- Freeradius-Users - lists.freeradius.org

EAP - Anonymous - Proxying
by Vito A. Smaldino 07 Sep '15

07 Sep '15

Hi all, i'm a FreeRadius (and related auth protocols) newbie, my final goal is to join EDUROAM (!). I'm playing starting with a stock Ubuntu 14.04 + FR 2.1.12. Following http://deployingradius.com/ i succesfully tested EAP as explained here http://deployingradius.com/scripts/eapol_test/. Then i applied some changes to configs in order to forward requests for a specific REALM (generated by eapol_test using ttls-pap), to another FR (2.0 pre cooked using ZeroShell); it didn't work! Looking at the output of freeradius -X (attached), it seems that the problem comes from the "User-Name" field that contains the value assigned by eapol_test to the "anonymous_identity" field rather than that assigned to the "identity" field; then FR isn't able to select the right destination REALM because it doesn't known anything about the effective REALM. Things work if i put the destination FR IP Address in the DEFAULT REALM, but this configuration is not acceptable for me. I known that the EAP protocol uses a fake/anonymous identity during phase 1, but until now i'm not able to understand more than this :-( Any help and suggestion will be appreciated. Attaches: - conf file used by eapol_test - Debug Output - radiusd.conf (comments and blank lines stripped out) - proxy.conf (stripped) - eap.conf (stripped) - sites-enabled/default (stripped) - sites-enabled/inner-tunnel (stripped) ====== conf file used by eapol_test network={ ssid="example" key_mgmt=WPA-EAP eap=TTLS identity="prova2(a)euclidebari.it" anonymous_identity="mickymouse" password="prova2a" phase2="auth=PAP" } ====== Debug Output FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 24 2014 at 14:57:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server server_euclide_it { ipaddr = 192.168.2.252 port = 1812 type = "auth+acct" secret = "testing123" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool pool_euclide_it { type = fail-over home_server = server_euclide_it } realm EUCLIDEBARI.IT { pool = pool_euclide_it nostrip } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.0/16 { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 52539 ... adding new socket proxy address * port 36512 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=0, length=128 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000f016d69636b796d6f757365 Message-Authenticator = 0x8f0e1b2cab6c45f749603dfb9fe3121e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 15 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.2.227 port 55621 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c24a7dd7c25b2c4284649365cf62b2b Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=1, length=424 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201012315001603010118010001140303500895fdbcbed3481e543f4718b61dca402a276ee1c5c7b47dbaf08103eb136d000082c030c02cc028c024c014c00a00a3009f006b006a0039003800880087c032c02ec02ac026c00fc005009d003d00350084c012c00800160013c00dc003000ac02fc02bc027c023c013c00900a2009e0067004000330032009a009900450044c031c02dc029c025c00ec004009c003c002f00960041c011c007c00cc0020005000400ff01000069000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011000d00 EAP-Message = 0x20001e060106020603050105020503040104020403030103020303020102020203000f000101 State = 0x7c24a7dd7c25b2c4284649365cf62b2b Message-Authenticator = 0x7618307c23dc64560c4545f5568f56d9 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0118], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 003e], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 02c8], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.2.227 port 55621 EAP-Message = 0x0102040015c000000469160301003e0200003a0301d72aa49a84707fec19955a71c223b0ddb8809fd6cce5122a2f9675df50fe62bf00c014000012ff01000100000b000403000102000f00010116030102c80b0002c40002c10002be308202ba308201a2a0030201020209008fc4031006f00775300d06092a864886f70d01010b05003015311330110603550403130a65647572756231343034301e170d3135303930353039303235345a170d3235303930323039303235345a3015311330110603550403130a6564757275623134303430820122300d06092a864886f70d01010105000382010f003082010a0282010100f2c1009b1a7294e79f5ca7 EAP-Message = 0x7cc01128a62585c8bb5c11a673bb63b34e427cf0d300a4b69d0fb69c39a017e84527deeb3b850e8c46d294db5d13843dfea0444ad7f9d0c7d499627de1c30fa4faec7ba7b91a6a12db36f3ced751b3655b75ef2e454b01d8b70c1785e9592bcee88c0bfed39e5ed7a8a75fdef14974b62775f4be2c6e67fa9e07a41e93d830ca5201238f80838f3019937e059c55dcc586aec288ee221be019d31a2f3ff403544dce69655b51dc0d994d3d96831f244bcda1b0fa746f27141dd2f79ce2f4d7a68608a5549825313a4adc48627468d6b59f9af22cb981f62bc9968198b92bfcbe05b33487e3233a854be4c26c3642f22f06d91dafbd0203010001a30d30 EAP-Message = 0x0b30090603551d1304023000300d06092a864886f70d01010b0500038201010023a54f9b6a0637be98f3187eac6b4aa0010c79692d5c0615c8a2e31554afe55124a09553666c4897a22bacd781b490899bc5a1726ab7fafa9d55db9341e77dadd93e6811940afba2787129264ea7337d4388977a88d6c07b427296ab7483d6f396c1c507955bf342fea6958dbb70a2865c210f08de87bc8739fe5158368c20fe5d161c46a3034ce26f3c762516d2e86870760cd90ebe6492112a7aa29574423f981764c535f09b635eefb66dbe2d6ad98000163edb33b91fbcd5aca82bad41127caaec3ec09e6bcdfcb21ac66c6cefe2ed559ad949c3d83fc983be17a4 EAP-Message = 0x0ea5a2f786af1fd45fd9aeca267187654809653a46ffb971a42600bcb402d95538c1f3160301014b0c0001470300174104c8a3ba662bc9069d8dadead4549b0422463d4d3492941dd4e2ccf38a9aa6431716beaa6dcf19ccb428ccf2c506b82461f83b3f0e8912a71818bc3437b423ce580100a8556000f3c354ef3feb2753922652e81cbcf594bbe8313e36ace607acb184f17f5dedf36919f3458ca6a583b2c9e474e0401eea28d50bb2239596c9a4d20ab9d44cf59d9b3ad2adbf04f2411cdeda46762f9fe8fdaa6cd91434255937f50366768f72a9bf75f6d79b68278be773be6bb6dd01c65d46a3485ffa1a7437bae0a137016da314f52d50667d EAP-Message = 0x57c13c77e0a793bcdc3bc219 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c24a7dd7d26b2c4284649365cf62b2b Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=2, length=137 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200061500 State = 0x7c24a7dd7d26b2c4284649365cf62b2b Message-Authenticator = 0xf74709dd977c95c2b2640c86b1739969 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.2.227 port 55621 EAP-Message = 0x0103007d15800000046969e584db8b5a1f010df7edbcea505a2c90151217ad9eb037080b6fcf41e4f7b24c8fec0b256bdb4ec5db293ace737a2a222a4eed091a0a6734445285374f64d8ada192c2493acd9a1e4fcc92afaaa48a79219e902ac442e08a6cf4456b26e5fb52c1fb70a1018175c7d916030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c24a7dd7e27b2c4284649365cf62b2b Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=3, length=271 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0203008c15001603010046100000424104222a353de69eeb9551f4f95c5490822c143d3d58b226f8862fbcb47d87be003124b0e5cd1cd558606740eb9c62a874a38335d43ca5d73bc239e25674f2356ca214030100010116030100307341e04e67aa3d57f7faa35ef13eb27d25564e6b398438b99058508ff8fa5fb772e5fc8292ca0d5c1be44f09249c569e State = 0x7c24a7dd7e27b2c4284649365cf62b2b Message-Authenticator = 0x6ac83dfd3eda6275d10752c19c3e0360 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 140 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.2.227 port 55621 EAP-Message = 0x0104004515800000003b14030100010116030100308c5e8e1e455e6c47ddc6b0809952b277649c52cf89acf888bbd75965ebce92e51c0b641dca8cc5b5f316018adccb425c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7c24a7dd7f20b2c4284649365cf62b2b Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.227 port 55621, id=4, length=259 User-Name = "mickymouse" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02040080150017030100208fae9376270446a8e7c337264836d70b0afd3cf2aa06df21f18d2367e850caa71703010050e335abefb024141930ef3a96365da9cf12d8dc57a6d04176119feb77ace448fef427911d840a4bf2bfcff577eb7ca2d97a5db81b5d2a3335d2fcee0eee096671fbd5eb1648fc92c98ec9c5a8f621f48c State = 0x7c24a7dd7f20b2c4284649365cf62b2b Message-Authenticator = 0x0ca4e41ee6414ebbd652b69cdeb714b1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mickymouse", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 128 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "prova2(a)euclidebari.it" User-Password = "prova2a" FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "prova2(a)euclidebari.it" User-Password = "prova2a" FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "euclidebari.it" for User-Name = " prova2(a)euclidebari.it" [suffix] Found realm "EUCLIDEBARI.IT" [suffix] Adding Realm = "EUCLIDEBARI.IT" [suffix] Proxying request from user prova2 to realm EUCLIDEBARI.IT [suffix] Preparing to proxy authentication request to realm "EUCLIDEBARI.IT " ++[suffix] returns updated ++[control] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mickymouse attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 4 to 192.168.2.227 port 55621 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 0 with timestamp +37 Cleaning up request 1 ID 1 with timestamp +37 Cleaning up request 2 ID 2 with timestamp +37 Cleaning up request 3 ID 3 with timestamp +37 Waking up in 0.5 seconds. Cleaning up request 4 ID 4 with timestamp +37 Ready to process requests. ====== radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct name = freeradius confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = freerad group = freerad max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ====== proxy.conf proxy server { default_fallback = no } home_server server_euclide_it { type = auth+acct ipaddr = 192.168.2.252 port = 1812 secret = testing123 status_check = status-server } home_server_pool pool_euclide_it { type = fail-over home_server = server_euclide_it } realm EUCLIDEBARI.IT { pool = pool_euclide_it nostrip } ===== eap.conf eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { auth_type = PAP } tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom CA_path = ${cadir} cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 # hours max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } mschapv2 { } } ====== sites-enabled/default authorize { preprocess chap mschap digest suffix eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp exec attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } ===== sites-enabled/inner-tunnel server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { chap mschap suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } # inner-tunnel server block -- Vito A. Smaldino

2 3

Freeradius with HAProxy and keepalived
by Arash Shams 07 Sep '15

07 Sep '15

Hello is it possible to have a master master or master slave freeradius with haproxy and keepalived ? i already search about that in google and find a useful document from s9s but i dont want to use theirs software if you have any suggestion or configuration file please share with me thank you

2 1

Where is PAP problem
by Tevfik Ceydeliler 07 Sep '15

07 Sep '15

Hi, I try to authenticate my user from PFsense by using itself as NAS, But I get auth-reject. Dont know why Here is sites-available conf file and debug log: r authorize { update reply { Huntgroup-Name := "%{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}'}" } preprocess chap mschap digest suffix eap { ok = return } files sql expiration logintime } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess suffix } accounting { detail unix radutmp sqlippool exec } session { radutmp } post-auth { sqlippool reply_log exec } } pre-proxy { } post-proxy { eap } --SQL User and Group attributes: mysql> select * from radcheck where username like "tevfikceydeliler" -> ; +-----+------------------+--------------------+----+--------+ | id | username | attribute | op | value | +-----+------------------+--------------------+----+--------+ | 595 | tevfikceydeliler | Cleartext-Password | := | Test01 | +-----+------------------+--------------------+----+--------+ mysql> select * from radusergroup where username like "tevfikceydeliler" -> ; +------------------+---------------+----------+ | username | groupname | priority | +------------------+---------------+----------+ | tevfikceydeliler | UGR_Test_Wifi | 0 | +------------------+---------------+----------+ radgroupcheck is ; +----+------------------------------------+----------------+----+---------------------------+ | id | groupname | attribute | op | value | +----+------------------------------------+----------------+----+---------------------------+ | 48 | UGR_Test_Wifi | NAS-IP-Address | != | 10.1.1.71 | | 50 | UGR_Test_Wifi | Auth-Type | := | Reject | +----+------------------------------------+----------------+----+---------------------------+ --And debug log file is like that: rad_recv: Access-Request packet from host 10.1.1.75 port 24348, id=217, length=138 NAS-IP-Address = 10.1.1.75 NAS-Identifier = "fwguest.yasar.com.tr" User-Name = "tevfikceydeliler" User-Password = "Test01" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 2000 Framed-IP-Address = 192.168.67.50 Called-Station-Id = "10.1.1.75" Calling-Station-Id = "c8:f7:33:38:20:ac" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} sql_xlat expand: %{User-Name} -> tevfikceydeliler sql_set_user escaped user --> 'tevfikceydeliler' expand: SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}' -> SELECT groupname FROM radhuntgroup WHERE nasipaddress='10.1.1.75' rlm_sql (sql): Reserving sql socket id: 0 sql_xlat finished rlm_sql (sql): Released sql socket id: 0 expand: %{sql:SELECT groupname FROM radhuntgroup WHERE nasipaddress='%{NAS-IP-Address}'} -> PfSense ++[reply] returns notfound ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> tevfikceydeliler [sql] sql_set_user escaped user --> 'tevfikceydeliler' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tevfikceydeliler' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tevfikceydeliler' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'tevfikceydeliler' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupnam e = 'UGR_Test_Wifi' ORDER BY id [sql] User found in group UGR_Test_Wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupnam e = 'UGR_Test_Wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Reject Auth-Type = Reject, rejecting user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> tevfikceydeliler attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 217 to 10.1.1.75 port 24348 --

2 3

Respond to DHCP Lease Query requests using rlm_cache
by Бен Томпсон 06 Sep '15

06 Sep '15

Hi Everyone I have configured FreeRADIUS to as a DHCP server which offers IP addresses based on the option 82 values added by a DHCP relay. In cases where the client sends a unicast renew request bypassing the relay, the option 82 values are queried from an instance of rlm_cache which have configured to keep a record of leases. (This replicates the option 82 "Stash" functionality in ISC DHCP Server). A bit of unlang is involved to check that the lease is valid and take care of clearing out the cache, but it is all fairly simple. The aformentioned server is working well, but I would also like it to be able to respond to Lease Query requests, and wondered if it would be possible to make it work in a similar way using rlm_cache. I would envisage that configuration might look something like this: dhcp DHCP-Lease-Query { # look in the cache to see if there is an active lease cache # check to see if we know about this IP ...some unlang lookup the IP from our usual auth source/DB ... ... some unlang to figure out if the lease(s) are valid, etc. ... # work out which type of reply packet is requred and add the relevant options if (result of above says lease is active) { update reply { DHCP-Message-Type := DHCP-Lease-Active ... add some other stuff to the reply... } } elsif (result of above says lease is unassigned) { update reply { DHCP-Message-Type := DHCP-Lease-Unassigned ... add some other stuff to the reply... } } elsif (result of above says lease is unknown) { update reply { DHCP-Message-Type := DHCP-Lease-Unknown ... add some other stuff to the reply... } } } I am guessing that the source code would need to be modified, and if so, it may be too much for me as I am not a skilled C programmer. I would be able to test it however. If it is possible without editing the code I would be grateful to find out how. Thanks Ben

3 17

Ldap/freeradius gidnumber attribute check issue
by David Francisco Rodriguez Perez 04 Sep '15

04 Sep '15

HI all I am using freeradius to do 802.1x authentication (Peap/mschapv2) to an LDAP (openldap). Freeradius version 2.1.10 in Ubuntu 12.04. This is a Proof of Concept so far. The authentication is working fine but I have not been able to match a group number in order to return a specificattribute. My directory looks like: dn: ou=Gente,dc=testexample,dc=com objectClass: organizationalUnit ou: Gente dn: ou=Groups,dc=testexample,dc=com objectClass: organizationalUnit ou: Groups dn: cn=students,ou=Groups,dc=testexample,dc=com objectClass: posixGroup cn: students gidNumber: 5000 dn: uid=david,ou=Gente,dc=testexample,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: radiusprofile objectClass: sambaSamAccount uid: david sn: Rodriguez givenName: David cn: David Rodriguez displayName: David Rodriguez uidNumber: 10000 gidNumber: 5000 dialupAccess: access_attr sambaSID: S-1-0-0-201000 sambaNTPassword: sambaLMPassword: So as I read i should use groupmembership_attribute but I did not found a way to use it. So I put in the dictionary: ATTRIBUTE GroupNumber 3003 integer And then I put in the ldap.attrmap file: checkItem GroupNumber gidNumber And then I put in the users file: DEFAULT GroupNumber == 5000 Filter-Id :="UNP-test" But I do not see that the match is working. Even I tried to put in the authorize part of default file update reply { Filter-Id:= %(GroupNumber) } But it did not expand anything. So how should I derive the gidNumber in order to return an attribute to the authenticator. Thanks a lot, David

3 8

Re: *TLS* Session caching in v3.0.9
by Jason Alderfer 04 Sep '15

04 Sep '15

On Fri, Sep 4, 2015 at 2:38 PM, Alan DeKok <aland(a)deployingradius.com> wrote: > On Sep 4, 2015, at 12:16 PM, Jason Alderfer <jha2(a)emu.edu> wrote: > > > 2. With the above in place, caching appears to work correctly. All > > expected attributes are in the cache, and on session resumption they are > > read correctly from the cache, however they are not sent back in the > final > > reply. See below. > > You're not putting anything into session-state. So when you're taking > the reply attributes from the &session-state, nothing is there. > > There's a lot of moving parts here. > > a) attributes which need to be saved across multiple Access-Challenges > MUST be put into the "session-state" list. > > b) you must set Cached-Session-Policy some time BEFORE the session > finishes, so that the TLS session is cached, with the policy. > > c) on session resumption, the Cached-Session-Policy is read from the cache > and put back into the reply list. The "inner tunnel" isn't executed. > > d) if the next packet is an Access-Accept, you can key off of > Cached-Session-Policy in the post-auth section, to set your reply attributes > > e) if the next packet is an Access-Challenge, you MUST copy > Cached-Session-Policy to &session-state, so that it can be used in the next > Access-Accept > > Success! The crucial missing piece was wrapping my policy processing code in a "Post-Auth-Type Challenge" so it would be called on session resumption, and setting values in session-state, not reply, like so: Post-Auth-Type Challenge { if ( reply:Cached-Session-Policy ) { if ( reply:Cached-Session-Policy =~ /vlan=(.+)/ ) { update session-state { Reply-Message += "Cached policy:%{reply:Cached-Session-Policy}" Tunnel-Private-Group-ID := "%{1}" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } } } } Thanks for your help with this, Alan. I appreciate your time. Jason Alderfer

1 0

Re: *TLS* Session caching in v3.0.9
by Jason Alderfer 04 Sep '15

04 Sep '15

On Mon, Aug 31, 2015 at 3:12 PM, Alan DeKok <aland(a)deployingradius.com> wrote: > On Aug 31, 2015, at 2:06 PM, Jason Alderfer <jha2(a)emu.edu> wrote: > > I'm having trouble getting session caching to work in 3.0.9. > > It's not clear what you mean by "session caching". > I want to use TLS session caching to enable TLS session resumption aka MS "fast reconnect". In the TLS session cache I want to store a VLAN value to be sent back in the TLS session resumptions. Did you configure the TLS session caching in raddb/mods-available/eap? > Yes. It is enabled. This is NOT the same thing as the "cache" module. And it's NOT the same > thing as the session-state. > > > Question 2: See attached debug log. When a session resumes, the cached > > info appears to be read correctly from the cache (see "Debug: (41)") but > it > > never gets sent back in the reply (see "Debug: (42)"). > > Try using v3.0.x from github. It may be better. I've put a few fixes > in which should help. Testing with v3.0.x. What I found: 1. In order to get TLS sessions to be cached without needing to enable use_tunneled_reply = yes, I had to put the following in the "authorize" section of "default" so that it came before the eap module was called. Otherwise eap didn't find anything to cache. update { &reply: += &session-state: } if ( &reply:Cached-Session-Policy ) { if ( &reply:Cached-Session-Policy =~ /vlan=(.+)/ ) { update reply { Reply-Message += "Cached policy:%{reply:Cached-Session-Policy}" Tunnel-Private-Group-ID := "%{1}" Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 } } } 2. With the above in place, caching appears to work correctly. All expected attributes are in the cache, and on session resumption they are read correctly from the cache, however they are not sent back in the final reply. See below. [...] Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: SSL Connection Established Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: SSL Application Data Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: Adding cached attributes from session f2da74c194f913b553b402be956fef89d955c31ac3438cfd3d173e803d37c269 Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: reply:User-Name += "alderfjh" Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: reply:Cached-Session-Policy += "vlan=3" Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: [eaptls process] = success Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: Session established. Decoding tunneled attributes Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: PEAP state TUNNEL ESTABLISHED Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: Skipping Phase2 because of session resumption Fri Sep 4 11:41:29 2015 : Debug: (14) eap_peap: SUCCESS Fri Sep 4 11:41:29 2015 : Debug: (14) eap: Sending EAP Request (code 1) ID 5 length 43 Fri Sep 4 11:41:29 2015 : Debug: (14) eap: EAP session adding &reply:State = 0x0a356ef1083077e4 Fri Sep 4 11:41:29 2015 : Debug: (14) modsingle[authenticate]: returned from eap (rlm_eap) for request 14 Fri Sep 4 11:41:29 2015 : Debug: (14) [eap] = handled Fri Sep 4 11:41:29 2015 : Debug: (14) } # authenticate = handled Fri Sep 4 11:41:29 2015 : Debug: (14) Using Post-Auth-Type Challenge Fri Sep 4 11:41:29 2015 : Debug: (14) Post-Auth-Type sub-section not found. Ignoring. Fri Sep 4 11:41:29 2015 : Debug: (14) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Fri Sep 4 11:41:29 2015 : Debug: (14) session-state: Nothing to cache Fri Sep 4 11:41:29 2015 : Debug: (14) Sent Access-Challenge Id 161 from 10.3.20.8:1812 to 10.3.20.20:32858 length 0 Fri Sep 4 11:41:29 2015 : Debug: (14) User-Name += "alderfjh" Fri Sep 4 11:41:29 2015 : Debug: (14) EAP-Message = 0x0105002b1900170301002089c927cc662723556271f795130acfbd6f74cf74844c6194fc8edf6008822831 Fri Sep 4 11:41:29 2015 : Debug: (14) Message-Authenticator = 0x00000000000000000000000000000000 Fri Sep 4 11:41:29 2015 : Debug: (14) State = 0x0a356ef1083077e4f2094fd2b79c8abb Fri Sep 4 11:41:29 2015 : Debug: (14) Finished request [...] Fri Sep 4 11:41:29 2015 : Debug: (15) Received Access-Request Id 141 from 10.3.20.20:32858 to 10.3.20.8:1812 length 317 Fri Sep 4 11:41:29 2015 : Debug: (15) User-Name = "alderfjh" Fri Sep 4 11:41:29 2015 : Debug: (15) NAS-IP-Address = 192.168.20.2 Fri Sep 4 11:41:29 2015 : Debug: (15) NAS-Port = 0 Fri Sep 4 11:41:29 2015 : Debug: (15) NAS-Identifier = "192.168.20.2" Fri Sep 4 11:41:29 2015 : Debug: (15) NAS-Port-Type = Wireless-802.11 Fri Sep 4 11:41:29 2015 : Debug: (15) Calling-Station-Id = "BC6E64721BDA" Fri Sep 4 11:41:29 2015 : Debug: (15) Called-Station-Id = "000B86612D64" Fri Sep 4 11:41:29 2015 : Debug: (15) Service-Type = Login-User Fri Sep 4 11:41:29 2015 : Debug: (15) Framed-MTU = 1100 Fri Sep 4 11:41:29 2015 : Debug: (15) EAP-Message = 0x0205005019001703010020b1e84bef14eb5dc34d86f50ad057aab7481972c63dcb75bcb83bdd08af79d8aa17030100206040b54b4046a27a7e464b0c4168296c41675fd2fd609d882b352a400c8e8fbb Fri Sep 4 11:41:29 2015 : Debug: (15) State = 0x0a356ef1083077e4f2094fd2b79c8abb Fri Sep 4 11:41:29 2015 : Debug: (15) Aruba-Essid-Name = "EMU-testdad" Fri Sep 4 11:41:29 2015 : Debug: (15) Aruba-Location-Id = "NL1-1st-great-lounge-103-ap65" Fri Sep 4 11:41:29 2015 : Debug: (15) Aruba-AP-Group = "NL-master-only-normal-ARM" Fri Sep 4 11:41:29 2015 : Debug: (15) Message-Authenticator = 0xe57b4ba73dfd4ebcb4fcd80cf4f1cbe3 Fri Sep 4 11:41:29 2015 : Debug: (15) session-state: No cached attributes Fri Sep 4 11:41:29 2015 : Debug: (15) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Fri Sep 4 11:41:29 2015 : Debug: (15) authorize { Fri Sep 4 11:41:29 2015 : Debug: (15) update { Fri Sep 4 11:41:29 2015 : Debug: (15) No attributes updated Fri Sep 4 11:41:29 2015 : Debug: (15) } # update = noop Fri Sep 4 11:41:29 2015 : Debug: (15) if ( &reply:Cached-Session-Policy ) { Fri Sep 4 11:41:29 2015 : Debug: (15) if ( &reply:Cached-Session-Policy ) -> FALSE [...] Fri Sep 4 11:41:29 2015 : Debug: (15) Sent Access-Accept Id 141 from 10.3.20.8:1812 to 10.3.20.20:32858 length 0 Fri Sep 4 11:41:29 2015 : Debug: (15) MS-MPPE-Recv-Key = 0x9f85989d1bc6533c26517adb7a130fa621c778ebd0d6fcc46319384e279481b4 Fri Sep 4 11:41:29 2015 : Debug: (15) MS-MPPE-Send-Key = 0xebbb603a80d0fe376d053c7101e5d8f8e35464c55efa82305133b0668bcc440a Fri Sep 4 11:41:29 2015 : Debug: (15) User-Name = "alderfjh" Fri Sep 4 11:41:29 2015 : Debug: (15) Finished request

2 1

NAS IP address for usergroup
by Tevfik Ceydeliler 04 Sep '15

04 Sep '15

Hi Does NAS-IP-Address attribute work under usergroup? +-----+-------------------------+-----------------------------+------+----------+ | id | username | attribute | op | value | +-----+-------------------------+-----------------------------+------+----------+ | 595 | tevfikceydeliler | Cleartext-Password | := | Test01 | +-----+-------------------------+-----------------------------+------+--------+ +-----------------------+--------------------+----------+ | username | groupname | priority | +-----------------------+---------------------+----------+ | tevfikceydeliler | UGR_Test_Wifi | 0 | +-----------------------+----------------------+----------+ +----+-----------------------+------------------------+-----+------------------+ | id | groupname | attribute | op | value | +----+---------------+--------------------------------+----+-------------- -----+ | 45 | UGR_Test_Wifi | NAS-IP-Address | == | 10.65.8.117 | +----+-----------------------+-------------------------+----+-------------------+ I test it but user can get access-accept" from dşfferent NAS also Or something wrong? --

2 4

User authentication by some couple conditions
by Tevfik Ceydeliler 04 Sep '15

04 Sep '15

Hi, I Use freeradius to assign IP address by using MySQL But due to some need I try to find some answer. 1) Is it possible one of those two scenarios: - Authentication by using Client AND Username+Password - Authentication by using Usergroup AND Username+Password 2) And second question is : Is is possible to Authentication expiration date on MySQL? Can you give me some reference I will be really appreciated. Regards.. -- Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

1 0

Re: Postgresql groupreply problem
by georg＠wojti.de 04 Sep '15

04 Sep '15

Alan DeKok schrieb am 31.08.2015 14:30: > On Aug 31, 2015, at 4:15 AM, georg(a)wojti.de wrote: >> I want to change the user MAC-authentication with an HP-Switch from the >> users-file to postgresql. The first thing is, that I have a some lines which >> check whether it is a Call-Check or not. If not then the radius has to reject >> this. But I think it's ok if I put this into the users-file. I have written >> the Cleartext-Password in this file, too, because I get an chap error (chap: >> ERROR: &control:Cleartext-Password is required for authentication), when I put >> this into the database. > > The server doesn't care where it gets the Cleartext-Password from. It doesn't > matter if it's in a database, or in the "users" file > >> In the Moment my configurations looks like this: >> >> -------------- users file -------------- >> DEFAULT Service-Type != Call-Check, Auth-Type := Reject >> Fall-Through = Yes > > You should delete that "Fall-Through". It does nothing useful. > >> DEFAULT Cleartext-Password := "xxxXXXxxx" >> Fall-Through = Yes >> >> DEFAULT >> Egress-VLANID := 0x3200005C #<-- check in server.conf; reject if it's >> the same > > Why is this entry here? It ALWAYS matches ALL incoming requests. So... > you'll always reject all requests. > > That doesn't make any sense. I have removed the files section. So the server has to test sql. looks like this: -------------- server.conf -------------- ... authorize { suffix if (Realm != "NULL") { reject } chap sql.sw-hp-mac-v3 } I have read the Rlm_sql wiki many times but there is no resolution to my problem. I tried many differen constellations for Example: Test #1: If "The user IS NOT found in radcheck" freeradius should start the group processing. In the usergroup table ist the username (in my case the MAC of the client) and the group, in groupcheck tabe is an entry with the Cleartext-Password and in the groupreply table is an entry for Egress-VLANID. Test #2: If "The user IS found in radcheck, the check items DO match AND Fall-Through is set in the radreply table" the group processing starts, too. In this case i have the Cleartext-Password in the check table and in the reply table is an entry with Fall-Through=Yes. In the usergroup table ist the MAC and the group,too, and in the groupreply table is an enty for Egress-VLANID. There is nothing to check for the groups so this table is empty. Result for both: The Group-Problem still exists! 1. Freeradius checks the usergroups and -> "rlm_sql_postgresql: query affected rows = 1 , fields = 5". I tested the sql-command manually and I get the Group "abc" -> this is OK 2. Next, freeradius calls the command "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id" but freeradius does not insert any group name into the sql-command. Why?! Looks like this "SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '' ORDER BY id" And so no attributes from the group tables were checked. >> -------------- Database -------------- >> (Hope that the format is ok. The tables radreply and radgroupcheck are empty) >> >> +----------------------------------------------------------------------+ >> | radcheck | >> +----+-------------------+--------------------+----+-------------------+ >> | id | username | attribute | op | value | >> +----+-------------------+--------------------+----+-------------------+ >> | 0 | 00:11:22:33:44:55 | Calling-Station-Id | == | 00-11-22-33-44-55 | >> +----+-------------------+--------------------+----+-------------------+ > > Which does nothing other than check the Calling-Station-Id. It does NOT add a > Cleartext-Password. > >> +-----------------------------------------------+ >> | radusergroup | >> +----+-------------------+-----------+----------+ >> | id | username | groupname | priority | >> +----+-------------------+-----------+----------+ >> | 0 | 00:11:22:33:44:55 | abc | 0 | >> +----+-------------------+-----------+----------+ >> >> +--------------------------------------------------+ >> | radgroupreply | >> +----+-----------+---------------+----+------------+ >> | id | groupname | attribute | op | value | >> +----+-----------+---------------+----+------------+ >> | 0 | abc | Egress-VLANID | := | 0x320000E0 | >> +----+-----------+---------------+----+------------+ >> >> >> >> The main problem is that the freeradius does not insert the GroupName in the >> sql-commands and so there is no correct reply. > > Because the radgroupcheck is empty. > > If you want to know how the SQL module works, go to the wiki, and search for > "rlm_sql". It has an entire page devoted to explaining exactly how the module > works, including processing of radcheck / radreply, and radgroupcheck / > radgroupreply. > > i.e. this is documented. Read the documentation, and you will fi the problem. > > Alan DeKok. > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0