- Freeradius-Users - lists.freeradius.org

3.0.9: Failed to parse log section
by Lai Fu Keung 20 Jul '15

20 Jul '15

Hi, In v3.0.9, I uncomment the "request" log in radius.log requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log When running radiusd, it give me error, "radiusd: Error: Failed to parse log {} section". Commenting back the line gives no error. What is the problem? It was OK with v3.0.8. Fu

1 0

Centos 7 with Freeradius 3.0.4 : smsotp supported ?
by usersurweb 19 Jul '15

19 Jul '15

Hi I am new to this forum. I have been using FreeRadius 2.1 (CentOs 6) with smsotp for a long time. Now I am trying to upgrade to FreeRadius 3.0.4 (CentOs7) but I can't build Smsotp module. After ./configure command, there is no make file created to build the module. Any help to build the module would be appreciated. Thanks. Regards. Pras.

5 11

(no subject)
by ankita therese 17 Jul '15

17 Jul '15

Hi, I'm having trouble getting FreeRADIUS to recognize the group of a user using sql. I'm running version 3.0.8, and as far as I can tell, everything runs smoothly up to the authorize_group_check_query. It executes, but after this, on debugging with radiusd -XX, authentication breaks off with Debug: (0) sql: ... falling-through to profile processing Debug: rlm_sql (sql): Released connection (4) The output of radiusd -X is as follows. Group attribute values are not verified or added to reply. I tried increasing minimum no of sql connections, but that just makes radius tell me i have too many idle connections and need to reduce min. (0) Received Access-Request Id 153 from 127.0.0.1:49747 to 127.0.1.1:1812 length 85 (0) User-Name = 'mynewuser' (0) User-Password = 'password' (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0x32010b83ba8a72dd523a231e353d1a1b (0) Framed-Protocol = PPP (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "mynewuser", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry DEFAULT at line 182 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> mynewuser (0) sql: SQL-User-Name set to 'mynewuser' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mynewuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mynewuser' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := 'password' (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mynewuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mynewuser' ORDER BY id (0) sql: User found in radreply table, merging reply items (0) sql: Reply-Message = 'OK' (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'mynewuser' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'mynewuser' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'student' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'student' ORDER BY id rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND %{User-Name} (0) sql: --> mynewuser (0) sql: SQL-User-Name set to 'mynewuser' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mynewuser', 'password', 'Access-Accept', '2015-07-12 20:57:34') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mynewuser', 'password', 'Access-Accept', '2015-07-12 20:57:34') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 153 from 127.0.1.1:1812 to 127.0.0.1:49747 length 0 (0) Framed-Protocol = PPP (0) Framed-Compression = Van-Jacobson-TCP-IP (0) Reply-Message = 'OK' (0) Finished request Thank you

3 3

Freeradius 3.0.4 - CentOS7 - no SQL log will be create
by Andre Schwarzer 16 Jul '15

16 Jul '15

Hello, When i activate the SQL log, still no log file is created. Am I doing something wrong or is it a bug? The following parameters are active logfile = /var/log/radius/sqllog.SQL driver = "rlm_sql_mysql" and is test logfile = /var/log/radius/sqllog.SQL driver = "rlm_sql_null" but with the second Settings i get a reject from the SQL Server. With the first all works fine, but no log was created. Regardes Andre

2 1

Freeradius 3.0 - SQL - spare connections?
by Andre Schwarzer 16 Jul '15

16 Jul '15

Hello, have installed a new freeradius 3.0, bevor i worked with the Version 1. I see in my Test´s, in the radius.log the Messages below. I don´t know what are spare Connections, what they do and for what the radius use this. Additional i don´t know why i get this messeges with the Default Settings. Can some one explain me the usage of the spare Connections, best by an example. Wed Jul 15 13:34:25 2015 : Info: rlm_sql (sql): 0 of 5 connections in use. Need more spares Wed Jul 15 13:34:25 2015 : Info: rlm_sql (sql): Opening additional connection (12) Regardes

4 6

Dynamic proxies??
by Peter Lambrechtsen 16 Jul '15

16 Jul '15

I suspect the answer will be "patches welcome" but... Has anyone ever thought of having a similar module as dynamic clients where you can pull proxies for external realms from an external source using unlang such as sql or ldap?? I have an interesting use case where I am looking to replace an existing radius proxy server with FreeRadius that has a lot of downstream proxies. So far the the best option I have is to copy the proxies.conf across all the instances and HUP the config whenever a new realm is added or removed and wondered if there was a smarter way to do it. Cheers Peter

3 5

MySQL group authentication problem (v3.0.8)
by ankita therese 16 Jul '15

16 Jul '15

Hi, I'm having trouble getting FreeRADIUS to recognize the group of a user using sql. I'm running version 3.0.8, and as far as I can tell, everything runs smoothly up to the authorize_group_check_query. It executes, but after this, on debugging with radiusd -XX, authentication breaks off with Debug: (0) sql: ... falling-through to profile processing Debug: rlm_sql (sql): Released connection (4) The output of radiusd -X is as follows. Group attribute values are not verified or added to reply. I tried increasing minimum no of sql connections, but that just makes radius tell me i have too many idle connections and need to reduce min. (0) Received Access-Request Id 153 from 127.0.0.1:49747 to 127.0.1.1:1812 length 85 (0) User-Name = 'mynewuser' (0) User-Password = 'password' (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 0 (0) Message-Authenticator = 0x32010b83ba8a72dd523a231e353d1a1b (0) Framed-Protocol = PPP (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "mynewuser", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry DEFAULT at line 182 (0) [files] = ok (0) sql: EXPAND %{User-Name} (0) sql: --> mynewuser (0) sql: SQL-User-Name set to 'mynewuser' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mynewuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mynewuser' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := 'password' (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mynewuser' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mynewuser' ORDER BY id (0) sql: User found in radreply table, merging reply items (0) sql: Reply-Message = 'OK' (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'mynewuser' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'mynewuser' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'student' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'student' ORDER BY id rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql: EXPAND %{User-Name} (0) sql: --> mynewuser (0) sql: SQL-User-Name set to 'mynewuser' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mynewuser', 'password', 'Access-Accept', '2015-07-12 20:57:34') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'mynewuser', 'password', 'Access-Accept', '2015-07-12 20:57:34') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 153 from 127.0.1.1:1812 to 127.0.0.1:49747 length 0 (0) Framed-Protocol = PPP (0) Framed-Compression = Van-Jacobson-TCP-IP (0) Reply-Message = 'OK' (0) Finished request Thank you

1 0

sending requests to a virtual server when behind a proxy
by Louis Munro 15 Jul '15

15 Jul '15

Hello, I have a set of servers behind two FreeRADIUS servers configured to proxy and load balance to a pool of backend FR servers (2.26 both on the load balancers and backend). I would like to send some requests to a different virtual server on the backend to authenticate our VPN requests separately from the regular Wireless authentications. I can set the virtual server in the client definition (on the backend servers) and that seems to work well but when the requests are proxied through the load-balancers the client is the proxying server and so my virtual server config is not applied. I could alway send those requests to a virtual server listening on a different port on the backend, but I would like to avoid that if there is a way. That just adds more complexity and ports to manage in firewall and such. Am I missing something obvious? I don’t think this could be done using dynamic clients since I can’t inspect the NAS-IP-Address there. Any other way that someone can think of? Your help is much appreciated, -- Louis Munro lmunro(a)inverse.ca :: www.inverse.ca +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

3 3

MySQL Authentication Problem (v3.0.3)
by Pyromancer 15 Jul '15

15 Jul '15

I am attempting to build a replacement radius server for a client who's primary v2.0.2 machine has gone down for good. There is a secondary so service continues for now. The old system had a very complex config which hands off lots of realms to LNSs and also does authentication for non-handed-off users via MySQL. Initially I attempted to replicate the original server on a newly installed machine, however FR 2.0.2 refused to compile with MySQL on the new box (Current SuSE, vendor MySQL). So I've installed the vendor FreeRadius (3.0.3 64bit). Initially I tried using the existing config copied from the secondary box, after commenting out all the depreciated attributes it ran and talked to MySQL however refused to authenticate a test user. Research led to the Wiki and mailing list, comments re changing the default config as little as possible (and potentially greater b0rkake the more this is ignored noted), So having backed up the original config I cleared it and am starting from scratch with the default one, and slowly adding in the features of the client's original system. This has the side benefit of removing a lot of redundant stuff from the files. However it's refusing to authenticate the MySQL users, giving a no known good password error, even though the cleartext password is present in the database and matches what radtest is submitting. The output from radiusd -X is below - the obvious problem is the "(0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type." line. But look above that and the user is found in the radcheck table - there are no group entries as this is a purely local auth-only user. This user was able to authenticate from radtest on the old server (and still is on the secondary), the databases are identical. I know there's another error further down regarding the accounting due to a missing table, but as that's after the auth section I'm assuming that won't be related to why a reject is being generated. I've tried running -X -x and -xx to get more detailed debug, but it doesn't reveal any more information on why the reject is being generated. The database entry looks like this: mysql> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'xktester' ORDER BY id; +------+------------+----------------------+------------------------------+----+ | id | username | attribute | value | op | +------+------------+----------------------+------------------------------+----+ | 3983 | xktester | Cleartext-Password | correct_horse_battery_staple | == | +------+------------+----------------------+------------------------------+----+ 1 row in set (0.00 sec) radiusd -X output: Received Access-Request Id 228 from 127.0.0.1:60330 to 127.0.0.1:21812 length 76 User-Name = 'xktester' User-Password = 'correct_horse_battery_staple' NAS-IP-Address = 192.168.142.85 NAS-Port = 10 Message-Authenticator = 0x48c52fb5b7f81584a37eccc1eb44a643 (0) # Executing section authorize from file /etc/raddb_ADSL//sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") (0) EXPAND %{tolower:%{User-Name}} (0) --> xktester (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (User-Name =~ /\\.$/) (0) if (User-Name =~ /\\.$/) -> FALSE (0) if (User-Name =~ /(a)\\./) (0) if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "xktester", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql : EXPAND %{User-Name} (0) sql : --> xktester (0) sql : SQL-User-Name set to 'xktester' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'xktester' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'xktester' ORDER BY id' (0) sql : User found in radcheck table (0) sql : EXPAND # SELECT groupname # FROM radusergroup # WHERE username = BINARY '%{SQL-User-Name}' # ORDER BY priority (0) sql : --> # SELECT groupname # FROM radusergroup # WHERE username = BINARY 'xktester' # ORDER BY priority rlm_sql (sql): Executing query: '# SELECT groupname # FROM radusergroup # WHERE username = BINARY 'xktester' # ORDER BY priority' rlm_sql_mysql: MYSQL Error: No Fields rlm_sql_mysql: MYSQL error: (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) (0) [sql] = noop (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (0) WARNING: pap : Authentication will fail unless a "known good" password is available. (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user. (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb_ADSL//sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql : EXPAND .query (0) sql : --> .query (0) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND %{User-Name} (0) sql : --> xktester (0) sql : SQL-User-Name set to 'xktester' (0) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'xktester', 'correct_horse_battery_staple', 'Access-Reject', '2015-07-15 20:38:03') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'xktester', 'correct_horse_battery_staple', 'Access-Reject', '2015-07-15 20:38:03')' rlm_sql_mysql: MYSQL check_error: 1146 received rlm_sql (sql): Table 'radius_ADSL.radpostauth' doesn't exist rlm_sql_mysql: MYSQL check_error: 1146 received rlm_sql_mysql: Cannot store result rlm_sql_mysql: MySQL error 'Table 'radius_ADSL.radpostauth' doesn't exist' (0) sql : No additional queries configured rlm_sql (sql): Released connection (4) (0) [sql] = noop (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> xktester (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (0) [eap] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (reply:EAP-Message && reply:Reply-Message) (0) if (reply:EAP-Message && reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response Sending Access-Reject Id 228 from 127.0.0.1:21812 to 127.0.0.1:60330 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 228 with timestamp +10 Ready to process requests.

3 5

freeradius-3.0 problem with EAP-TTLS
by Till Dörges 15 Jul '15

15 Jul '15

[Not sure where to report this. So please advise, if there's a more suitable place.] Dear all, When upgrading our running freeradius-2.2 configuration for EAP-TTLS to freeradius-3.0 we followed the guide from http://freeradius.org/version3.html and almost everything was running in our test environment except one point already discussed similarly: http://lists.freeradius.org/pipermail/freeradius-users/2015-March/076365.ht… We had the same problem with our wpa_supplicant and Oddyssey clients: The very last ACK from the client was not well recognized by freeradius-3 with the same DEBUG message, also see (partly obfuscated radius.debug.txt): Login incorrect (eap_ttls: Invalid ACK received: 0) Encouraged from the thread follow-up http://lists.freeradius.org/pipermail/freeradius-users/2015-May/077614.html we checked the values returned to the method tls_ack_handler() in src/main/tls.c : In fact we found for the last ACK: ssn->info.content_type == 0 (instead of handshake == 22) ssn->info.handshake_type == handshake_finished (expected 20) ssn->dirty_out.used == 0 In order to make it work, we patched freeradius-3 like this (also see attachments tls.c.patch and tls.c.original): $ diff tls.c.patch tls.c.original 3130,3134d3129 < /* patch needed for many versions of TTLS clients, compare http://lists.freeradius.org/pipermail/freeradius-users/2015-May/077614.html */ < if ((ssn->info.handshake_type == handshake_finished) && (ssn->dirty_out.used == 0)) { < ssn->info.content_type = handshake; < } < HTH -- Till -- Dipl.-Inform. Till Dörges doerges(a)pre-sense.de Tel. +49 - 40 - 244 2407 - 14 Fax +49 - 40 - 244 2407 - 24 PRESENSE Technologies GmbH Sachsenstr. 5, D-20097 HH Geschäftsführer/Managing Directors AG Hamburg, HRB 107844 Till Dörges, Jürgen Sander USt-IdNr.: DE263765024

2 1