap] Got tunneled Access-Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 27 to 18.15.2.96 port 39821 EAP-Message = 0x016e004b19001703010040935a24ed0f4bae1413743c3c1b8465b26dce8b4e54d8733277feea035324317e2359d7b7a04e62922331707504ccc06ecb0e5a117f1db024426116e552088fa7 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8be7f3fa8d89eaec49bb7390043eac56 Finished request 6. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=28, length=273 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x026e006b190017030100601e1924cddad42e5f82e6baceca61075e4f50cbdfcc6f32c3e34a99e966a2d6b85f427bf719dd9586019ab5eead1ad7daf21012855f3143d8d8bc338271dec31828a34ce5924e2b0a8c9668c9d67f719f7466cbfd25edb67b411f2c76e6384501 State = 0x8be7f3fa8d89eaec49bb7390043eac56 Message-Authenticator = 0x7a4043ef634f9bdb61136f3fd92a28af # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 110 length 107 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x026e00441a026e003f31c1fb03eebb1e5a69819119a42d8d19e90000000000000000d8dc46e58ebd8bd1bf2ddce64ed8debcdb8284b445e8e24900575041544553543031 server { [peap] Setting User-Name to WPATEST01 Sending tunneled request EAP-Message = 0x026e00441a026e003f31c1fb03eebb1e5a69819119a42d8d19e90000000000000000d8dc46e58ebd8bd1bf2ddce64ed8debcdb8284b445e8e24900575041544553543031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "WPATEST01" State = 0x82d2aee482bcb4d70ca1911950ec56f8 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok ++update control { ++} # update control = noop [eap] EAP packet type response id 110 length 68 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{Stripped-User-Name} -> WPATEST01 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01 [sql] sql_set_user escaped user --> 'WPATEST01' rlm_sql (sql): Reserving sql socket id: 19 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'WPATEST01' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'WPATEST01' ORDER BY priority rlm_sql (sql): Released sql socket id: 19 [sql] User WPATEST01 not found ++[sql] = notfound ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +group MS-CHAP { [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: WPATEST01 [mschap] Client is using MS-CHAPv2 for WPATEST01, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject +} # group MS-CHAP = reject [eap] Freeing handler ++[eap] = reject +} # group authenticate = reject Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> WPATEST01 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "nE=691 R=1" EAP-Message = 0x046e0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code Access-Reject MS-CHAP-Error = "nE=691 R=1" EAP-Message = 0x046e0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 28 to 18.15.2.96 port 39821 EAP-Message = 0x016f002b19001703010020657b2b2cba09fec9c74376a57473e880bfa77238cbbeff27c1343c2263eca983 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8be7f3fa8c88eaec49bb7390043eac56 Finished request 7. Going to the next request Waking up in 4.2 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=29, length=209 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x026f002b19001703010020ec79e2545ad2b1cfe636917063ef7b711f0fa14c6d8457b069aa058c5906bb8a State = 0x8be7f3fa8c88eaec49bb7390043eac56 Message-Authenticator = 0x3fb015ef305a7eac9cb158c63a9b3d9d # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 111 length 43 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> WPATEST01 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 29 to 18.15.2.96 port 39821 EAP-Message = 0x046f0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=30, length=162 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x0223000e01575041544553543031 Message-Authenticator = 0x87cd6a9e4c9564d7e3ed4521d116b50b # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 35 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{Stripped-User-Name} -> WPATEST01 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01 [sql] sql_set_user escaped user --> 'WPATEST01' rlm_sql (sql): Reserving sql socket id: 18 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'WPATEST01' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'WPATEST01' ORDER BY priority rlm_sql (sql): Released sql socket id: 18 [sql] User WPATEST01 not found ++[sql] = notfound ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 30 to 18.15.2.96 port 39821 EAP-Message = 0x012400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9aa5a94f9a81b08af2138422daf6c105 Finished request 9. Going to the next request Waking up in 0.5 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=31, length=374 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x022400d01980000000c616030100c1010000bd0301f3bda01eda9f2d175e6217aa9d9da118a9134dfc2ce3144cf19c790fb65f7de0000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011 State = 0x9aa5a94f9a81b08af2138422daf6c105 Message-Authenticator = 0x2154e0dfbfe0c524d846bbbe4d9f8c3e # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 36 length 208 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 00c1], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0a44], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 31 to 18.15.2.96 port 39821 EAP-Message = 0x0125040019c000000a8816030100310200002d03015602b08a76325520a8c3e5889521fef23ce8edf0c8f14f225469b1157c6b6aae000035000005ff010001001603010a440b000a40000a3d0004fb308204f7308203dfa003020102020101300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a060355040313 EAP-Message = 0x23496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323031335a170d3235303930363133323031335a307c310b300906035504061302495431123010060355040813094c6f6d626172646961311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3110300e06035504031307465220636572743128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100a4afeca0af0c867558f514da8309f7cf1a2a772738c3c0e0fd9e EAP-Message = 0x4b83717de37e6fc95c6a00afc83ccd3d5a980c6ae732fccd004aea22afa08826f1419e012553054eafa018dd201f6591a5c5a78da76010fe30d1dd1d28956bb7f393b2ca66373f34cf3a2eebd81854ef8173eb801b149c209808a871a16ad279ef8f08b849eafb80f129a4010e1a4f7617168edfcec40dd4a1a928a06205fe85f7f25234b8f1947beaf29be481dc8719d38294c81ef9f6e42cc223286a3edeb4b5fe9eb064e9cce2e7d79eb9a0c95534553c89b7567e311602900011fb6a9227b85b191ebcd3fa152f7bd504f4bc862b551b7661f07b0de5c543c6e3d2c24f086b3c96e92c56970250840eff1d261e29ec8109f75c4d198a5115612101 EAP-Message = 0x884de35e51d349512874a73ff8ea1fcf390035ac5d044dfa2fce3f77979b61f634cf228ab9fa28680adad86952c50bf05730bc9b73c9cbdec210659b3e6bfc738797f810c6c0203159805b0e0f3d87a86c62ba7800fa3a30e7c2d2c506a47a88b13970f2fbf2cf5a0b64a601a8f5ffb640a6368f95fe21e793c5ce64b48130365cdbd3c190c21829ee4823667e607f18d251bc214251bf1b16f290644f14b590757500b694266a81ee784bd55472eb6e9a052daf4328f30b973adabcd8913fedd1140e7b8fdd7f81f4ea429393cd685cd9d50fa9f6028493c7b0cf2b4ce8fc87801ffa2becde0be62d0203010001a34f304d30130603551d25040c300a EAP-Message = 0x06082b060105050703013036 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9aa5a94f9b80b08af2138422daf6c105 Finished request 10. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=32, length=172 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x022500061900 State = 0x9aa5a94f9b80b08af2138422daf6c105 Message-Authenticator = 0xc30fd4d1c8fbe3b53ad945b481066afc # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 37 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 32 to 18.15.2.96 port 39821 EAP-Message = 0x012603fc19400603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010063fd16c3ec75c7e00d8e15c07929d20f75430b2ae796be3bea47ee94075f94c69ab384cd359b73f0e9f70040e5fddf7075c62cefd4f9ec416ea544105b9ee1b179a2c66c99adfeea1dc55b8f7a50c2619bfb22b8ef5a081c8a9c821bf7d609b3aea8c7dce6e8a936a98c29ebb1e9e8e3ec8ff98e62429c0a536d56f1829229c9f1cc73a9420a8babc7e090472b91b7899c898df93e1f180ed2d4e10c07e7ae2b15d56f86c425928e929c1df694 EAP-Message = 0x8481a70cfeee2a035fa1dd513cab51319b11cdcae1e0947348a89905694c65c9d81cc8372ba4ad15f78e6f05c7eee90a9b4c47542f401ccc646d97460f6fd51ae316718406630f8999c30f80f01dc3c7f3130300053c3082053830820420a003020102020900f36684f36b9057e7300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172 EAP-Message = 0x652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323030385a170d3235303930363133323030385a3081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520 EAP-Message = 0x417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d2da114e3c65d1a6d5af105f21e12a6e10f8f563bef1dcc697bdb47d41e2382bcbc78e661170ca75c488a79f17bf9b3917b41779c6f7c5c76bbb34d8c00bbfc4cdcac10131216d120495fbd475275adfcb950c447f0e70852120760b6fc3979fb810fdd0af3d6b611317c3f2582abb6bad7c320fac36317c011027908fdb8ae803abaed0ac8b2d03c5fe313ccec14845a7818a1c13b83646b8f4a5ae2cd0d745b7d65dbd9bb81dc3a861caa48bd67e5a02aa0445e01c5c19667b466077d9fb4100f58f78b149288459cc16ae484cebed6891ba EAP-Message = 0x3b5d949a7f258f97 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9aa5a94f9883b08af2138422daf6c105 Finished request 11. Going to the next request Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=33, length=172 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x022600061900 State = 0x9aa5a94f9883b08af2138422daf6c105 Message-Authenticator = 0xec9b1d5c4dc6e45d991d320069e814e2 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 38 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 33 to 18.15.2.96 port 39821 EAP-Message = 0x012702a21900f2a1fd1b024e31eda43d00c39a8957a21d16c384ba6f1c63be668c3abc95085b6bb71ec2690203010001a38201513082014d301d0603551d0e04160414279a85d9f9cf9f8457de3c73852d320e2db97dcf3081e50603551d230481dd3081da8014279a85d9f9cf9f8457de3c73852d320e2db97dcfa181b6a481b33081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e6176 EAP-Message = 0x69676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479820900f36684f36b9057e7300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010042885b349b6b9cd176de3c166109cac40e03a3e01a0b4c6dada2fdea3d768ec6d05499cceeb5c12840ec273d6294187f5951580755b89f4373e0b8cdea5c03709356e7e3f452faaca711084daa283d4a4fca87a13fa6c956eac1a34a1e2e22e0dc EAP-Message = 0x67c494914cca1cf6973b176665a630e5488c37707f1cdfe6ee4e43dfac65c13556df847fdc301f2ae0d71740ec3ad962f623e53865c510ab3f67f4c9d3fce9051610882c4244ec103dbd379e8e5dfc7a53dd4d839a6ee2d248e70ed1e69d1bfc77e1f2efd78b016f30ac2d6da9c9ac01366b69f6248f737463b9634ecb9b512dcd9e13cfe4683a57f5fedc49b98ce2d0dbb37b4e6627dd804f7a543a6680e416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9aa5a94f9982b08af2138422daf6c105 Finished request 12. Going to the next request Waking up in 0.2 seconds. rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=34, length=762 User-Name = "WPATEST01" NAS-IP-Address = 192.168.1.29 Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "C4-9A-02-0F-0C-36" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x0227025019800000024616030102061000020202005b95bea6ad27a5e0714d0a929aa0614eb79efdbf330b5dc7b4e576245920e7e7788b1e49c90b470df73b080522f3e87a092989bb4cb1b08141242e5553956d9ce7bae1edd6caa72d38e1e71fc0c31537d34416e61896f526bb6f3e54806c82be09b677c195e0370d457508cd4645da3d36aa49694bd823d558bd2147791952a3591d94e237ea064c239aca10491bb42aac6189fee8ca802e0696dc6a449b6aaa05c05743c44b04b9001f0e44afec187c5ced8b874348b049f59d66e60df7677a2ded62f36b79c3402b992e26db94af11d24838af81cc8f0909288de9f422640715f986aebb733c00 EAP-Message = 0x61407139a59d56bd2b6ff25184b217953d5d9f09a30bb08b36b1c916efd50b5eac799aee9f2219340c8e6742b188fee88dfe45c6cc99ad8e6cd76b7d0aaf6479ffff78b34600b30707c548b73d317366a646bd2a5949a70029f78fe114b2743fb87858eec21eaa1ddfa7e5ce24c7142d1f792e0a34c9429259638bcd82624f9a714a7a08458b09e15f8ebb526c2801ad411f4e0698d8ee5420b4189d69869ded275996a499f3e83fed4d10f99de7c901b83642e301ae1abba4be4496579ca775779b6e47ee2bf32c5886048304b939a857547e02363ce1acd662832bba56a8eae2dcbe0c56d4bf7209599240699b678fefdc0b1b8dab4c7e2febaae634 EAP-Message = 0x139d2a88fef4f660cc7ff33c613d0ff82945ee2a1c0b3fefdb070714030100010116030100305fb335cd650dee58c3d0e72bcd2cebaf2ad9be9771711d8f711b5dd5e3af7deb8ac4ce2d6525a06abd5a50e3b7233291 State = 0x9aa5a94f9982b08af2138422daf6c105 Message-Authenticator = 0x2a906c40a10f593908e3b85e32b9f718 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "WPATEST01" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] EAP packet type response id 39 length 253 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 582 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 34 to 18.15.2.96 port 39821 EAP-Message = 0x012800411900140301000101160301003070615ca22fe998758237eba6df7204ae366aa0d4d0be6576fe3c8766df683cc749120cdbd7d5c965ed280783bc692e52 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9aa5a94f9e8db08af2138422daf6c105 Finished request 13. Going to the next request Waking up in 0.1 seconds. -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it YetOpen S.r.l. - http://www.yetopen.it/

3 5

attr_filter: remove everything, except the avps1,avp2,..
by Jorge Pereira 24 Sep '15

24 Sep '15

Hi, Always when I need to remove some avp from a list, I do something like. update <list> { <avp1> !* ANY <avp2> !* ANY ....... } But, I would like to know if exist some way to do in an inverted match. something like "remove everything, except the avps1,avp2,..." -- Jorge Pereira

3 2

AW: google authenticator and commercial otp
by the2nd 24 Sep '15

24 Sep '15

In a few months you may use OTPme (http://www.otpme.org) The current version does not support OATH tokens but the next version will. I successfully tested HOTP and TOTP tokens like the yubikey or google authenticator. Freeradius integration is done via rlm_python. If you want to keep otpd and want to write your own freeradius module you may have a look at the otpme module. It should be a good starting point. Regards the2nd <div>-------- Ursprüngliche Nachricht --------</div><div>Von: Michael A Hawkins <mhawkins.consultant(a)gmail.com> </div><div>Datum:09.23.2015 18:39 (GMT+01:00) </div><div>An: freeradius-users(a)lists.freeradius.org </div><div>Betreff: google authenticator and commercial otp </div><div> </div>Alan said, "There are a number of commercial ones which work. The google authenticator also works." Commercial means I usually (almost always) can't use my own tokens sourced from my own token supplier. I liked it that otpd allowed me to source tokens from wherever I wanted. All I needed was a supplier with a cost effective token and a supplier willing to supply me with the seeds too. Commercial suppliers usually lock you into their tokens, their servers, their solution or all of the above. google authenticator doesn't fit in my wallet. I've always believed that the least likely item to be lost or misplaced by a user is their own wallet. Cell phones, not so much. A users wallet contains stuff that is far more important than a cell phone. Cell phones get lost, stolen far more often than wallets. If rlm_otp is to be removed. Against which module would I rewrite otpd so that it could continue to work with freeradius? From googling, it looks like alot of other otpd solutions out there use a perl module to interact with freeradius. Is that the only way? Is there a better way? Thanks again, Mike - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

google authenticator and commercial otp
by Michael A Hawkins 23 Sep '15

23 Sep '15

Alan said, "There are a number of commercial ones which work. The google authenticator also works." Commercial means I usually (almost always) can't use my own tokens sourced from my own token supplier. I liked it that otpd allowed me to source tokens from wherever I wanted. All I needed was a supplier with a cost effective token and a supplier willing to supply me with the seeds too. Commercial suppliers usually lock you into their tokens, their servers, their solution or all of the above. google authenticator doesn't fit in my wallet. I've always believed that the least likely item to be lost or misplaced by a user is their own wallet. Cell phones, not so much. A users wallet contains stuff that is far more important than a cell phone. Cell phones get lost, stolen far more often than wallets. If rlm_otp is to be removed. Against which module would I rewrite otpd so that it could continue to work with freeradius? From googling, it looks like alot of other otpd solutions out there use a perl module to interact with freeradius. Is that the only way? Is there a better way? Thanks again, Mike

2 1

otpd - resurrecting
by Michael A Hawkins 23 Sep '15

23 Sep '15

A: Adam Bishop - version - radiusd: FreeRADIUS Version 2.2.0 - while I think that later versions are always a good thing. I don't think the FreeRadius version is the culprit. Thanks for the pointer on debugging with GDB. A: Stefan Paetow - SElinux is off, thanks for su --shell=/bin/bash -l radiusd otptest (!!). A: Alan DeKok - I get it. Don't bother, go find another otp, I am not a serious programmer. Well, I already use multiple other otp's and write code in multiple languages for multiple platforms. So if someone can recommend an otpd package that is GPLv2, supports any OATH compliant token and will work with FreeRadius after rlm_otp is removed, I am interested. Meanwhile, I've written enough C to fix otpd several times in the past and probably won't give up just yet. Or to put it the question another way, what otp package are you recommending for use with FreeRadius? Thanks to all for the rapid and detailed responses. I have some work to do. PS: I used the phrase "mess with" as a colloqialism for "seriously applied proper programming and maintenance techniques to adjust the package to compile, link, make and install without error or warning under Fedora". Now back to fixing my first LINUX segfault. Cheers! /Mike

2 1

Set proxy port in Freeradius 3.0.4
by Brad 23 Sep '15

23 Sep '15

Hi All, I have seen previous discussions about proxy port 1814 for previous versions 1x and 2x. With the latest 3 version the proxy seems to use ephemeral ports instead of 1814. In etc/raddb/sites-available/default I added a listen for proxy: listen { ippaddr = * port = 1814 type = proxy limit { } } But got an error about adding the proxy listen in a virtual server area. Can someone please direct on the appropriate file location to place the listen or set the proxy port? Thanks, Brad

2 3

otpd - resurrecting it
by Michael A Hawkins 23 Sep '15

23 Sep '15

I am trying to resurrect otpd, a GPL fork is here "https://code.google.com/p/otpd/. I like this thing because it allows me to run my own OTP service with OATH compliant event based tokens of almost any kind. I never got any time based tokens working and I don't really care. Years ago, I got otpd working by running it as radiusd so that FreeRadius could interact with it. This required setting all rights on all otpd related files and /var/run/otpd/socket to be owned and perm'd for radiusd. I don't know enough about LINUX to know why radiusd had to run otpd but I do remember that no matter what I did, if radiusd did not have rights to /var/run/otpd/socket then FreeRadius was always denied permission when attempting to interact with otpd. Compiling the otpd code was also a challenge because I mostly run Fedora and C files, ./configure and make files all had to be messed with. But I managed. The problem I face now though is that if I do everything I originally did as above I get all the way to authenticating and freeradius always fails the authentication and otpd seg faults. otptest executable works just fine (while running as user otpd, I haven't worked out how to use radiusd while running otptest. I always get... [root@HP-LAB-1 otpd]# su -l radiusd otptest This account is currently not available. I can use tokens and confirm that otpd is working with otptest if and only if I use root while otpd itself is running as root. The major changes that I used to make to FreeRadius configuration was: 4. Now edit the /etc/raddb/sites-available/default file and add a single line with text “otp” inside of both the authorize and authenticate sections. 5. Now add the same “otp” entries into the same sections found in the file /etc/raddb/sites_enabled/inner-tunnel. 6. Restart radiusd with “service radiusd restart”. I added otp to default and inner-tunnel like below (right underneath the heading: authorize { otp ... } authenticate { otp ... } Executing radtest... [mhawkins@HP-LAB-1 bNAC]$ radtest test1 885115 localhost 10 testing123 Sending Access-Request of id 84 to 127.0.0.1 port 1812 User-Name = "test1" User-Password = "885115" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=84, length=20 Debug from freeradius looks like... rad_recv: Access-Request packet from host 127.0.0.1 port 37633, id=84, length=75 User-Name = "test1" User-Password = "885115" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 Message-Authenticator = 0x54ce669945c80bffd886fce32b90a76a # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} rlm_otp: otp_pwe_present: password attributes 2, 2 ++[otp] returns ok ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = otp # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} rlm_otp: otp_pwe_present: password attributes 2, 2 ++[otp] returns fail Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 84 to 127.0.0.1 port 37633 Waking up in 4.9 seconds. Cleaning up request 6 ID 84 with timestamp +858 Ready to process requests. All of the above results in otpd still running. But if I run radtest once more... otpd segfaults and leaves the /var/run/otpd/socket inaccessible by radiusd. I can see that otpd passes the authentication but freeradius doesn't see it. Sep 22 22:16:59 HP-LAB-1 otpd[9352]: accept_thread: plugin accept fd=8 Sep 22 22:16:59 HP-LAB-1 otpd[9352]: work_thread(140561874147072,8): handling plugin request for [test1] Sep 22 22:16:59 HP-LAB-1 otpd[9352]: verify: user [test1] authentication succeeded So I don't know why FreeRadius is failing the authentication and I don't know why otpd is segfaulting (this is the first time I've ever had to work on an executable that does that). Any help or hints on how to solve or troubleshoot this would be *VERY* much appreciated. /Mike Hawkins

4 3

dynamic home server
by Jorge Pereira 23 Sep '15

23 Sep '15

Hi, Someone know if is possible to setup a home-serverpool dynamically?

2 2