- Freeradius-Users - lists.freeradius.org

Authentication MS SQL Server 2008
by Andrés Gómez 09 Sep '15

09 Sep '15

Hi everyone. I have a list of authorized users stored in a Microsoft SQL Server 2008. My Freeradius system is installed on a Linux server, and I want to store the accounting (radacct table) data in my Linux server (mysql). can freeradius ask to Microsoft SQL Server 2008 to authorize an user? How can I do it? I have searched and I only get information abut how to store accounting data ina a ODBC database, but its not my case. Regards, -- *C. Andrés Gómez R.*

2 1

Realm Strip
by Dennis Xu 09 Sep '15

09 Sep '15

This is our setup: we put a FreeRadius version 2.1.10 on Ubuntu in front of the Cisco ACS 5 and we need the FreeRadius to strip the suffix starting from @ and just pass the username to ACS 5 for authentication(with AD). We use PEAP MS-CHAPv2. It did not work. ACS5 still sees the whole username(i.e, dxu(a)uoguelph.ca) with the suffix. I added the following to the proxy.conf file: realm uoguelph.ca { type = radius authhost = acs5-test2.uoguelph.ca:1812 accthost = acs5-test2.uoguelph.ca:1813 secret = testing123 } I added followings to the radiusd.conf file: realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } authorize { preprocess mschap suffix eap files } authenticate { Auth-Type MS-CHAP { mschap } eap } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } Did I miss anything? Does FreeRadius strip the realm for both inner and outer IDs for peap authentication? Thank you for your help! --- Dennis Xu, MASc, CCIE #13056 Analyst 3, Network Infrastructure Computing and Communications Services(CCS) University of Guelph 519-824-4120 Ext 56217 dxu(a)uoguelph.ca www.uoguelph.ca/ccs

2 2

User authentication - users config file and MySQL databases
by Alexandre Oliveira 09 Sep '15

09 Sep '15

Hello all, I would like to transfer all the configured users in the users in the users con file to MySQL database, it is possible? I’ve configured Radius to work with MySQL and created a test user, teste, in radcheck database with a test password, teste. Follow the entry: username - teste attribute - cleartext-password op - := value - teste I also created an entry in radreply database. Follow the entry: username - teste attribute - fall-through op - = value - yes For this test all other databases are empty. I’ve stated free radius in debug mode to see if there were any erros, but there weren’t. Follow the log output: root@Ubuntu-Radius-Server:~# tail /var/log/freeradius/radius.log Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #2 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #3 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #4 Tue Sep 8 23:53:00 2015 : Info: Loaded virtual server inner-tunnel Tue Sep 8 23:53:00 2015 : Info: ... adding new socket proxy address * port 52669 Tue Sep 8 23:53:00 2015 : Info: Ready to process requests. After Freeradius server was running I testes if the user from radcheck database was going to be authenticated, and it wasn’t. I received a Rejected Message, as follow. Sending Access-Request of id 47 to 127.0.0.1 port 1812 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=47, length=20 Neither the debug or log shown if Freeradius was searching for his user in the users config file or in radcheck database. Since in Freeradius documentation states that if the user is not found it is rejected, I’m presuming that the user was not found. Although it is not clear if Freeradius is searching only in the users config or if it is searching also in radcheck database. Is is possible to add to the debug or in the log file where is Freeradius searching for he user? when I tested the authentication with an user, teste1, configured in the users config file, the authentication was accepted. root@Ubuntu-Radius-Server:~# radtest teste1 teste localhost 1812 testing123 Sending Access-Request of id 2 to 127.0.0.1 port 1812 User-Name = "teste1" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=2, length=20 I didn’t found in radiusd.conf o in sql.conf files a way to configure Freeradius to search it to use the radcheck database to authenticate the users. Is it possible to configure it? Thanks for the help. Regards Alex

1 0

Let FreeRADIUS ignore a request from rlm_perl
by Harm van Tilborg 09 Sep '15

09 Sep '15

Hey there, I'm using FreeRADIUS Version 2.2.8 and am wondering whether it is possible to ignore a request (i.e. send no reply at all) inside a rlm_perl module. I tried returning either RLM_MODULE_NOOP, RLM_MODULE_INVALID, RLM_MODULE_FAIL, and RLM_MODULE_HANDLED (without setting any reply attributes) inside an authenticate function. Although, in the end, they all result in the server rejecting the request, which is not what I want. How can I achieve this? -- Harm

4 5

Radius and MYSQL
by Alexandre Vilarinho 08 Sep '15

08 Sep '15

Hello all I'm new at Radius and I'm trying do configure Radius do authenticate the user from MYSQL databank. I configured the user in the user configuration file and it is working correctly, follow the configuration of the user. teste1 Cleartext-Password := "teste" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=1", Cisco-AVPair = "shell:cmd=show", Cisco-AVPair = "shell:cmd=show privilege" For this user I would like to configure a group in MYSQL called Privilege Level 1 and add it to that group. The Privilege Level 1 group should have the following configuration: Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=1", Cisco-AVPair = "shell:cmd=show", Cisco-AVPair = "shell:cmd=show privilege" The user should have have the following configuration: teste1 Cleartext-Password := "teste" I've already installed MYSQL database and it is also integrated with Radius. I've followed the following explanation webpage tutorial - guide/SQL HOWTO I think that mysql databank and databases are correct and integrated with Radius. I didn't find any tutorial for beginners that explain step-by-step what should be done to configure the user group and the user. Can anyone explain to me how I can configure the user and the group? Regards Alex

2 5

ascend-data-filter in freeradius v3.0.x - interaction with RFC6929?
by Vereecke, Katrien (Katrien) 08 Sep '15

08 Sep '15

Hello, I am using the freeradius-server version V3.0.x and have the problem that the data specified in the users file for the Ascend-Data-Filter attribute (from the Ascend vendor space) is not correct sent in the radius access-accept msg. Is this related to the rfc6929 extended-attribute 242 that I need to do something specific, the Ascend-Data-filter is sent as part of the vendor space Ascend(=529), so there is no conflict with the 242 extended-attribute of rfc6929? My users file contains the following: Ascend-Data-Filter = 0x01010100010203040a0b0c0d05200600000504d2020200000000000000000000, The radius output is : (12) Sent Access-Accept Id 222 from 138.203.10.191:1812 to 138.203.10.123:64397 length 0 .... (12) Alc-Default-Router = 10.50.2.1 (12) Ascend-Data-Filter = 0x (12) Class = 0x41444d494e31 (12) Finished request Waking up in 4.9 seconds. (12) <done>: Cleaning up request packet ID 222 with timestamp +184 Ready to process requests My wireshark shows for the ascend-data-filter the following " 1a 28 00 00 02 11 f2 22 20 27 7a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" In a previous version of freeradius V2.1.12. this is working fine, but I stepped up to version V3.0.8 to have support for the radius extensions RFC6929. Thanks, Regards, Katrien.

2 2

unixODBC errors - undefined symbol:get_vtable
by Mohamed Imran (NBI) 08 Sep '15

08 Sep '15

Hi all, I've installed freeradius (built from source version: freeradius-server-3.0.9) on Centos 6.7 and am trying to get it to talk to our MS SQL servers (using unixODBC and FreeTDS driver) to lookup a mac address etc. as part of the post-auth process but not having much success. Running radius -X shows the following error: rlm_sql_unixodbc: 01000 [unixODBC][Driver Manager]Can't open lib '/usr/lib64/libtdsodbc.so' : ??vb??: undefined symbol: get_vtable rlm_sql_unixodbc: SQL down 08003 [unixODBC][Driver Manager]Connnection does not exist rlm_sql_unixodbc: Can't allocate the stmt rlm_sql_unixodbc: Socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) Has anyone else seen this issue? Any ideas on how this can be fixed? Also wondering if it's the version of unixODBC or FreeTDS im using is incompatible with this verison of freeradius. If so which version should I be using? Any help much appreciated. ================================ Environment details: ================================ OS: Centos 6.7 Freeradius: freeradius-server-3.0.9 [built from source as the repo version 3.0.3 kept throwing segmentation fault error] unixODBC: (from centos repo) Arch : x86_64 Version : 2.2.14 Release : 14.el6 FreeTDS: (from centos repo) Arch : x86_64 Version : 0.91 Release : 2.el6 ==================================== Regards, Mohamed Connect with us on: <https://twitter.com/NBIPComputing> The NBI Partnership Ltd provides non-scientific services to the <http://www.jic.ac.uk/> John Innes Centre, the <http://www.ifr.ac.uk/> Institute of Food Research, <http://www.tgac.ac.uk/> The Genome Analysis Centre and <http://www.tsl.ac.uk/> The Sainsbury Laboratory Disclaimer: This e-mail message may contain confidential information and is intended only for the use of the intended recipient(s). Any unauthorized disclosure, dissemination, distribution, copying or the taking of any action in reliance on the information herein is prohibited. E-mails are not secure and cannot be guaranteed to be error free as they can be intercepted, amended, or contain viruses. Anyone who communicates with us by e-mail is deemed to have accepted these risks. Company Name is not responsible for errors or omissions in this message and denies any responsibility for any damage arising from the use of e-mail. Any opinion and other statement contained in this message and any attachment are solely those of the author and do not necessarily represent those of the company.

2 1

Trigger EDIR-Intruder Lockout in FR3
by Anja Ruckdaeschel 08 Sep '15

08 Sep '15

Hi there, I wonder what is the designated way in FR 3.0.9 to trigger an eDirectory-Intruder Lockout with edir_autz=yes in addition? I want to use a, universal password retrieval b, grace login consumation, account expire check, password expire check, login time restrictions check, attribute checks, etc. c, intruder lockout trigger (I do a named ldap bind with the login-user with a password which is bad, if mschap rejects) in one radius config for PEAP/MSCHAPv2 with eDIR. So far, I only manage to get a and b OR a and c running. Perhaps you can give me a hint? Thank you for your time. Ciao Anja

2 3

rlm_sql and string escaping
by Unik 08 Sep '15

08 Sep '15

Hello list! I'm currently trying to port our custom GPL'ed FreeRADIUS module to 3.x. In addition to updating it to work on newer versions I tried to convert it from using our own half-assed SQL abstraction layer to rlm_sql's (using rlm_sqlhpwippool as an inspiration). While doing that I noticed that there are no DB-specific mechanisms to escape strings for use in DB queries (sql_escape_func is too strict and doesn't know about DB escaping rules). So my question is - is it ok for me to extend rlm_sql with DB-specific string escaping API, and if so, what are your suggestions and requirements for such an API? One thing to consider is that data-string-escaping and identifier -string-escaping follow different rules in several DBs. My current plan is: * Add another function pointer to rlm_sql instance (sql_string_escape_func). * Make it default to sql_escape_func. * Check if driver implements its own string escaping function, and if so, replace sql_string_escape_func with it. This implies that new function will have the same signature as sql_escape_func. -- With best regards, Alex Unigovsky mailto:unik@compot.ru Systems Administrator Maksim Co. Ltd. work: +7 495 981-0313 cell: +7 926 619-8997 23 Barishikha st. 125368 Moscow Russian Federation

1 0

EAP - Anonymous - Proxying
by Vito A. Smaldino 07 Sep '15

07 Sep '15

Hi all, i'm a FreeRadius (and related auth protocols) newbie, my final goal is to join EDUROAM (!). I'm playing starting with a stock Ubuntu 14.04 + FR 2.1.12. Following http://deployingradius.com/ i succesfully tested EAP as explained here http://deployingradius.com/scripts/eapol_test/. Then i applied some changes to configs in order to forward requests for a specific REALM (generated by eapol_test using ttls-pap), to another FR (2.0 pre cooked using ZeroShell); it didn't work! Looking at the output of freeradius -X (attached), it seems that the problem comes from the "User-Name" field that contains the value assigned by eapol_test to the "anonymous_identity" field rather than that assigned to the "identity" field; then FR isn't able to select the right destination REALM because it doesn't known anything about the effective REALM. Things work if i put the destination FR IP Address in the DEFAULT REALM, but this configuration is not acceptable for me. I known that the EAP protocol uses a fake/anonymous identity during phase 1, but until now i'm not able to understand more than this :-( Any help and suggestion will be appreciated. Attaches: - conf file used by eapol_test - Debug Output - radiusd.conf (comments and blank lines stripped out) - proxy.conf (stripped) - eap.conf (stripped) - sites-enabled/default (stripped) - sites-enabled/inner-tunnel (stripped) ====== conf file used by eapol_test network={ ssid="example" key_mgmt=WPA-EAP eap=TTLS identity="prova2(a)euclidebari.it" anonymous_identity="mickymouse" password="prova2a" phase2="auth=PAP" } ====== Debug Output FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 24 2014 at 14:57:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server server_euclide_it { ipaddr = 192.168.2.252 port = 1812 type = "auth+acct" secret = "testing123" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool pool_euclide_it { type = fail-over home_server = server_euclide_it } realm EUCLIDEBARI.IT { pool = pool_euclide_it nostrip } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.0/16 { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 52539 ... adding new socket proxy address * port 36512 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=0, length=128 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000f016d69636b796d6f757365 Message-Authenticator = 0x8f0e1b2cab6c45f749603dfb9fe3121e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 15 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.2.227 port 55621 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c24a7dd7c25b2c4284649365cf62b2b Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=1, length=424 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201012315001603010118010001140303500895fdbcbed3481e543f4718b61dca402a276ee1c5c7b47dbaf08103eb136d000082c030c02cc028c024c014c00a00a3009f006b006a0039003800880087c032c02ec02ac026c00fc005009d003d00350084c012c00800160013c00dc003000ac02fc02bc027c023c013c00900a2009e0067004000330032009a009900450044c031c02dc029c025c00ec004009c003c002f00960041c011c007c00cc0020005000400ff01000069000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011000d00 EAP-Message = 0x20001e060106020603050105020503040104020403030103020303020102020203000f000101 State = 0x7c24a7dd7c25b2c4284649365cf62b2b Message-Authenticator = 0x7618307c23dc64560c4545f5568f56d9 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0118], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 003e], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 02c8], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.2.227 port 55621 EAP-Message = 0x0102040015c000000469160301003e0200003a0301d72aa49a84707fec19955a71c223b0ddb8809fd6cce5122a2f9675df50fe62bf00c014000012ff01000100000b000403000102000f00010116030102c80b0002c40002c10002be308202ba308201a2a0030201020209008fc4031006f00775300d06092a864886f70d01010b05003015311330110603550403130a65647572756231343034301e170d3135303930353039303235345a170d3235303930323039303235345a3015311330110603550403130a6564757275623134303430820122300d06092a864886f70d01010105000382010f003082010a0282010100f2c1009b1a7294e79f5ca7 EAP-Message = 0x7cc01128a62585c8bb5c11a673bb63b34e427cf0d300a4b69d0fb69c39a017e84527deeb3b850e8c46d294db5d13843dfea0444ad7f9d0c7d499627de1c30fa4faec7ba7b91a6a12db36f3ced751b3655b75ef2e454b01d8b70c1785e9592bcee88c0bfed39e5ed7a8a75fdef14974b62775f4be2c6e67fa9e07a41e93d830ca5201238f80838f3019937e059c55dcc586aec288ee221be019d31a2f3ff403544dce69655b51dc0d994d3d96831f244bcda1b0fa746f27141dd2f79ce2f4d7a68608a5549825313a4adc48627468d6b59f9af22cb981f62bc9968198b92bfcbe05b33487e3233a854be4c26c3642f22f06d91dafbd0203010001a30d30 EAP-Message = 0x0b30090603551d1304023000300d06092a864886f70d01010b0500038201010023a54f9b6a0637be98f3187eac6b4aa0010c79692d5c0615c8a2e31554afe55124a09553666c4897a22bacd781b490899bc5a1726ab7fafa9d55db9341e77dadd93e6811940afba2787129264ea7337d4388977a88d6c07b427296ab7483d6f396c1c507955bf342fea6958dbb70a2865c210f08de87bc8739fe5158368c20fe5d161c46a3034ce26f3c762516d2e86870760cd90ebe6492112a7aa29574423f981764c535f09b635eefb66dbe2d6ad98000163edb33b91fbcd5aca82bad41127caaec3ec09e6bcdfcb21ac66c6cefe2ed559ad949c3d83fc983be17a4 EAP-Message = 0x0ea5a2f786af1fd45fd9aeca267187654809653a46ffb971a42600bcb402d95538c1f3160301014b0c0001470300174104c8a3ba662bc9069d8dadead4549b0422463d4d3492941dd4e2ccf38a9aa6431716beaa6dcf19ccb428ccf2c506b82461f83b3f0e8912a71818bc3437b423ce580100a8556000f3c354ef3feb2753922652e81cbcf594bbe8313e36ace607acb184f17f5dedf36919f3458ca6a583b2c9e474e0401eea28d50bb2239596c9a4d20ab9d44cf59d9b3ad2adbf04f2411cdeda46762f9fe8fdaa6cd91434255937f50366768f72a9bf75f6d79b68278be773be6bb6dd01c65d46a3485ffa1a7437bae0a137016da314f52d50667d EAP-Message = 0x57c13c77e0a793bcdc3bc219 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c24a7dd7d26b2c4284649365cf62b2b Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=2, length=137 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200061500 State = 0x7c24a7dd7d26b2c4284649365cf62b2b Message-Authenticator = 0xf74709dd977c95c2b2640c86b1739969 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.2.227 port 55621 EAP-Message = 0x0103007d15800000046969e584db8b5a1f010df7edbcea505a2c90151217ad9eb037080b6fcf41e4f7b24c8fec0b256bdb4ec5db293ace737a2a222a4eed091a0a6734445285374f64d8ada192c2493acd9a1e4fcc92afaaa48a79219e902ac442e08a6cf4456b26e5fb52c1fb70a1018175c7d916030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c24a7dd7e27b2c4284649365cf62b2b Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=3, length=271 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0203008c15001603010046100000424104222a353de69eeb9551f4f95c5490822c143d3d58b226f8862fbcb47d87be003124b0e5cd1cd558606740eb9c62a874a38335d43ca5d73bc239e25674f2356ca214030100010116030100307341e04e67aa3d57f7faa35ef13eb27d25564e6b398438b99058508ff8fa5fb772e5fc8292ca0d5c1be44f09249c569e State = 0x7c24a7dd7e27b2c4284649365cf62b2b Message-Authenticator = 0x6ac83dfd3eda6275d10752c19c3e0360 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 140 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.2.227 port 55621 EAP-Message = 0x0104004515800000003b14030100010116030100308c5e8e1e455e6c47ddc6b0809952b277649c52cf89acf888bbd75965ebce92e51c0b641dca8cc5b5f316018adccb425c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c24a7dd7f20b2c4284649365cf62b2b Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=4, length=259 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02040080150017030100208fae9376270446a8e7c337264836d70b0afd3cf2aa06df21f18d2367e850caa71703010050e335abefb024141930ef3a96365da9cf12d8dc57a6d04176119feb77ace448fef427911d840a4bf2bfcff577eb7ca2d97a5db81b5d2a3335d2fcee0eee096671fbd5eb1648fc92c98ec9c5a8f621f48c State = 0x7c24a7dd7f20b2c4284649365cf62b2b Message-Authenticator = 0x0ca4e41ee6414ebbd652b69cdeb714b1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 128 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "prova2(a)euclidebari.it" User-Password = "prova2a" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "prova2(a)euclidebari.it" User-Password = "prova2a" FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "euclidebari.it" for User-Name = " prova2(a)euclidebari.it" [suffix] Found realm "EUCLIDEBARI.IT" [suffix] Adding Realm = "EUCLIDEBARI.IT" [suffix] Proxying request from user prova2 to realm EUCLIDEBARI.IT [suffix] Preparing to proxy authentication request to realm "EUCLIDEBARI.IT " ++[suffix] returns updated ++[control] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mickymouse attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 4 to 192.168.2.227 port 55621 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 0 with timestamp +37 Cleaning up request 1 ID 1 with timestamp +37 Cleaning up request 2 ID 2 with timestamp +37 Cleaning up request 3 ID 3 with timestamp +37 Waking up in 0.5 seconds. Cleaning up request 4 ID 4 with timestamp +37 Ready to process requests. ====== radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ====== proxy.conf proxy server { default_fallback = no } home_server server_euclide_it { type = auth+acct ipaddr = 192.168.2.252 port = 1812 secret = testing123 status_check = status-server } home_server_pool pool_euclide_it { type = fail-over home_server = server_euclide_it } realm EUCLIDEBARI.IT { pool = pool_euclide_it nostrip } ===== eap.conf eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom CA_path = ${cadir} cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 # hours max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } mschapv2 { } } ====== sites-enabled/default authorize { preprocess chap mschap digest suffix eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } ===== sites-enabled/inner-tunnel server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { chap mschap suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } # inner-tunnel server block -- Vito A. Smaldino

2 3