- Freeradius-Users - lists.freeradius.org

freeradius dialupadmin development invitation
by Timmy 24 Aug '15

24 Aug '15

Hello all Users, Freeradius dialupadmin is a very nice and native GUI for Freeradius 2.2. However, it does not work any more after php version 5.3. I want to start an invitation for raising a fund for developing it so that it can still work up to php 5.6, and also redesign its GUI to have a modern outlook. I think a few hundred US$ will do. If any body is interested, we can share the expense. 10 participants are cheap enough to complete this project. Yours Faithfully, Timmy

6 7

Ubuntu FreeRADIUS Packages
by Kev Pearce 24 Aug '15

24 Aug '15

Hi all, Are there any official places (i.e. PPAs) to get pre-compiled FreeRADIUS packages later then 3.0.4 from? "http://packages.networkradius.com/ubuntu trusty main" only has 3.0.4 in it. I'm after 3.0.9. Cheers all Kev/.

3 6

Using DHCP for Radius on a Cable Modem Plant
by John Alcock 23 Aug '15

23 Aug '15

Morning, Has anyone use freeradius and the built-in dhcp server in freeradius for a small cable modem plant? I am using LDAP for the authentication part and it works. Radius just seems like a much cleaner solution. So, the idea I have in mind is using freeradius for authentication and go ahead and use it for DHCP. I will use a SQL database backend to keep track of users. So, my question has to do with documentation. Most of seems to be dealing with version 2, and the main page says.. hey.. do not use version 2 configs as a starting space. Also, documentation seems weak on the new DHCP options. The way I figure it, if I am going to complain about documentation or lack thereof, I just need to write some documentation and submit to the group. That being said, some directions in the right direction would help me get started. I have seen documentation on each of the separate items below, but not much in tieing it all together. Platform will be Linux running a standard LAMP installation. SQL database (mysql, postgress, I do not care) to keep track of information, specifically the MAC address which will be used for authentication. DHCP? Should I use the DHCP built into Radius? Or outside DHCP server. I kind like the idea of allowing Radius handling it all. So. At the end, I guess I am looking for some general advice on best practices of setting this up. Once I get an overview setup, then I can start working on specifics. John

5 13

Strange things with android phone
by kjonca＠o2.pl 22 Aug '15

22 Aug '15

I have configured and working wifi with eap-tls authentication. I want to use another root ca, so I did the following steps. openssl genrsa -aes256 -out private/wifi,beta,ca.key 4096 openssl req -new -out cacerts/wifi,beta,ca.pem -subj "/C=PL/ST=Mazowieckie/L=Warszawa/O=beta/OU=wifi/CN=beta-wifi-ca/emailAddress=kjonca(a)poczta.onet.pl" -x509 -days 3650 -extensions v3_ca -key private/wifi,beta,ca.key openssl req -new -out req.csr -subj "/C=PL/ST=Mazowieckie/O=beta/OU=beta.kjonca/CN=selen.kjonca" -key ../private/selen.kjonca.1.key #this is phone key openssl ca -in req.csr -cert cacerts/wifi,beta,ca.pem -keyfile private/wifi,beta,ca.key -extensions xpclient_ext -extfile ../xp.ext -out certs/wifi,selen,1.pem openssl x509 -x509toreq -in certs/wifi,beta-wifi-beta,2,1.pem -out req.csr -signkey private/wifi,beta-wifi-beta,2.key #this is key for freeradius instance openssl ca -in req.csr -cert cacerts/wifi,beta,ca.pem -keyfile private/wifi,beta,ca.key -out certs/wifi,beta-wifi-beta,2.5.pem openssl pkcs12 -export -certfile cacerts/wifi,beta,ca.pem -in certs/wifi,selen,1.pem -inkey ../private/selen.kjonca.1.key -out wifi,selen.p12 Then *.p12 file was sent to phone and imported into cert store. And strange things happen: When "CA cert" field in wifi network definition is set then phone can't connect. When is empty - eweything works. Here some logs. 12:02:28 2015 : Info: Cleaning up request 83 ID 240 with timestamp +1556 Sat Aug 22 12:02:28 2015 : Info: Cleaning up request 84 ID 241 with timestamp +1556 Sat Aug 22 12:02:28 2015 : Info: Cleaning up request 85 ID 242 with timestamp +1556 Sat Aug 22 12:02:28 2015 : Info: Cleaning up request 86 ID 243 with timestamp +1556 Sat Aug 22 12:02:28 2015 : Info: Cleaning up request 87 ID 244 with timestamp +1556 Sat Aug 22 12:02:28 2015 : Info: Cleaning up request 88 ID 245 with timestamp +1556 Sat Aug 22 12:02:28 2015 : Info: Ready to process requests. Sat Aug 22 12:04:43 2015 : Debug: Thread 5 got semaphore Sat Aug 22 12:04:43 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:04:43 2015 : Debug: Thread 5 handling request 89, (18 handled so far) Sat Aug 22 12:04:43 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:43 2015 : Info: +group authorize { Sat Aug 22 12:04:43 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:04:43 2015 : Info: ++[chap] = noop Sat Aug 22 12:04:43 2015 : Info: ++[mschap] = noop Sat Aug 22 12:04:43 2015 : Info: ++[digest] = noop Sat Aug 22 12:04:43 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:04:43 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:04:43 2015 : Info: ++[suffix] = noop Sat Aug 22 12:04:43 2015 : Info: [eap] EAP packet type response id 154 length 17 Sat Aug 22 12:04:43 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:04:43 2015 : Info: ++[eap] = updated Sat Aug 22 12:04:43 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:04:43 2015 : Info: ++[files] = ok Sat Aug 22 12:04:43 2015 : Info: ++[expiration] = noop Sat Aug 22 12:04:43 2015 : Info: ++[logintime] = noop Sat Aug 22 12:04:43 2015 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Sat Aug 22 12:04:43 2015 : Info: ++[pap] = noop Sat Aug 22 12:04:43 2015 : Info: +} # group authorize = updated Sat Aug 22 12:04:43 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:04:43 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:43 2015 : Info: +group authenticate { Sat Aug 22 12:04:43 2015 : Info: [eap] EAP Identity Sat Aug 22 12:04:43 2015 : Info: [eap] processing type tls Sat Aug 22 12:04:43 2015 : Info: [tls] Requiring client certificate Sat Aug 22 12:04:43 2015 : Info: [tls] Initiate Sat Aug 22 12:04:43 2015 : Info: [tls] Start returned 1 Sat Aug 22 12:04:43 2015 : Info: ++[eap] = handled Sat Aug 22 12:04:43 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:04:43 2015 : Info: Finished request 89. Sat Aug 22 12:04:43 2015 : Debug: Going to the next request Sat Aug 22 12:04:43 2015 : Debug: Thread 5 waiting to be assigned a request Sat Aug 22 12:04:43 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:04:43 2015 : Debug: Thread 3 got semaphore Sat Aug 22 12:04:43 2015 : Debug: Thread 3 handling request 90, (19 handled so far) Sat Aug 22 12:04:43 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:43 2015 : Info: +group authorize { Sat Aug 22 12:04:43 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:04:43 2015 : Info: ++[chap] = noop Sat Aug 22 12:04:43 2015 : Info: ++[mschap] = noop Sat Aug 22 12:04:43 2015 : Info: ++[digest] = noop Sat Aug 22 12:04:43 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:04:43 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:04:43 2015 : Info: ++[suffix] = noop Sat Aug 22 12:04:43 2015 : Info: [eap] EAP packet type response id 155 length 204 Sat Aug 22 12:04:43 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:04:43 2015 : Info: ++[eap] = updated Sat Aug 22 12:04:43 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:04:43 2015 : Info: ++[files] = ok Sat Aug 22 12:04:43 2015 : Info: ++[expiration] = noop Sat Aug 22 12:04:43 2015 : Info: ++[logintime] = noop Sat Aug 22 12:04:43 2015 : Info: ++[pap] = noop Sat Aug 22 12:04:43 2015 : Info: +} # group authorize = updated Sat Aug 22 12:04:43 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:04:43 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:43 2015 : Info: +group authenticate { Sat Aug 22 12:04:43 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:04:43 2015 : Info: [eap] EAP/tls Sat Aug 22 12:04:43 2015 : Info: [eap] processing type tls Sat Aug 22 12:04:43 2015 : Info: [tls] Authenticate Sat Aug 22 12:04:43 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:04:43 2015 : Info: [tls] eaptls_verify returned 7 Sat Aug 22 12:04:43 2015 : Info: [tls] Done initial handshake Sat Aug 22 12:04:43 2015 : Info: [tls] (other): before/accept initialization Sat Aug 22 12:04:43 2015 : Info: [tls] TLS_accept: before/accept initialization Sat Aug 22 12:04:43 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:04:43 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 00c1], ClientHello Sat Aug 22 12:04:43 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:43 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:04:43 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 0039], ServerHello Sat Aug 22 12:04:43 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:43 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:04:43 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 0695], Certificate Sat Aug 22 12:04:43 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:43 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:04:43 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 00cb], ServerKeyExchange Sat Aug 22 12:04:43 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:43 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:04:43 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 000e], CertificateRequest Sat Aug 22 12:04:43 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:43 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:43 2015 : Info: [tls] TLS_accept: Need to read more data: unknown state Sat Aug 22 12:04:43 2015 : Debug: In SSL Handshake Phase Sat Aug 22 12:04:43 2015 : Debug: In SSL Accept mode Sat Aug 22 12:04:43 2015 : Info: [tls] eaptls_process returned 13 Sat Aug 22 12:04:43 2015 : Info: ++[eap] = handled Sat Aug 22 12:04:43 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:04:43 2015 : Info: Finished request 90. Sat Aug 22 12:04:43 2015 : Debug: Going to the next request Sat Aug 22 12:04:43 2015 : Debug: Thread 3 waiting to be assigned a request Sat Aug 22 12:04:43 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:04:43 2015 : Debug: Thread 4 got semaphore Sat Aug 22 12:04:43 2015 : Debug: Thread 4 handling request 91, (19 handled so far) Sat Aug 22 12:04:43 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:43 2015 : Info: +group authorize { Sat Aug 22 12:04:43 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:04:43 2015 : Info: ++[chap] = noop Sat Aug 22 12:04:43 2015 : Info: ++[mschap] = noop Sat Aug 22 12:04:43 2015 : Info: ++[digest] = noop Sat Aug 22 12:04:43 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:04:43 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:04:43 2015 : Info: ++[suffix] = noop Sat Aug 22 12:04:43 2015 : Info: [eap] EAP packet type response id 156 length 6 Sat Aug 22 12:04:43 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:04:43 2015 : Info: ++[eap] = updated Sat Aug 22 12:04:43 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:04:43 2015 : Info: ++[files] = ok Sat Aug 22 12:04:43 2015 : Info: ++[expiration] = noop Sat Aug 22 12:04:43 2015 : Info: ++[logintime] = noop Sat Aug 22 12:04:43 2015 : Info: ++[pap] = noop Sat Aug 22 12:04:43 2015 : Info: +} # group authorize = updated Sat Aug 22 12:04:43 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:04:43 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:43 2015 : Info: +group authenticate { Sat Aug 22 12:04:43 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:04:43 2015 : Info: [eap] EAP/tls Sat Aug 22 12:04:43 2015 : Info: [eap] processing type tls Sat Aug 22 12:04:43 2015 : Info: [tls] Authenticate Sat Aug 22 12:04:43 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:04:43 2015 : Info: [tls] Received TLS ACK Sat Aug 22 12:04:43 2015 : Info: [tls] ACK handshake fragment handler Sat Aug 22 12:04:43 2015 : Info: [tls] eaptls_verify returned 1 Sat Aug 22 12:04:43 2015 : Info: [tls] eaptls_process returned 13 Sat Aug 22 12:04:43 2015 : Info: ++[eap] = handled Sat Aug 22 12:04:43 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:04:43 2015 : Info: Finished request 91. Sat Aug 22 12:04:43 2015 : Debug: Going to the next request Sat Aug 22 12:04:43 2015 : Debug: Thread 4 waiting to be assigned a request Sat Aug 22 12:04:44 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:04:44 2015 : Debug: Thread 1 got semaphore Sat Aug 22 12:04:44 2015 : Debug: Thread 1 handling request 92, (19 handled so far) Sat Aug 22 12:04:44 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:44 2015 : Info: +group authorize { Sat Aug 22 12:04:44 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:04:44 2015 : Info: ++[chap] = noop Sat Aug 22 12:04:44 2015 : Info: ++[mschap] = noop Sat Aug 22 12:04:44 2015 : Info: ++[digest] = noop Sat Aug 22 12:04:44 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:04:44 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:04:44 2015 : Info: ++[suffix] = noop Sat Aug 22 12:04:44 2015 : Info: [eap] EAP packet type response id 157 length 253 Sat Aug 22 12:04:44 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:04:44 2015 : Info: ++[eap] = updated Sat Aug 22 12:04:44 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:04:44 2015 : Info: ++[files] = ok Sat Aug 22 12:04:44 2015 : Info: ++[expiration] = noop Sat Aug 22 12:04:44 2015 : Info: ++[logintime] = noop Sat Aug 22 12:04:44 2015 : Info: ++[pap] = noop Sat Aug 22 12:04:44 2015 : Info: +} # group authorize = updated Sat Aug 22 12:04:44 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:04:44 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:44 2015 : Info: +group authenticate { Sat Aug 22 12:04:44 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:04:44 2015 : Info: [eap] EAP/tls Sat Aug 22 12:04:44 2015 : Info: [eap] processing type tls Sat Aug 22 12:04:44 2015 : Info: [tls] Authenticate Sat Aug 22 12:04:44 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:04:44 2015 : Debug: TLS Length 1577 Sat Aug 22 12:04:44 2015 : Info: [tls] Received EAP-TLS First Fragment of the message Sat Aug 22 12:04:44 2015 : Info: [tls] eaptls_verify returned 9 Sat Aug 22 12:04:44 2015 : Info: [tls] eaptls_process returned 13 Sat Aug 22 12:04:44 2015 : Info: ++[eap] = handled Sat Aug 22 12:04:44 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:04:44 2015 : Info: Finished request 92. Sat Aug 22 12:04:44 2015 : Debug: Going to the next request Sat Aug 22 12:04:44 2015 : Debug: Thread 1 waiting to be assigned a request Sat Aug 22 12:04:44 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:04:44 2015 : Debug: Thread 2 got semaphore Sat Aug 22 12:04:44 2015 : Debug: Thread 2 handling request 93, (19 handled so far) Sat Aug 22 12:04:44 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:44 2015 : Info: +group authorize { Sat Aug 22 12:04:44 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:04:44 2015 : Info: ++[chap] = noop Sat Aug 22 12:04:44 2015 : Info: ++[mschap] = noop Sat Aug 22 12:04:44 2015 : Info: ++[digest] = noop Sat Aug 22 12:04:44 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:04:44 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:04:44 2015 : Info: ++[suffix] = noop Sat Aug 22 12:04:44 2015 : Info: [eap] EAP packet type response id 158 length 185 Sat Aug 22 12:04:44 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:04:44 2015 : Info: ++[eap] = updated Sat Aug 22 12:04:44 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:04:44 2015 : Info: ++[files] = ok Sat Aug 22 12:04:44 2015 : Info: ++[expiration] = noop Sat Aug 22 12:04:44 2015 : Info: ++[logintime] = noop Sat Aug 22 12:04:44 2015 : Info: ++[pap] = noop Sat Aug 22 12:04:44 2015 : Info: +} # group authorize = updated Sat Aug 22 12:04:44 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:04:44 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:44 2015 : Info: +group authenticate { Sat Aug 22 12:04:44 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:04:44 2015 : Info: [eap] EAP/tls Sat Aug 22 12:04:44 2015 : Info: [eap] processing type tls Sat Aug 22 12:04:44 2015 : Info: [tls] Authenticate Sat Aug 22 12:04:44 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:04:44 2015 : Info: [tls] eaptls_verify returned 7 Sat Aug 22 12:04:44 2015 : Info: [tls] Done initial handshake Sat Aug 22 12:04:44 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:04:44 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 0493], Certificate Sat Aug 22 12:04:44 2015 : Info: [tls] chain-depth=1, Sat Aug 22 12:04:44 2015 : Info: [tls] error=0 Sat Aug 22 12:04:44 2015 : Info: [tls] --> User-Name = selen.kjonca Sat Aug 22 12:04:44 2015 : Info: [tls] --> BUF-Name = beta-wifi-ca-2 Sat Aug 22 12:04:44 2015 : Info: [tls] --> subject = /C=PL/ST=Mazowieckie/L=Warszawa/O=beta/OU=wifi/CN=beta-wifi-ca-2/emailAddress=kjonca(a)poczta.onet.pl Sat Aug 22 12:04:44 2015 : Info: [tls] --> issuer = /C=PL/ST=Mazowieckie/L=Warszawa/O=beta/OU=wifi/CN=beta-wifi-ca-2/emailAddress=kjonca(a)poczta.onet.pl Sat Aug 22 12:04:44 2015 : Info: [tls] --> verify return:1 Sat Aug 22 12:04:44 2015 : Info: [tls] expand: %{User-Name} -> selen.kjonca Sat Aug 22 12:04:44 2015 : Info: [tls] checking certificate CN (selen.kjonca) with xlat'ed value (selen.kjonca) Sat Aug 22 12:04:44 2015 : Info: [tls] chain-depth=0, Sat Aug 22 12:04:44 2015 : Info: [tls] error=0 Sat Aug 22 12:04:44 2015 : Info: [tls] --> User-Name = selen.kjonca Sat Aug 22 12:04:44 2015 : Info: [tls] --> BUF-Name = selen.kjonca Sat Aug 22 12:04:44 2015 : Info: [tls] --> subject = /C=PL/ST=Mazowieckie/O=beta/OU=beta.kjonca/CN=selen.kjonca Sat Aug 22 12:04:44 2015 : Info: [tls] --> issuer = /C=PL/ST=Mazowieckie/L=Warszawa/O=beta/OU=wifi/CN=beta-wifi-ca-2/emailAddress=kjonca(a)poczta.onet.pl Sat Aug 22 12:04:44 2015 : Info: [tls] --> verify return:1 Sat Aug 22 12:04:44 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:44 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:04:44 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange Sat Aug 22 12:04:44 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:44 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:04:44 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify Sat Aug 22 12:04:44 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:44 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:04:44 2015 : Info: [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Sat Aug 22 12:04:44 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:04:44 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 0010], Finished Sat Aug 22 12:04:44 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:44 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:04:44 2015 : Info: [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] Sat Aug 22 12:04:44 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:44 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:04:44 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 0010], Finished Sat Aug 22 12:04:44 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:44 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:04:44 2015 : Info: [tls] (other): SSL negotiation finished successfully Sat Aug 22 12:04:44 2015 : Debug: SSL Connection Established Sat Aug 22 12:04:44 2015 : Info: [tls] eaptls_process returned 13 Sat Aug 22 12:04:44 2015 : Info: ++[eap] = handled Sat Aug 22 12:04:44 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:04:44 2015 : Info: Finished request 93. Sat Aug 22 12:04:44 2015 : Debug: Going to the next request Sat Aug 22 12:04:44 2015 : Debug: Thread 2 waiting to be assigned a request Sat Aug 22 12:04:44 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:04:44 2015 : Debug: Thread 5 got semaphore Sat Aug 22 12:04:44 2015 : Debug: Thread 5 handling request 94, (19 handled so far) Sat Aug 22 12:04:44 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:44 2015 : Info: +group authorize { Sat Aug 22 12:04:44 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:04:44 2015 : Info: ++[chap] = noop Sat Aug 22 12:04:44 2015 : Info: ++[mschap] = noop Sat Aug 22 12:04:44 2015 : Info: ++[digest] = noop Sat Aug 22 12:04:44 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:04:44 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:04:44 2015 : Info: ++[suffix] = noop Sat Aug 22 12:04:44 2015 : Info: [eap] EAP packet type response id 159 length 6 Sat Aug 22 12:04:44 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:04:44 2015 : Info: ++[eap] = updated Sat Aug 22 12:04:44 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:04:44 2015 : Info: ++[files] = ok Sat Aug 22 12:04:44 2015 : Info: ++[expiration] = noop Sat Aug 22 12:04:44 2015 : Info: ++[logintime] = noop Sat Aug 22 12:04:44 2015 : Info: ++[pap] = noop Sat Aug 22 12:04:44 2015 : Info: +} # group authorize = updated Sat Aug 22 12:04:44 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:04:44 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:44 2015 : Info: +group authenticate { Sat Aug 22 12:04:44 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:04:44 2015 : Info: [eap] EAP/tls Sat Aug 22 12:04:44 2015 : Info: [eap] processing type tls Sat Aug 22 12:04:44 2015 : Info: [tls] Authenticate Sat Aug 22 12:04:44 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:04:44 2015 : Info: [tls] Received TLS ACK Sat Aug 22 12:04:44 2015 : Info: [tls] ACK handshake is finished Sat Aug 22 12:04:44 2015 : Info: [tls] eaptls_verify returned 3 Sat Aug 22 12:04:44 2015 : Info: [tls] eaptls_process returned 3 Sat Aug 22 12:04:44 2015 : Info: [tls] Adding user data to cached session Sat Aug 22 12:04:44 2015 : Info: [eap] Freeing handler Sat Aug 22 12:04:44 2015 : Info: ++[eap] = ok Sat Aug 22 12:04:44 2015 : Info: +} # group authenticate = ok Sat Aug 22 12:04:44 2015 : Auth: Login OK: [selen.kjonca] (from client ni port 2 cli 00-08-22-4F-62-54) Sat Aug 22 12:04:44 2015 : Info: # Executing section post-auth from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:04:44 2015 : Info: +group post-auth { Sat Aug 22 12:04:44 2015 : Info: ++[exec] = noop Sat Aug 22 12:04:44 2015 : Info: +} # group post-auth = noop Sat Aug 22 12:04:44 2015 : Info: Finished request 94. Sat Aug 22 12:04:44 2015 : Debug: Going to the next request Sat Aug 22 12:04:44 2015 : Debug: Thread 5 waiting to be assigned a request Sat Aug 22 12:04:45 2015 : Debug: Waking up in 3.9 seconds. Sat Aug 22 12:04:48 2015 : Info: Cleaning up request 89 ID 246 with timestamp +1696 Sat Aug 22 12:04:48 2015 : Info: Cleaning up request 90 ID 247 with timestamp +1696 Sat Aug 22 12:04:48 2015 : Info: Cleaning up request 91 ID 248 with timestamp +1696 Sat Aug 22 12:04:49 2015 : Info: Cleaning up request 92 ID 249 with timestamp +1697 Sat Aug 22 12:04:49 2015 : Info: Cleaning up request 93 ID 250 with timestamp +1697 Sat Aug 22 12:04:49 2015 : Info: Cleaning up request 94 ID 251 with timestamp +1697 Sat Aug 22 12:04:49 2015 : Info: Ready to process requests. Sat Aug 22 12:05:05 2015 : Debug: Thread 3 got semaphore Sat Aug 22 12:05:05 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:05:05 2015 : Debug: Thread 3 handling request 95, (20 handled so far) Sat Aug 22 12:05:05 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:05 2015 : Info: +group authorize { Sat Aug 22 12:05:05 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:05:05 2015 : Info: ++[chap] = noop Sat Aug 22 12:05:05 2015 : Info: ++[mschap] = noop Sat Aug 22 12:05:05 2015 : Info: ++[digest] = noop Sat Aug 22 12:05:05 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:05:05 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:05:05 2015 : Info: ++[suffix] = noop Sat Aug 22 12:05:05 2015 : Info: [eap] EAP packet type response id 60 length 17 Sat Aug 22 12:05:05 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:05:05 2015 : Info: ++[eap] = updated Sat Aug 22 12:05:05 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:05:05 2015 : Info: ++[files] = ok Sat Aug 22 12:05:05 2015 : Info: ++[expiration] = noop Sat Aug 22 12:05:05 2015 : Info: ++[logintime] = noop Sat Aug 22 12:05:05 2015 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Sat Aug 22 12:05:05 2015 : Info: ++[pap] = noop Sat Aug 22 12:05:05 2015 : Info: +} # group authorize = updated Sat Aug 22 12:05:05 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:05:05 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:05 2015 : Info: +group authenticate { Sat Aug 22 12:05:05 2015 : Info: [eap] EAP Identity Sat Aug 22 12:05:05 2015 : Info: [eap] processing type tls Sat Aug 22 12:05:05 2015 : Info: [tls] Requiring client certificate Sat Aug 22 12:05:05 2015 : Info: [tls] Initiate Sat Aug 22 12:05:05 2015 : Info: [tls] Start returned 1 Sat Aug 22 12:05:05 2015 : Info: ++[eap] = handled Sat Aug 22 12:05:05 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:05:05 2015 : Info: Finished request 95. Sat Aug 22 12:05:05 2015 : Debug: Going to the next request Sat Aug 22 12:05:05 2015 : Debug: Thread 3 waiting to be assigned a request Sat Aug 22 12:05:05 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:05:05 2015 : Debug: Thread 4 got semaphore Sat Aug 22 12:05:05 2015 : Debug: Thread 4 handling request 96, (20 handled so far) Sat Aug 22 12:05:05 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:05 2015 : Info: +group authorize { Sat Aug 22 12:05:05 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:05:05 2015 : Info: ++[chap] = noop Sat Aug 22 12:05:05 2015 : Info: ++[mschap] = noop Sat Aug 22 12:05:05 2015 : Info: ++[digest] = noop Sat Aug 22 12:05:05 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:05:05 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:05:05 2015 : Info: ++[suffix] = noop Sat Aug 22 12:05:05 2015 : Info: [eap] EAP packet type response id 61 length 204 Sat Aug 22 12:05:05 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:05:05 2015 : Info: ++[eap] = updated Sat Aug 22 12:05:05 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:05:05 2015 : Info: ++[files] = ok Sat Aug 22 12:05:05 2015 : Info: ++[expiration] = noop Sat Aug 22 12:05:05 2015 : Info: ++[logintime] = noop Sat Aug 22 12:05:05 2015 : Info: ++[pap] = noop Sat Aug 22 12:05:05 2015 : Info: +} # group authorize = updated Sat Aug 22 12:05:05 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:05:05 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:05 2015 : Info: +group authenticate { Sat Aug 22 12:05:05 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:05:05 2015 : Info: [eap] EAP/tls Sat Aug 22 12:05:05 2015 : Info: [eap] processing type tls Sat Aug 22 12:05:05 2015 : Info: [tls] Authenticate Sat Aug 22 12:05:05 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:05:05 2015 : Info: [tls] eaptls_verify returned 7 Sat Aug 22 12:05:05 2015 : Info: [tls] Done initial handshake Sat Aug 22 12:05:05 2015 : Info: [tls] (other): before/accept initialization Sat Aug 22 12:05:05 2015 : Info: [tls] TLS_accept: before/accept initialization Sat Aug 22 12:05:05 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:05:05 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 00c1], ClientHello Sat Aug 22 12:05:05 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:05 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:05:05 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 0039], ServerHello Sat Aug 22 12:05:05 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:05 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:05:05 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 0695], Certificate Sat Aug 22 12:05:05 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:05 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:05:05 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 00cb], ServerKeyExchange Sat Aug 22 12:05:05 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:05 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:05:05 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 000e], CertificateRequest Sat Aug 22 12:05:05 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:05 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:05 2015 : Info: [tls] TLS_accept: Need to read more data: unknown state Sat Aug 22 12:05:05 2015 : Debug: In SSL Handshake Phase Sat Aug 22 12:05:05 2015 : Debug: In SSL Accept mode Sat Aug 22 12:05:05 2015 : Info: [tls] eaptls_process returned 13 Sat Aug 22 12:05:05 2015 : Info: ++[eap] = handled Sat Aug 22 12:05:05 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:05:05 2015 : Info: Finished request 96. Sat Aug 22 12:05:05 2015 : Debug: Going to the next request Sat Aug 22 12:05:05 2015 : Debug: Thread 4 waiting to be assigned a request Sat Aug 22 12:05:05 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:05:05 2015 : Debug: Thread 1 got semaphore Sat Aug 22 12:05:05 2015 : Debug: Thread 1 handling request 97, (20 handled so far) Sat Aug 22 12:05:05 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:05 2015 : Info: +group authorize { Sat Aug 22 12:05:05 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:05:05 2015 : Info: ++[chap] = noop Sat Aug 22 12:05:05 2015 : Info: ++[mschap] = noop Sat Aug 22 12:05:05 2015 : Info: ++[digest] = noop Sat Aug 22 12:05:05 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:05:05 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:05:05 2015 : Info: ++[suffix] = noop Sat Aug 22 12:05:05 2015 : Info: [eap] EAP packet type response id 62 length 6 Sat Aug 22 12:05:05 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:05:05 2015 : Info: ++[eap] = updated Sat Aug 22 12:05:05 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:05:05 2015 : Info: ++[files] = ok Sat Aug 22 12:05:05 2015 : Info: ++[expiration] = noop Sat Aug 22 12:05:05 2015 : Info: ++[logintime] = noop Sat Aug 22 12:05:05 2015 : Info: ++[pap] = noop Sat Aug 22 12:05:05 2015 : Info: +} # group authorize = updated Sat Aug 22 12:05:05 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:05:05 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:05 2015 : Info: +group authenticate { Sat Aug 22 12:05:05 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:05:05 2015 : Info: [eap] EAP/tls Sat Aug 22 12:05:05 2015 : Info: [eap] processing type tls Sat Aug 22 12:05:05 2015 : Info: [tls] Authenticate Sat Aug 22 12:05:05 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:05:05 2015 : Info: [tls] Received TLS ACK Sat Aug 22 12:05:05 2015 : Info: [tls] ACK handshake fragment handler Sat Aug 22 12:05:05 2015 : Info: [tls] eaptls_verify returned 1 Sat Aug 22 12:05:05 2015 : Info: [tls] eaptls_process returned 13 Sat Aug 22 12:05:05 2015 : Info: ++[eap] = handled Sat Aug 22 12:05:05 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:05:05 2015 : Info: Finished request 97. Sat Aug 22 12:05:05 2015 : Debug: Going to the next request Sat Aug 22 12:05:05 2015 : Debug: Thread 1 waiting to be assigned a request Sat Aug 22 12:05:05 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:05:05 2015 : Debug: Thread 2 got semaphore Sat Aug 22 12:05:05 2015 : Debug: Thread 2 handling request 98, (20 handled so far) Sat Aug 22 12:05:05 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:05 2015 : Info: +group authorize { Sat Aug 22 12:05:05 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:05:05 2015 : Info: ++[chap] = noop Sat Aug 22 12:05:05 2015 : Info: ++[mschap] = noop Sat Aug 22 12:05:05 2015 : Info: ++[digest] = noop Sat Aug 22 12:05:05 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:05:05 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:05:05 2015 : Info: ++[suffix] = noop Sat Aug 22 12:05:05 2015 : Info: [eap] EAP packet type response id 63 length 13 Sat Aug 22 12:05:05 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:05:05 2015 : Info: ++[eap] = updated Sat Aug 22 12:05:05 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:05:05 2015 : Info: ++[files] = ok Sat Aug 22 12:05:05 2015 : Info: ++[expiration] = noop Sat Aug 22 12:05:05 2015 : Info: ++[logintime] = noop Sat Aug 22 12:05:05 2015 : Info: ++[pap] = noop Sat Aug 22 12:05:05 2015 : Info: +} # group authorize = updated Sat Aug 22 12:05:05 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:05:05 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:05 2015 : Info: +group authenticate { Sat Aug 22 12:05:05 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:05:05 2015 : Info: [eap] EAP/tls Sat Aug 22 12:05:05 2015 : Info: [eap] processing type tls Sat Aug 22 12:05:05 2015 : Info: [tls] Authenticate Sat Aug 22 12:05:05 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:05:05 2015 : Info: [tls] eaptls_verify returned 7 Sat Aug 22 12:05:05 2015 : Info: [tls] Done initial handshake Sat Aug 22 12:05:05 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:05:05 2015 : Info: [tls] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca Sat Aug 22 12:05:05 2015 : Error: TLS Alert read:fatal:unknown CA Sat Aug 22 12:05:05 2015 : Error: TLS_accept: failed in unknown state Sat Aug 22 12:05:05 2015 : Error: rlm_eap: SSL error error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca Sat Aug 22 12:05:05 2015 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Sat Aug 22 12:05:05 2015 : Debug: TLS receive handshake failed during operation Sat Aug 22 12:05:05 2015 : Info: [tls] eaptls_process returned 4 Sat Aug 22 12:05:05 2015 : Info: [eap] Handler failed in EAP/tls Sat Aug 22 12:05:05 2015 : Info: [eap] Failed in EAP select Sat Aug 22 12:05:05 2015 : Info: ++[eap] = invalid Sat Aug 22 12:05:05 2015 : Info: +} # group authenticate = invalid Sat Aug 22 12:05:05 2015 : Info: Failed to authenticate the user. Sat Aug 22 12:05:05 2015 : Auth: Login incorrect (TLS Alert read:fatal:unknown CA): [selen.kjonca] (from client ni port 2 cli 00-08-22-4F-62-54) Sat Aug 22 12:05:05 2015 : Info: Using Post-Auth-Type REJECT Sat Aug 22 12:05:05 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:05 2015 : Info: +group REJECT { Sat Aug 22 12:05:05 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> selen.kjonca Sat Aug 22 12:05:05 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Aug 22 12:05:05 2015 : Info: ++[attr_filter.access_reject] = updated Sat Aug 22 12:05:05 2015 : Info: +} # group REJECT = updated Sat Aug 22 12:05:05 2015 : Info: Delaying reject of request 98 for 1 seconds Sat Aug 22 12:05:05 2015 : Debug: Going to the next request Sat Aug 22 12:05:05 2015 : Debug: Thread 2 waiting to be assigned a request Sat Aug 22 12:05:06 2015 : Info: Sending delayed reject for request 98 Sat Aug 22 12:05:06 2015 : Debug: Waking up in 3.9 seconds. Sat Aug 22 12:05:07 2015 : Debug: Thread 5 got semaphore Sat Aug 22 12:05:07 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:05:07 2015 : Debug: Thread 5 handling request 99, (20 handled so far) Sat Aug 22 12:05:07 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:07 2015 : Info: +group authorize { Sat Aug 22 12:05:07 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:05:07 2015 : Info: ++[chap] = noop Sat Aug 22 12:05:07 2015 : Info: ++[mschap] = noop Sat Aug 22 12:05:07 2015 : Info: ++[digest] = noop Sat Aug 22 12:05:07 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:05:07 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:05:07 2015 : Info: ++[suffix] = noop Sat Aug 22 12:05:07 2015 : Info: [eap] EAP packet type response id 162 length 17 Sat Aug 22 12:05:07 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:05:07 2015 : Info: ++[eap] = updated Sat Aug 22 12:05:07 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:05:07 2015 : Info: ++[files] = ok Sat Aug 22 12:05:07 2015 : Info: ++[expiration] = noop Sat Aug 22 12:05:07 2015 : Info: ++[logintime] = noop Sat Aug 22 12:05:07 2015 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Sat Aug 22 12:05:07 2015 : Info: ++[pap] = noop Sat Aug 22 12:05:07 2015 : Info: +} # group authorize = updated Sat Aug 22 12:05:07 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:05:07 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:07 2015 : Info: +group authenticate { Sat Aug 22 12:05:07 2015 : Info: [eap] EAP Identity Sat Aug 22 12:05:07 2015 : Info: [eap] processing type tls Sat Aug 22 12:05:07 2015 : Info: [tls] Requiring client certificate Sat Aug 22 12:05:07 2015 : Info: [tls] Initiate Sat Aug 22 12:05:07 2015 : Info: [tls] Start returned 1 Sat Aug 22 12:05:07 2015 : Info: ++[eap] = handled Sat Aug 22 12:05:07 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:05:07 2015 : Info: Finished request 99. Sat Aug 22 12:05:07 2015 : Debug: Going to the next request Sat Aug 22 12:05:07 2015 : Debug: Thread 5 waiting to be assigned a request Sat Aug 22 12:05:07 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:05:07 2015 : Debug: Thread 3 got semaphore Sat Aug 22 12:05:07 2015 : Debug: Thread 3 handling request 100, (21 handled so far) Sat Aug 22 12:05:07 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:07 2015 : Info: +group authorize { Sat Aug 22 12:05:07 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:05:07 2015 : Info: ++[chap] = noop Sat Aug 22 12:05:07 2015 : Info: ++[mschap] = noop Sat Aug 22 12:05:07 2015 : Info: ++[digest] = noop Sat Aug 22 12:05:07 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:05:07 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:05:07 2015 : Info: ++[suffix] = noop Sat Aug 22 12:05:07 2015 : Info: [eap] EAP packet type response id 163 length 204 Sat Aug 22 12:05:07 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:05:07 2015 : Info: ++[eap] = updated Sat Aug 22 12:05:07 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:05:07 2015 : Info: ++[files] = ok Sat Aug 22 12:05:07 2015 : Info: ++[expiration] = noop Sat Aug 22 12:05:07 2015 : Info: ++[logintime] = noop Sat Aug 22 12:05:07 2015 : Info: ++[pap] = noop Sat Aug 22 12:05:07 2015 : Info: +} # group authorize = updated Sat Aug 22 12:05:07 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:05:07 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:07 2015 : Info: +group authenticate { Sat Aug 22 12:05:07 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:05:07 2015 : Info: [eap] EAP/tls Sat Aug 22 12:05:07 2015 : Info: [eap] processing type tls Sat Aug 22 12:05:07 2015 : Info: [tls] Authenticate Sat Aug 22 12:05:07 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:05:07 2015 : Info: [tls] eaptls_verify returned 7 Sat Aug 22 12:05:07 2015 : Info: [tls] Done initial handshake Sat Aug 22 12:05:07 2015 : Info: [tls] (other): before/accept initialization Sat Aug 22 12:05:07 2015 : Info: [tls] TLS_accept: before/accept initialization Sat Aug 22 12:05:07 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:05:07 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 00c1], ClientHello Sat Aug 22 12:05:07 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:07 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:05:07 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 0039], ServerHello Sat Aug 22 12:05:07 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:07 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:05:07 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 0695], Certificate Sat Aug 22 12:05:07 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:07 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:05:07 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 00cb], ServerKeyExchange Sat Aug 22 12:05:07 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:07 2015 : Info: [tls] >>> Unknown TLS version [length 0005] Sat Aug 22 12:05:07 2015 : Info: [tls] >>> TLS 1.0 Handshake [length 000e], CertificateRequest Sat Aug 22 12:05:07 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:07 2015 : Info: [tls] TLS_accept: unknown state Sat Aug 22 12:05:07 2015 : Info: [tls] TLS_accept: Need to read more data: unknown state Sat Aug 22 12:05:07 2015 : Debug: In SSL Handshake Phase Sat Aug 22 12:05:07 2015 : Debug: In SSL Accept mode Sat Aug 22 12:05:07 2015 : Info: [tls] eaptls_process returned 13 Sat Aug 22 12:05:07 2015 : Info: ++[eap] = handled Sat Aug 22 12:05:07 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:05:07 2015 : Info: Finished request 100. Sat Aug 22 12:05:07 2015 : Debug: Going to the next request Sat Aug 22 12:05:07 2015 : Debug: Thread 3 waiting to be assigned a request Sat Aug 22 12:05:07 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:05:07 2015 : Debug: Thread 4 got semaphore Sat Aug 22 12:05:07 2015 : Debug: Thread 4 handling request 101, (21 handled so far) Sat Aug 22 12:05:07 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:07 2015 : Info: +group authorize { Sat Aug 22 12:05:07 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:05:07 2015 : Info: ++[chap] = noop Sat Aug 22 12:05:07 2015 : Info: ++[mschap] = noop Sat Aug 22 12:05:07 2015 : Info: ++[digest] = noop Sat Aug 22 12:05:07 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:05:07 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:05:07 2015 : Info: ++[suffix] = noop Sat Aug 22 12:05:07 2015 : Info: [eap] EAP packet type response id 164 length 6 Sat Aug 22 12:05:07 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:05:07 2015 : Info: ++[eap] = updated Sat Aug 22 12:05:07 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:05:07 2015 : Info: ++[files] = ok Sat Aug 22 12:05:07 2015 : Info: ++[expiration] = noop Sat Aug 22 12:05:07 2015 : Info: ++[logintime] = noop Sat Aug 22 12:05:07 2015 : Info: ++[pap] = noop Sat Aug 22 12:05:07 2015 : Info: +} # group authorize = updated Sat Aug 22 12:05:07 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:05:07 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:07 2015 : Info: +group authenticate { Sat Aug 22 12:05:07 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:05:07 2015 : Info: [eap] EAP/tls Sat Aug 22 12:05:07 2015 : Info: [eap] processing type tls Sat Aug 22 12:05:07 2015 : Info: [tls] Authenticate Sat Aug 22 12:05:07 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:05:07 2015 : Info: [tls] Received TLS ACK Sat Aug 22 12:05:07 2015 : Info: [tls] ACK handshake fragment handler Sat Aug 22 12:05:07 2015 : Info: [tls] eaptls_verify returned 1 Sat Aug 22 12:05:07 2015 : Info: [tls] eaptls_process returned 13 Sat Aug 22 12:05:07 2015 : Info: ++[eap] = handled Sat Aug 22 12:05:07 2015 : Info: +} # group authenticate = handled Sat Aug 22 12:05:07 2015 : Info: Finished request 101. Sat Aug 22 12:05:07 2015 : Debug: Going to the next request Sat Aug 22 12:05:07 2015 : Debug: Thread 4 waiting to be assigned a request Sat Aug 22 12:05:07 2015 : Debug: Waking up in 0.9 seconds. Sat Aug 22 12:05:07 2015 : Debug: Thread 1 got semaphore Sat Aug 22 12:05:07 2015 : Debug: Thread 1 handling request 102, (21 handled so far) Sat Aug 22 12:05:07 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:07 2015 : Info: +group authorize { Sat Aug 22 12:05:07 2015 : Info: ++[preprocess] = ok Sat Aug 22 12:05:07 2015 : Info: ++[chap] = noop Sat Aug 22 12:05:07 2015 : Info: ++[mschap] = noop Sat Aug 22 12:05:07 2015 : Info: ++[digest] = noop Sat Aug 22 12:05:07 2015 : Info: [suffix] No '@' in User-Name = "selen.kjonca", looking up realm NULL Sat Aug 22 12:05:07 2015 : Info: [suffix] No such realm "NULL" Sat Aug 22 12:05:07 2015 : Info: ++[suffix] = noop Sat Aug 22 12:05:07 2015 : Info: [eap] EAP packet type response id 165 length 13 Sat Aug 22 12:05:07 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sat Aug 22 12:05:07 2015 : Info: ++[eap] = updated Sat Aug 22 12:05:07 2015 : Info: [files] users: Matched entry selen.kjonca at line 12 Sat Aug 22 12:05:07 2015 : Info: ++[files] = ok Sat Aug 22 12:05:07 2015 : Info: ++[expiration] = noop Sat Aug 22 12:05:07 2015 : Info: ++[logintime] = noop Sat Aug 22 12:05:07 2015 : Info: ++[pap] = noop Sat Aug 22 12:05:07 2015 : Info: +} # group authorize = updated Sat Aug 22 12:05:07 2015 : Info: Found Auth-Type = EAP Sat Aug 22 12:05:07 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:07 2015 : Info: +group authenticate { Sat Aug 22 12:05:07 2015 : Info: [eap] Request found, released from the list Sat Aug 22 12:05:07 2015 : Info: [eap] EAP/tls Sat Aug 22 12:05:07 2015 : Info: [eap] processing type tls Sat Aug 22 12:05:07 2015 : Info: [tls] Authenticate Sat Aug 22 12:05:07 2015 : Info: [tls] processing EAP-TLS Sat Aug 22 12:05:07 2015 : Info: [tls] eaptls_verify returned 7 Sat Aug 22 12:05:07 2015 : Info: [tls] Done initial handshake Sat Aug 22 12:05:07 2015 : Info: [tls] <<< Unknown TLS version [length 0005] Sat Aug 22 12:05:07 2015 : Info: [tls] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca Sat Aug 22 12:05:07 2015 : Error: TLS Alert read:fatal:unknown CA Sat Aug 22 12:05:07 2015 : Error: TLS_accept: failed in unknown state Sat Aug 22 12:05:07 2015 : Error: rlm_eap: SSL error error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca Sat Aug 22 12:05:07 2015 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Sat Aug 22 12:05:07 2015 : Debug: TLS receive handshake failed during operation Sat Aug 22 12:05:07 2015 : Info: [tls] eaptls_process returned 4 Sat Aug 22 12:05:07 2015 : Info: [eap] Handler failed in EAP/tls Sat Aug 22 12:05:07 2015 : Info: [eap] Failed in EAP select Sat Aug 22 12:05:07 2015 : Info: ++[eap] = invalid Sat Aug 22 12:05:07 2015 : Info: +} # group authenticate = invalid Sat Aug 22 12:05:07 2015 : Info: Failed to authenticate the user. Sat Aug 22 12:05:07 2015 : Auth: Login incorrect (TLS Alert read:fatal:unknown CA): [selen.kjonca] (from client ni port 2 cli 00-08-22-4F-62-54) Sat Aug 22 12:05:07 2015 : Info: Using Post-Auth-Type REJECT Sat Aug 22 12:05:07 2015 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sat Aug 22 12:05:07 2015 : Info: +group REJECT { Sat Aug 22 12:05:07 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> selen.kjonca Sat Aug 22 12:05:07 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Aug 22 12:05:07 2015 : Info: ++[attr_filter.access_reject] = updated Sat Aug 22 12:05:07 2015 : Info: +} # group REJECT = updated Sat Aug 22 12:05:07 2015 : Info: Delaying reject of request 102 for 1 seconds Sat Aug 22 12:05:07 2015 : Debug: Going to the next request Sat Aug 22 12:05:07 2015 : Debug: Thread 1 waiting to be assigned a request Sat Aug 22 12:05:08 2015 : Info: Sending delayed reject for request 102 Sat Aug 22 12:05:08 2015 : Debug: Waking up in 1.7 seconds. Sat Aug 22 12:05:10 2015 : Info: Cleaning up request 95 ID 252 with timestamp +1718 Sat Aug 22 12:05:10 2015 : Info: Cleaning up request 96 ID 253 with timestamp +1718 Sat Aug 22 12:05:10 2015 : Info: Cleaning up request 97 ID 254 with timestamp +1718 Sat Aug 22 12:05:10 2015 : Debug: Waking up in 1.0 seconds. Sat Aug 22 12:05:11 2015 : Info: Cleaning up request 98 ID 255 with timestamp +1718 Sat Aug 22 12:05:11 2015 : Debug: Waking up in 1.2 seconds. Sat Aug 22 12:05:12 2015 : Info: Cleaning up request 99 ID 0 with timestamp +1720 Sat Aug 22 12:05:12 2015 : Info: Cleaning up request 100 ID 1 with timestamp +1720 Sat Aug 22 12:05:12 2015 : Info: Cleaning up request 101 ID 2 with timestamp +1720 Sat Aug 22 12:05:12 2015 : Debug: Waking up in 1.0 seconds. Sat Aug 22 12:05:13 2015 : Info: Cleaning up request 102 ID 3 with timestamp +1720 Sat Aug 22 12:05:13 2015 : Info: Ready to process requests. -- http://wolnelektury.pl/wesprzyj/teraz/ share, n.: To give in, endure humiliation.

3 7

freeradius not starting when default rediswho module is enabled - freeradius 3.0.10 - current git
by Michal Tomaszewski 21 Aug '15

21 Aug '15

Hi all, After enabling rediswho module and adding rediswho to accounting section (and only this section) there is an error: Fri Aug 21 16:06:29 2015 : Debug: Loading library using absolute path "//lib/rlm_rediswho.so" Fri Aug 21 16:06:29 2015 : Debug: Loaded rlm_rediswho, checking if it's valid Fri Aug 21 16:06:29 2015 : Debug: # Loaded module rlm_rediswho Fri Aug 21 16:06:29 2015 : Debug: # Loading module "rediswho" from file //etc/raddb/mods-enabled/rediswho Fri Aug 21 16:06:29 2015 : Debug: rediswho { Fri Aug 21 16:06:29 2015 : Debug: redis_module_instance = "redis" Fri Aug 21 16:06:29 2015 : Debug: trim_count = 15 Fri Aug 21 16:06:29 2015 : Error: //etc/raddb/mods-enabled/rediswho[10]: Configuration item "insert" must have a value Fri Aug 21 16:06:29 2015 : Error: //etc/raddb/mods-enabled/rediswho[10]: Invalid configuration for module "rediswho" Default configuration of rediswho from mods-enabled is used. As I understand the file /mods-available/rediswho should have e.g. changed sections. It probably has changed since freeradius 2.x. Can you advice the correct one? Regards, Michał Tomaszewski ________________________________________ Uwaga: Treść niniejszej wiadomości może być poufna i objęta zakazem jej ujawniania. Jeśli czytelnik tej wiadomości nie jest jej zamierzonym adresatem, pracownikiem lub pośrednikiem upoważnionym do jej przekazania adresatowi, informujemy że wszelkie rozprowadzanie, rozpowszechnianie lub powielanie niniejszej wiadomości jest zabronione. Jeśli otrzymałeś tę wiadomość omyłkowo, proszę bezzwłocznie odesłać ją nadawcy, a samą wiadomość usunąć z komputera. Dziękujemy. ________________________________ Note: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.If you have received this communication in error, please notify the sender immediately by replying to the message and deleting it from your computer. Thank you. ________________________________

2 2

PAM_Radius EAP-TTLS
by Qrious 21 Aug '15

21 Aug '15

Hi, I'm setting up a RADIUS server which among others has to be linked to PAM. One of my primary requirements is that is uses secure cryptography. The main question is: 1. Does the PAM Radius module support EAP-TTLS with an inner tunnel of PAP? I did some research and came accross http://lists.freeradius.org/pipermail/freeradius-users/2013-December/069408…, which unfortunately doesn't answer my question. I scanned through the sourcecode of the PAM_radius module, which does not have any indication of TLS support. Background: Most supported protocols are based on MD5, which has been severly comprimised[1], or a single DES key (MSCHAP V2) [2], which is also comprimised. So that only leaves the TLS based protocols, Based on [3] I assume I should use PAP for the inner tunnel, because this enables me to store hashed password (will use SSHA512). If you know a more secure setup, don't hesitate to advice me :). Also if I made a mistake somewhere, don't hesitate to correct me :) As a final remark, I think it would be beneficial for the security of many account details, both transfered and stored for (FREE)RADIUS, to include clear warnings on the pages about insecure protocols/authentication standards. [1] https://en.wikipedia.org/wiki/MD5 [2] https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/ [3] http://deployingradius.com/documents/protocols/compatibility.html

3 5

rlm_counter in v3.1.x
by Arran Cudbard-Bell 21 Aug '15

21 Aug '15

The width of the counter fields in rlm_counter has been increased to 64bits in v3.1.x. When upgrading you will need to re-create the counter databases, or move to rlm_sqlcounter. If anyone using rlm_counter has a huge issue with this, then let us know, and we'll determine a better upgrade path. This is also mentioned in the v3.0.x -> v3.1.x upgrade document. https://github.com/FreeRADIUS/freeradius-server/tree/v3.1.x/raddb I suspect not many people use the GDBM based modules anymore, and that they're mostly vestigial. -Arran

1 0

Hash/Salt password with mysql
by Moataz Elmasry 20 Aug '15

20 Aug '15

Hi all, I'm trying to configure freeradius with mysql authentication. Specifically I'm trying to use a somehow longer hash. I came upon the thread http://lists.freeradius.org/pipermail/freeradius-users/2015-January/075505.… Which explains using update control to query hash and salt from the database. It goes something like this: update control { Tmp-String-0 := "%{sql:SELECT hash FROM <table> WHERE <clause>}" Tmp-String-1 := "%{sql:SELECT salt FROM <table> WHERE <clause>}" } update control { SSHA2-512-Password := "0x%{control:Tmp-String-0}%{control:Tmp-String-1}" } This is probably a beginners question, but I don't know what to put in the where clause as I don't know which parameters are available at the time of calling this, ideally the statement will look like this: Assume table: users(id, username, hash, salt) update control { Tmp-String-0 := "%{sql:SELECT hash FROM users WHERE <USERNAME_CONNECTING = username>}" Tmp-String-1 := "%{sql:SELECT salt FROM users WHERE <USERNAME_CONNECTING = username>}" } Any idea how to achieve that? Sepcifically how to get the username the user is currently submitting

2 6

FreeRadius + Postgresql newbie
by Guillermo Narvaez 20 Aug '15

20 Aug '15

Hi, I'm installing FreeRadius with Postgresql after a couple of years of using plain text files, all the SQL thing was created but I can't realize where is the Users table. Can anyone help me? Thanks!

3 7

reloading configuration
by Marcin 20 Aug '15

20 Aug '15

Hi When configuration users file is reloaded by sending SIGHUP * http://wiki.freeradius.org/guide/FAQ#How-do-I-get-radius-to-pick-up-changes…) does radius reconnect all database connections which it has established? -- Regards Marcin / nicraM

3 5