- Freeradius-Users - lists.freeradius.org

QUERY_REGARDING PFX
by pavani 21 May '15

21 May '15

Hi All, Can any one tell me how to install certificates with pfx format On radius server side.for EAP-TLS mode. Please reply me as soon as possible. Thanks pavani

2 1

Re: How to enable Access-challenge in Free radius
by sridhar Varadarajan 21 May '15

21 May '15

On May 7, 2015, at 3:17 AM, sridharww(a)yahoo.co.in wrote: > I am using Free Radius version of 1.1.7-r0.0.2 Wow... upgrade to a version released in the last 8 years. > When i searched for windows version, i could only get http://freeradius.net/Downloads.html site where 1.1.7 is the pointer for it. No other binaries are shown here. So I have taken the version of linux (version 3) and installed in REDHAT box. faced following problem with openssl https://www.openssl.org/news/secadv_20140407.txt Even i have upgraded openssl in my box to 1.0.2g and did configure , make and make install of radius tool but still it throws the same error. openssl downloaded from : http://www.linuxfromscratch.org/blfs/view/svn/postlfs/openssl.html I edited security.allow_vulnerable_openssl = 'CVE-2014-0160' or security.allow_vulnerable_openssl = no or security.allow_vulnerable_openssl = yes or allow_vulnerable_openssl = yes or allow_vulnerable_openssl = no or allow_vulnerable_openssl = 'CVE-2014-0160' followed by again configure, make , make install. but still its not working. following is seen when trying to start up the server. security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" Debugger not attachedRefusing to start with libssl version OpenSSL 1.0.1e-fips 11 Feb 2013 0x1000105f (1.0.1e release) (in range 1.0.1 dev - 1.0.1f release)Security advisory CVE-2014-0160 (Heartbleed)For more information see http://heartbleed.comOnce you have verified libssl has been correctly patched, set security.allow_vulnerable_openssl = 'CVE-2014-0160' I think some more things needs to be done to overcome this problem. > I have an software where i will provide my RADIUS server details i.e. IP address, port to communicate, protocol (in my case i either use CHAP or PAP) > > So when i am trying to login to the software i will provide username and password which will be parsed to the Freeradius installed server which will check in radius server database (users.conf) file. Based on the permission i have provided it allows me to login to my software and if the user is missing in that conf file then it will deny my access > > Now, i need to provide second level authentication i.e. secure ID token in addition to the username and password . > > FOr this i believe if i enable access-challenge in Free radius tool, then if any user login request comes in i.e. access-request packet then i expect Free radius should validate the request and if the user is present in radius tool then it challenge my software with access-challenge request . Modern versions of FreeRADIUS include an rlm_securid module. You can use that. >I found a Freed radius along with my REDHAT OS which i have installed using yum command and its successful too. Now i can able to access my software with normal authentication but i need to add it more with secure ID + access challenge part. Can you guide me on this now. I am also surfing internet to find some guides / solutions to get it configured in Free radius tool.Below are the log outputs taken from radius server. RADIUS details:Authentication request: Fri May 8 13:49:21 2015 Packet-Type = Access-Request NAS-Port = 825766194 Attr-4 = 0x3132372e302e302e31 User-Name = "test" Reply for request:Fri May 8 13:49:21 2015Packet-Type = Access-Accept Name : freeradiusArch : x86_64Version : 2.1.12Release : 6.el6Size : 5.7 MRepo : installedFrom repo : rhel-x86_64-server-6 Can you guide me on the further steps to configure the access-challenge + secure ID part now. hope this version of linux shoud do the needful. > Alan DeKok. From: Alan DeKok <aland(a)deployingradius.com> To: sridharww(a)yahoo.co.in Sent: Thursday, 7 May 2015 7:13 PM Subject: Re: How to enable Access-challenge in Free radius On May 7, 2015, at 3:17 AM, sridharww(a)yahoo.co.in wrote: > I am using Free Radius version of 1.1.7-r0.0.2 Wow... upgrade to a version released in the last 8 years. > I have an software where i will provide my RADIUS server details i.e. IP address, port to communicate, protocol (in my case i either use CHAP or PAP) > > So when i am trying to login to the software i will provide username and password which will be parsed to the Freeradius installed server which will check in radius server database (users.conf) file. Based on the permission i have provided it allows me to login to my software and if the user is missing in that conf file then it will deny my access > > Now, i need to provide second level authentication i.e. secure ID token in addition to the username and password . > > FOr this i believe if i enable access-challenge in Free radius tool, then if any user login request comes in i.e. access-request packet then i expect Free radius should validate the request and if the user is present in radius tool then it challenge my software with access-challenge request . Modern versions of FreeRADIUS include an rlm_securid module. You can use that. > Alan DeKok.

1 1

Access request always return reject
by J Kephart 21 May '15

21 May '15

Good day! We've just compiled FR 2.2.7 on a CentOS 6.6 system, preparatory to migrating from our old 2.1.12 release. When we ran the initial test, under "radius -X," we got the expected reject, because there was no user named "test." We then added that user to the users file (the only change we made), with just the username and cleartext-password, and ran the test again, and it still returned a reject. I'm posting the output from "radius -X" below. We've essentially the same config on the older server, and we've never encountered the problem there, so it seems fairly obvious that something's wrong; we just can't tell what it is. I do see that it says "++[reject] = reject", but I'm not seeing the cause. One note however: In the output, at line 190, we see "server { # from file /usr/loc" followed by a bunch of gibberish. I'm not sure that's a real concern, but it does seem odd. In any case, the debug output is below. I'd appreciate it if someone could point me to the problem. Many thanks! Jim 1: Wed May 20 16:46:25 2015 : Info: radiusd: FreeRADIUS Version 2.2.7, for host x86_64-unknown-linux-gnu, built on May 20 2015 at 16:45:16 2: Wed May 20 16:46:25 2015 : Debug: Server was built with: 3: Wed May 20 16:46:25 2015 : Debug: accounting 4: Wed May 20 16:46:25 2015 : Debug: authentication 5: Wed May 20 16:46:25 2015 : Debug: WITH_DHCP 6: Wed May 20 16:46:25 2015 : Debug: WITH_VMPS 7: Wed May 20 16:46:25 2015 : Debug: Server core libs: 8: Wed May 20 16:46:25 2015 : Debug: ssl: OpenSSL 1.0.1e-fips 11 Feb 2013 9: Wed May 20 16:46:25 2015 : Info: Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. 10: Wed May 20 16:46:25 2015 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A 11: Wed May 20 16:46:25 2015 : Info: PARTICULAR PURPOSE. 12: Wed May 20 16:46:25 2015 : Info: You may redistribute copies of FreeRADIUS under the terms of the 13: Wed May 20 16:46:25 2015 : Info: GNU General Public License. 14: Wed May 20 16:46:25 2015 : Info: For more information about these matters, see the file named COPYRIGHT. 15: Wed May 20 16:46:25 2015 : Info: Starting - reading configuration files ... 16: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf 17: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf 18: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/clients.conf 19: Wed May 20 16:46:25 2015 : Debug: including files in directory /usr/local/etc/raddb/modules/ 20: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax 21: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/chap 22: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/unix 23: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com 24: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/always 25: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap 26: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/detail 27: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/redis 28: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log 29: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/perl 30: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/radrelay 31: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/pap 32: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess 33: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp 34: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/otp 35: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd 36: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/files 37: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/digest 38: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/policy 39: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/realm 40: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/dynamic_clients 41: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/opendirectory 42: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp 43: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd 44: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/echo 45: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/exec 46: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime 47: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/cui 48: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp 49: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration 50: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique 51: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 52: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/ntlm_auth 53: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval 54: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter 55: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log 56: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/counter 57: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/dhcp_sqlippool 58: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/sql/mysql/ippool-dhcp.conf 59: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/expr 60: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/cache 61: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite 62: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip 63: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool 64: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog 65: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/pam 66: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/soh 67: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap 68: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login 69: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap 70: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan 71: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/replicate 72: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group 73: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/modules/rediswho 74: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/eap.conf 75: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/policy.conf 76: Wed May 20 16:46:25 2015 : Debug: including files in directory /usr/local/etc/raddb/sites-enabled/ 77: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default 78: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel 79: Wed May 20 16:46:25 2015 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket 80: Wed May 20 16:46:25 2015 : Debug: main { 81: Wed May 20 16:46:25 2015 : Debug: allow_core_dumps = no 82: Wed May 20 16:46:25 2015 : Debug: } 83: Wed May 20 16:46:25 2015 : Debug: including dictionary file /usr/local/etc/raddb/dictionary 84: Wed May 20 16:46:25 2015 : Debug: main { 85: Wed May 20 16:46:25 2015 : Debug: name = "radiusd" 86: Wed May 20 16:46:25 2015 : Debug: prefix = "/usr/local" 87: Wed May 20 16:46:25 2015 : Debug: localstatedir = "/usr/local/var" 88: Wed May 20 16:46:25 2015 : Debug: sbindir = "/usr/local/sbin" 89: Wed May 20 16:46:25 2015 : Debug: logdir = "/var/log/radius" 90: Wed May 20 16:46:25 2015 : Debug: run_dir = "/usr/local/var/run/radiusd" 91: Wed May 20 16:46:25 2015 : Debug: libdir = "/usr/local/lib" 92: Wed May 20 16:46:25 2015 : Debug: radacctdir = "/var/log/radius/radacct" 93: Wed May 20 16:46:25 2015 : Debug: hostname_lookups = no 94: Wed May 20 16:46:25 2015 : Debug: max_request_time = 30 95: Wed May 20 16:46:25 2015 : Debug: cleanup_delay = 5 96: Wed May 20 16:46:25 2015 : Debug: max_requests = 1024 97: Wed May 20 16:46:25 2015 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" 98: Wed May 20 16:46:25 2015 : Debug: checkrad = "/usr/local/sbin/checkrad" 99: Wed May 20 16:46:25 2015 : Debug: debug_level = 0 100: Wed May 20 16:46:25 2015 : Debug: proxy_requests = yes 101: Wed May 20 16:46:25 2015 : Debug: log { 102: Wed May 20 16:46:25 2015 : Debug: stripped_names = no 103: Wed May 20 16:46:25 2015 : Debug: auth = no 104: Wed May 20 16:46:25 2015 : Debug: auth_badpass = no 105: Wed May 20 16:46:25 2015 : Debug: auth_goodpass = no 106: Wed May 20 16:46:25 2015 : Debug: } 107: Wed May 20 16:46:25 2015 : Debug: security { 108: Wed May 20 16:46:25 2015 : Debug: max_attributes = 200 109: Wed May 20 16:46:25 2015 : Debug: reject_delay = 1 110: Wed May 20 16:46:25 2015 : Debug: status_server = yes 111: Wed May 20 16:46:25 2015 : Debug: allow_vulnerable_openssl = yes 112: Wed May 20 16:46:25 2015 : Debug: } 113: Wed May 20 16:46:25 2015 : Debug: } 114: Wed May 20 16:46:25 2015 : Debug: radiusd: #### Loading Realms and Home Servers #### 115: Wed May 20 16:46:25 2015 : Debug: proxy server { 116: Wed May 20 16:46:25 2015 : Debug: retry_delay = 5 117: Wed May 20 16:46:25 2015 : Debug: retry_count = 3 118: Wed May 20 16:46:25 2015 : Debug: default_fallback = no 119: Wed May 20 16:46:25 2015 : Debug: dead_time = 120 120: Wed May 20 16:46:25 2015 : Debug: wake_all_if_all_dead = no 121: Wed May 20 16:46:25 2015 : Debug: } 122: Wed May 20 16:46:25 2015 : Debug: home_server localhost { 123: Wed May 20 16:46:25 2015 : Debug: ipaddr = 127.0.0.1 124: Wed May 20 16:46:25 2015 : Debug: port = 1812 125: Wed May 20 16:46:25 2015 : Debug: type = "auth" 126: Wed May 20 16:46:25 2015 : Debug: secret = "testing123" 127: Wed May 20 16:46:25 2015 : Debug: response_window = 20 128: Wed May 20 16:46:25 2015 : Debug: max_outstanding = 65536 129: Wed May 20 16:46:25 2015 : Debug: require_message_authenticator = yes 130: Wed May 20 16:46:25 2015 : Debug: zombie_period = 40 131: Wed May 20 16:46:25 2015 : Debug: status_check = "status-server" 132: Wed May 20 16:46:25 2015 : Debug: ping_interval = 30 133: Wed May 20 16:46:25 2015 : Debug: check_interval = 30 134: Wed May 20 16:46:25 2015 : Debug: num_answers_to_alive = 3 135: Wed May 20 16:46:25 2015 : Debug: num_pings_to_alive = 3 136: Wed May 20 16:46:25 2015 : Debug: revive_interval = 120 137: Wed May 20 16:46:25 2015 : Debug: status_check_timeout = 4 138: Wed May 20 16:46:25 2015 : Debug: coa { 139: Wed May 20 16:46:25 2015 : Debug: irt = 2 140: Wed May 20 16:46:25 2015 : Debug: mrt = 16 141: Wed May 20 16:46:25 2015 : Debug: mrc = 5 142: Wed May 20 16:46:25 2015 : Debug: mrd = 30 143: Wed May 20 16:46:25 2015 : Debug: } 144: Wed May 20 16:46:25 2015 : Debug: } 145: Wed May 20 16:46:25 2015 : Debug: home_server_pool my_auth_failover { 146: Wed May 20 16:46:25 2015 : Debug: type = fail-over 147: Wed May 20 16:46:25 2015 : Debug: home_server = localhost 148: Wed May 20 16:46:25 2015 : Debug: } 149: Wed May 20 16:46:25 2015 : Debug: realm example.com { 150: Wed May 20 16:46:25 2015 : Debug: auth_pool = my_auth_failover 151: Wed May 20 16:46:25 2015 : Debug: } 152: Wed May 20 16:46:25 2015 : Debug: realm LOCAL { 153: Wed May 20 16:46:25 2015 : Debug: } 154: Wed May 20 16:46:25 2015 : Debug: radiusd: #### Loading Clients #### 155: Wed May 20 16:46:25 2015 : Debug: client localhost { 156: Wed May 20 16:46:25 2015 : Debug: ipaddr = 127.0.0.1 157: Wed May 20 16:46:25 2015 : Debug: require_message_authenticator = no 158: Wed May 20 16:46:25 2015 : Debug: secret = "testing123" 159: Wed May 20 16:46:25 2015 : Debug: nastype = "other" 160: Wed May 20 16:46:25 2015 : Debug: } 161: Wed May 20 16:46:25 2015 : Debug: radiusd: #### Instantiating modules #### 162: Wed May 20 16:46:25 2015 : Debug: instantiate { 163: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_exec, checking if it's valid) 164: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_exec 165: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec 166: Wed May 20 16:46:25 2015 : Debug: exec { 167: Wed May 20 16:46:25 2015 : Debug: wait = no 168: Wed May 20 16:46:25 2015 : Debug: input_pairs = "request" 169: Wed May 20 16:46:25 2015 : Debug: shell_escape = yes 170: Wed May 20 16:46:25 2015 : Debug: timeout = 10 171: Wed May 20 16:46:25 2015 : Debug: } 172: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_expr, checking if it's valid) 173: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_expr 174: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr 175: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_expiration, checking if it's valid) 176: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_expiration 177: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration 178: Wed May 20 16:46:25 2015 : Debug: expiration { 179: Wed May 20 16:46:25 2015 : Debug: reply-message = "Password Has Expired " 180: Wed May 20 16:46:25 2015 : Debug: } 181: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_logintime, checking if it's valid) 182: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_logintime 183: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime 184: Wed May 20 16:46:25 2015 : Debug: logintime { 185: Wed May 20 16:46:25 2015 : Debug: reply-message = "You are calling outside your allowed timespan " 186: Wed May 20 16:46:25 2015 : Debug: minimum-timeout = 60 187: Wed May 20 16:46:25 2015 : Debug: } 188: Wed May 20 16:46:25 2015 : Debug: } 189: Wed May 20 16:46:25 2015 : Debug: radiusd: #### Loading Virtual Servers #### 190: Wed May 20 16:46:25 2015 : Debug: server { # from file /usr/loc\E0?Y\FD\FF 191: Wed May 20 16:46:25 2015 : Debug: modules { 192: Wed May 20 16:46:25 2015 : Debug: Module: Creating Auth-Type = digest 193: Wed May 20 16:46:25 2015 : Debug: Module: Checking authenticate {...} for more modules to load 194: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_pap, checking if it's valid) 195: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_pap 196: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap 197: Wed May 20 16:46:25 2015 : Debug: pap { 198: Wed May 20 16:46:25 2015 : Debug: encryption_scheme = "auto" 199: Wed May 20 16:46:25 2015 : Debug: auto_header = no 200: Wed May 20 16:46:25 2015 : Debug: } 201: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_chap, checking if it's valid) 202: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_chap 203: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap 204: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_mschap, checking if it's valid) 205: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_mschap 206: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap 207: Wed May 20 16:46:25 2015 : Debug: mschap { 208: Wed May 20 16:46:25 2015 : Debug: use_mppe = yes 209: Wed May 20 16:46:25 2015 : Debug: require_encryption = no 210: Wed May 20 16:46:25 2015 : Debug: require_strong = no 211: Wed May 20 16:46:25 2015 : Debug: with_ntdomain_hack = no 212: Wed May 20 16:46:25 2015 : Debug: allow_retry = yes 213: Wed May 20 16:46:25 2015 : Debug: } 214: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_digest, checking if it's valid) 215: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_digest 216: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest 217: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_unix, checking if it's valid) 218: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_unix 219: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix 220: Wed May 20 16:46:25 2015 : Debug: unix { 221: Wed May 20 16:46:25 2015 : Debug: radwtmp = "/var/log/radius/radwtmp" 222: Wed May 20 16:46:25 2015 : Debug: } 223: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_eap, checking if it's valid) 224: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_eap 225: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf 226: Wed May 20 16:46:25 2015 : Debug: eap { 227: Wed May 20 16:46:25 2015 : Debug: default_eap_type = "md5" 228: Wed May 20 16:46:25 2015 : Debug: timer_expire = 60 229: Wed May 20 16:46:25 2015 : Debug: ignore_unknown_eap_types = no 230: Wed May 20 16:46:25 2015 : Debug: cisco_accounting_username_bug = no 231: Wed May 20 16:46:25 2015 : Debug: max_sessions = 1024 232: Wed May 20 16:46:25 2015 : Debug: } 233: Wed May 20 16:46:25 2015 : Debug: Module: Linked to sub-module rlm_eap_md5 234: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating eap-md5 235: Wed May 20 16:46:25 2015 : Debug: Module: Linked to sub-module rlm_eap_leap 236: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating eap-leap 237: Wed May 20 16:46:25 2015 : Debug: Module: Linked to sub-module rlm_eap_gtc 238: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating eap-gtc 239: Wed May 20 16:46:25 2015 : Debug: gtc { 240: Wed May 20 16:46:25 2015 : Debug: challenge = "Password: " 241: Wed May 20 16:46:25 2015 : Debug: auth_type = "PAP" 242: Wed May 20 16:46:25 2015 : Debug: } 243: Wed May 20 16:46:25 2015 : Debug: Module: Linked to sub-module rlm_eap_tls 244: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating eap-tls 245: Wed May 20 16:46:25 2015 : Debug: tls { 246: Wed May 20 16:46:25 2015 : Debug: rsa_key_exchange = no 247: Wed May 20 16:46:25 2015 : Debug: dh_key_exchange = yes 248: Wed May 20 16:46:25 2015 : Debug: rsa_key_length = 512 249: Wed May 20 16:46:25 2015 : Debug: dh_key_length = 512 250: Wed May 20 16:46:25 2015 : Debug: verify_depth = 0 251: Wed May 20 16:46:25 2015 : Debug: CA_path = "/usr/local/etc/raddb/certs" 252: Wed May 20 16:46:25 2015 : Debug: pem_file_type = yes 253: Wed May 20 16:46:25 2015 : Debug: private_key_file = "/usr/local/etc/raddb/certs/server.pem" 254: Wed May 20 16:46:25 2015 : Debug: certificate_file = "/usr/local/etc/raddb/certs/server.pem" 255: Wed May 20 16:46:25 2015 : Debug: CA_file = "/usr/local/etc/raddb/certs/ca.pem" 256: Wed May 20 16:46:25 2015 : Debug: private_key_password = "whatever" 257: Wed May 20 16:46:25 2015 : Debug: dh_file = "/usr/local/etc/raddb/certs/dh" 258: Wed May 20 16:46:25 2015 : Debug: fragment_size = 1024 259: Wed May 20 16:46:25 2015 : Debug: include_length = yes 260: Wed May 20 16:46:25 2015 : Debug: check_crl = no 261: Wed May 20 16:46:25 2015 : Debug: cipher_list = "DEFAULT" 262: Wed May 20 16:46:25 2015 : Debug: make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" 263: Wed May 20 16:46:25 2015 : Debug: ecdh_curve = "prime256v1" 264: Wed May 20 16:46:25 2015 : Debug: cache { 265: Wed May 20 16:46:25 2015 : Debug: enable = no 266: Wed May 20 16:46:25 2015 : Debug: lifetime = 24 267: Wed May 20 16:46:25 2015 : Debug: max_entries = 255 268: Wed May 20 16:46:25 2015 : Debug: } 269: Wed May 20 16:46:25 2015 : Debug: verify { 270: Wed May 20 16:46:25 2015 : Debug: } 271: Wed May 20 16:46:25 2015 : Debug: ocsp { 272: Wed May 20 16:46:25 2015 : Debug: enable = no 273: Wed May 20 16:46:25 2015 : Debug: override_cert_url = yes 274: Wed May 20 16:46:25 2015 : Debug: url = "http://127.0.0.1/ocsp/" 275: Wed May 20 16:46:25 2015 : Debug: use_nonce = yes 276: Wed May 20 16:46:25 2015 : Debug: timeout = 0 277: Wed May 20 16:46:25 2015 : Debug: softfail = no 278: Wed May 20 16:46:25 2015 : Debug: } 279: Wed May 20 16:46:25 2015 : Debug: } 280: Wed May 20 16:46:25 2015 : Debug: Module: Linked to sub-module rlm_eap_ttls 281: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating eap-ttls 282: Wed May 20 16:46:25 2015 : Debug: ttls { 283: Wed May 20 16:46:25 2015 : Debug: default_eap_type = "md5" 284: Wed May 20 16:46:25 2015 : Debug: copy_request_to_tunnel = no 285: Wed May 20 16:46:25 2015 : Debug: use_tunneled_reply = no 286: Wed May 20 16:46:25 2015 : Debug: virtual_server = "inner-tunnel" 287: Wed May 20 16:46:25 2015 : Debug: include_length = yes 288: Wed May 20 16:46:25 2015 : Debug: } 289: Wed May 20 16:46:25 2015 : Debug: Module: Linked to sub-module rlm_eap_peap 290: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating eap-peap 291: Wed May 20 16:46:25 2015 : Debug: peap { 292: Wed May 20 16:46:25 2015 : Debug: default_eap_type = "mschapv2" 293: Wed May 20 16:46:25 2015 : Debug: copy_request_to_tunnel = no 294: Wed May 20 16:46:25 2015 : Debug: use_tunneled_reply = no 295: Wed May 20 16:46:25 2015 : Debug: proxy_tunneled_request_as_eap = yes 296: Wed May 20 16:46:25 2015 : Debug: virtual_server = "inner-tunnel" 297: Wed May 20 16:46:25 2015 : Debug: soh = no 298: Wed May 20 16:46:25 2015 : Debug: } 299: Wed May 20 16:46:25 2015 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 300: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating eap-mschapv2 301: Wed May 20 16:46:25 2015 : Debug: mschapv2 { 302: Wed May 20 16:46:25 2015 : Debug: with_ntdomain_hack = no 303: Wed May 20 16:46:25 2015 : Debug: send_error = no 304: Wed May 20 16:46:25 2015 : Debug: } 305: Wed May 20 16:46:25 2015 : Debug: Module: Checking authorize {...} for more modules to load 306: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_preprocess, checking if it's valid) 307: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_preprocess 308: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess 309: Wed May 20 16:46:25 2015 : Debug: preprocess { 310: Wed May 20 16:46:25 2015 : Debug: huntgroups = "/usr/local/etc/raddb/huntgroups" 311: Wed May 20 16:46:25 2015 : Debug: hints = "/usr/local/etc/raddb/hints" 312: Wed May 20 16:46:25 2015 : Debug: with_ascend_hack = no 313: Wed May 20 16:46:25 2015 : Debug: ascend_channels_per_line = 23 314: Wed May 20 16:46:25 2015 : Debug: with_ntdomain_hack = no 315: Wed May 20 16:46:25 2015 : Debug: with_specialix_jetstream_hack = no 316: Wed May 20 16:46:25 2015 : Debug: with_cisco_vsa_hack = no 317: Wed May 20 16:46:25 2015 : Debug: with_alvarion_vsa_hack = no 318: Wed May 20 16:46:25 2015 : Debug: } 319: Wed May 20 16:46:25 2015 : Debug: reading pairlist file /usr/local/etc/raddb/huntgroups 320: Wed May 20 16:46:25 2015 : Debug: reading pairlist file /usr/local/etc/raddb/hints 321: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_realm, checking if it's valid) 322: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_realm 323: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm 324: Wed May 20 16:46:25 2015 : Debug: realm suffix { 325: Wed May 20 16:46:25 2015 : Debug: format = "suffix" 326: Wed May 20 16:46:25 2015 : Debug: delimiter = "@" 327: Wed May 20 16:46:25 2015 : Debug: ignore_default = no 328: Wed May 20 16:46:25 2015 : Debug: ignore_null = no 329: Wed May 20 16:46:25 2015 : Debug: } 330: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_always, checking if it's valid) 331: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_always 332: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "reject" from file /usr/local/etc/raddb/modules/always 333: Wed May 20 16:46:25 2015 : Debug: always reject { 334: Wed May 20 16:46:25 2015 : Debug: rcode = "reject" 335: Wed May 20 16:46:25 2015 : Debug: simulcount = 0 336: Wed May 20 16:46:25 2015 : Debug: mpp = no 337: Wed May 20 16:46:25 2015 : Debug: } 338: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_files, checking if it's valid) 339: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_files 340: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files 341: Wed May 20 16:46:25 2015 : Debug: files { 342: Wed May 20 16:46:25 2015 : Debug: usersfile = "/usr/local/etc/raddb/users" 343: Wed May 20 16:46:25 2015 : Debug: acctusersfile = "/usr/local/etc/raddb/acct_users" 344: Wed May 20 16:46:25 2015 : Debug: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" 345: Wed May 20 16:46:25 2015 : Debug: compat = "no" 346: Wed May 20 16:46:25 2015 : Debug: } 347: Wed May 20 16:46:25 2015 : Debug: reading pairlist file /usr/local/etc/raddb/users 348: Wed May 20 16:46:25 2015 : Debug: reading pairlist file /usr/local/etc/raddb/acct_users 349: Wed May 20 16:46:25 2015 : Debug: reading pairlist file /usr/local/etc/raddb/preproxy_users 350: Wed May 20 16:46:25 2015 : Debug: Module: Checking preacct {...} for more modules to load 351: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_acct_unique, checking if it's valid) 352: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_acct_unique 353: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique 354: Wed May 20 16:46:25 2015 : Debug: acct_unique { 355: Wed May 20 16:46:25 2015 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" 356: Wed May 20 16:46:25 2015 : Debug: } 357: Wed May 20 16:46:25 2015 : Debug: Module: Checking accounting {...} for more modules to load 358: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_detail, checking if it's valid) 359: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_detail 360: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail 361: Wed May 20 16:46:25 2015 : Debug: detail { 362: Wed May 20 16:46:25 2015 : Debug: detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" 363: Wed May 20 16:46:25 2015 : Debug: header = "%t" 364: Wed May 20 16:46:25 2015 : Debug: detailperm = 384 365: Wed May 20 16:46:25 2015 : Debug: dirperm = 493 366: Wed May 20 16:46:25 2015 : Debug: locking = no 367: Wed May 20 16:46:25 2015 : Debug: log_packet_header = no 368: Wed May 20 16:46:25 2015 : Debug: escape_filenames = no 369: Wed May 20 16:46:25 2015 : Debug: } 370: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_attr_filter, checking if it's valid) 371: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_attr_filter 372: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter 373: Wed May 20 16:46:25 2015 : Debug: attr_filter attr_filter.accounting_response { 374: Wed May 20 16:46:25 2015 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" 375: Wed May 20 16:46:25 2015 : Debug: key = "%{User-Name}" 376: Wed May 20 16:46:25 2015 : Debug: relaxed = no 377: Wed May 20 16:46:25 2015 : Debug: } 378: Wed May 20 16:46:25 2015 : Debug: reading pairlist file /usr/local/etc/raddb/attrs.accounting_response 379: Wed May 20 16:46:25 2015 : Debug: Module: Checking session {...} for more modules to load 380: Wed May 20 16:46:25 2015 : Debug: (Loaded rlm_radutmp, checking if it's valid) 381: Wed May 20 16:46:25 2015 : Debug: Module: Linked to module rlm_radutmp 382: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp 383: Wed May 20 16:46:25 2015 : Debug: radutmp { 384: Wed May 20 16:46:25 2015 : Debug: filename = "/var/log/radius/radutmp" 385: Wed May 20 16:46:25 2015 : Debug: username = "%{User-Name}" 386: Wed May 20 16:46:25 2015 : Debug: case_sensitive = yes 387: Wed May 20 16:46:25 2015 : Debug: check_with_nas = yes 388: Wed May 20 16:46:25 2015 : Debug: perm = 384 389: Wed May 20 16:46:25 2015 : Debug: callerid = yes 390: Wed May 20 16:46:25 2015 : Debug: } 391: Wed May 20 16:46:25 2015 : Debug: Module: Checking post-proxy {...} for more modules to load 392: Wed May 20 16:46:25 2015 : Debug: Module: Checking post-auth {...} for more modules to load 393: Wed May 20 16:46:25 2015 : Debug: Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter 394: Wed May 20 16:46:25 2015 : Debug: attr_filter attr_filter.access_reject { 395: Wed May 20 16:46:25 2015 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_reject" 396: Wed May 20 16:46:25 2015 : Debug: key = "%{User-Name}" 397: Wed May 20 16:46:25 2015 : Debug: relaxed = no 398: Wed May 20 16:46:25 2015 : Debug: } 399: Wed May 20 16:46:25 2015 : Debug: reading pairlist file /usr/local/etc/raddb/attrs.access_reject 400: Wed May 20 16:46:25 2015 : Debug: } # modules 401: Wed May 20 16:46:25 2015 : Debug: } # server 402: Wed May 20 16:46:25 2015 : Debug: server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel 403: Wed May 20 16:46:25 2015 : Debug: modules { 404: Wed May 20 16:46:25 2015 : Debug: Module: Checking authenticate {...} for more modules to load 405: Wed May 20 16:46:25 2015 : Debug: Module: Checking authorize {...} for more modules to load 406: Wed May 20 16:46:25 2015 : Debug: Module: Checking session {...} for more modules to load 407: Wed May 20 16:46:25 2015 : Debug: Module: Checking post-proxy {...} for more modules to load 408: Wed May 20 16:46:25 2015 : Debug: Module: Checking post-auth {...} for more modules to load 409: Wed May 20 16:46:25 2015 : Debug: } # modules 410: Wed May 20 16:46:25 2015 : Debug: } # server 411: Wed May 20 16:46:25 2015 : Debug: radiusd: #### Opening IP addresses and Ports #### 412: Wed May 20 16:46:25 2015 : Debug: listen { 413: Wed May 20 16:46:25 2015 : Debug: type = "auth" 414: Wed May 20 16:46:25 2015 : Debug: ipaddr = * 415: Wed May 20 16:46:25 2015 : Debug: port = 0 416: Wed May 20 16:46:25 2015 : Debug: } 417: Wed May 20 16:46:25 2015 : Debug: listen { 418: Wed May 20 16:46:25 2015 : Debug: type = "acct" 419: Wed May 20 16:46:25 2015 : Debug: ipaddr = * 420: Wed May 20 16:46:25 2015 : Debug: port = 0 421: Wed May 20 16:46:25 2015 : Debug: } 422: Wed May 20 16:46:25 2015 : Debug: listen { 423: Wed May 20 16:46:25 2015 : Debug: type = "control" 424: Wed May 20 16:46:25 2015 : Debug: listen { 425: Wed May 20 16:46:25 2015 : Debug: socket = "/usr/local/var/run/radiusd/radiusd.sock" 426: Wed May 20 16:46:25 2015 : Debug: } 427: Wed May 20 16:46:25 2015 : Debug: } 428: Wed May 20 16:46:25 2015 : Debug: listen { 429: Wed May 20 16:46:25 2015 : Debug: type = "auth" 430: Wed May 20 16:46:25 2015 : Debug: ipaddr = 127.0.0.1 431: Wed May 20 16:46:25 2015 : Debug: port = 18120 432: Wed May 20 16:46:25 2015 : Debug: } 433: Wed May 20 16:46:25 2015 : Debug: ... adding new socket proxy address * port 49326 434: Wed May 20 16:46:25 2015 : Debug: Listening on authentication address * port 1812 435: Wed May 20 16:46:25 2015 : Debug: Listening on accounting address * port 1813 436: Wed May 20 16:46:25 2015 : Debug: Listening on command file /usr/local/var/run/radiusd/radiusd.sock 437: Wed May 20 16:46:25 2015 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel 438: Wed May 20 16:46:25 2015 : Debug: Listening on proxy address * port 1814 439: Wed May 20 16:46:25 2015 : Info: Ready to process requests. 440: rad_recv: Access-Request packet from host 127.0.0.1 port 38078, id=59, length=74 441: User-Name = "test" 442: User-Password = "test" 443: NAS-IP-Address = xx.xx.xx.xx 444: NAS-Port = 0 445: Message-Authenticator = 0x7aa095c3bdfd6bc29db406eaa142ef44 446: Wed May 20 16:46:28 2015 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default 447: Wed May 20 16:46:28 2015 : Info: +group authorize { 448: Wed May 20 16:46:28 2015 : Info: ++[preprocess] = ok 449: Wed May 20 16:46:28 2015 : Info: ++[chap] = noop 450: Wed May 20 16:46:28 2015 : Info: ++[mschap] = noop 451: Wed May 20 16:46:28 2015 : Info: ++[digest] = noop 452: Wed May 20 16:46:28 2015 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL 453: Wed May 20 16:46:28 2015 : Info: [suffix] No such realm "NULL" 454: Wed May 20 16:46:28 2015 : Info: ++[suffix] = noop 455: Wed May 20 16:46:28 2015 : Info: [eap] No EAP-Message, not doing EAP 456: Wed May 20 16:46:28 2015 : Info: ++[eap] = noop 457: Wed May 20 16:46:28 2015 : Info: ++[reject] = reject 458: Wed May 20 16:46:28 2015 : Info: +} # group authorize = reject 459: Wed May 20 16:46:28 2015 : Info: Using Post-Auth-Type Reject 460: Wed May 20 16:46:28 2015 : Info: # Executing group from file /usr/local/etc/raddb/sites-enabled/default 461: Wed May 20 16:46:28 2015 : Info: +group REJECT { 462: Wed May 20 16:46:28 2015 : Info: [eap] Request didn't contain an EAP-Message, not inserting EAP-Failure 463: Wed May 20 16:46:28 2015 : Info: ++[eap] = noop 464: Wed May 20 16:46:28 2015 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test 465: Wed May 20 16:46:28 2015 : Debug: attr_filter: Matched entry DEFAULT at line 11 466: Wed May 20 16:46:28 2015 : Info: ++[attr_filter.access_reject] = updated 467: Wed May 20 16:46:28 2015 : Info: +} # group REJECT = updated 468: Wed May 20 16:46:28 2015 : Info: Delaying reject of request 0 for 1 seconds 469: Wed May 20 16:46:28 2015 : Debug: Going to the next request 470: Wed May 20 16:46:28 2015 : Debug: Waking up in 0.9 seconds. 471: Wed May 20 16:46:29 2015 : Info: Sending delayed reject for request 0 472: Sending Access-Reject of id 59 to 127.0.0.1 port 38078 473: Wed May 20 16:46:29 2015 : Debug: Waking up in 4.9 seconds. 474: Wed May 20 16:46:34 2015 : Info: Cleaning up request 0 ID 59 with timestamp +3 475: Wed May 20 16:46:34 2015 : Info: Ready to process requests.

5 5

FreeRadius 3.1.x
by Jorge Pereira 20 May '15

20 May '15

Hi Alan, Have some idea about the plans for 3.1.0? idea about when will be release? -- Jorge Pereira

5 8

[ttls] <<< Unknown TLS version [length 0002]
by gabriel_skupien 20 May '15

20 May '15

Problem with TTLS setup. EAP clients negotiate TLSv1.2 but FR reports "Unknown TLS version". Any idea? ######################## freeradius: FreeRADIUS Version 2.2.7, for host x86_64-pc-linux-gnu, built on May 20 2015 at 15:09:29 Copyright (C) 1999-2015 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. ######################## OpenSSL 1.0.1f 6 Jan 2014 ######################## rad_recv: Access-Request packet from host 127.0.0.1 port 41457, id=246, length=163 User-Name = "xxx" NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 11 NAS-Port-Id = "ikev1_iPhone" NAS-IP-Address = 55.55.55.55 Called-Station-Id = "55.55.55.55[500]" Calling-Station-Id = "10.8.0.41[500]" EAP-Message = 0x02000014016761627269656c2e736b757069656e NAS-Identifier = "xxx" Message-Authenticator = 0x3081d2a8deb390730c6a4549a473d550 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "xxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 0 length 20 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 246 to 127.0.0.1 port 41457 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xabbe8980abbf9c62469ee671636876ab Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 41457, id=247, length=366 User-Name = "xxx" NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 11 NAS-Port-Id = "ikev1_iPhone" NAS-IP-Address = 55.55.55.55 Called-Station-Id = "55.55.55.55[500]" Calling-Station-Id = "10.8.0.41[500]" EAP-Message = 0x020100cd1580000000c316030300be010000ba0303555c8c48a01b005b0cd652b9a53aa87fbbaa396563f547fd22c3c9c2484d36a4000048c009c023c00ac024c02bc02cc013c027c014c028c02fc030003300670039006b009e009f004500be008800c40016002f003c0035003d009c009d004100ba008400c0c008c012000a01000049000d001600140403050306030203040105010601030102010101000a000c000a00170018001900150013000b000201000000001500130000106d6f6f6e2e696e742e636369672e706c NAS-Identifier = "xxx" State = 0xabbe8980abbf9c62469ee671636876ab Message-Authenticator = 0x8753091a175404cac7110ea5a622c82a # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "xxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 205 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 195 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< Unknown TLS version [length 00be] [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> Unknown TLS version [length 0034] [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> Unknown TLS version [length 02c6] [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> Unknown TLS version [length 014d] [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> Unknown TLS version [length 0004] [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 247 to 127.0.0.1 port 41457 EAP-Message = 0x0102040015c00000045f16030300340200003003039133f78dbb4a2fd7a086f78271b18d472b8e3f9a24cf88c85fefa041a396614b00c013000008000b00040300010216030302c60b0002c20002bf0002bc308202b8308201a0a003020102020900f25943f5edd1f259300d06092a864886f70d01010b0500301431123010060355040313096c6f63616c686f7374301e170d3135303531353133313833365a170d3235303531323133313833365a301431123010060355040313096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100d60d70fda5d3dc73b6f490dde396e249b5f4ed9ab84209 EAP-Message = 0x65a696f9147657575a9c96ca528986c48cbcb8a180d58d0ab3ca6ec6a645475be6a4bc8d4f653e0d674f5c650704e10ad0498bc553b4b86ed39507ec8c7ff843e3c95ab7a6ae1318edd8d21c4e8875f38aef3d5148306f5f35c8c27f032a541a4d71ec9d02b70502241bb90bbb60d476d33263924f5f0e256f283617cd9780a9fb7235e6f721ab5274028dd8608c5b1b981af461a0de1cc24231de37b4f8fdeea51f0704fb69d7d15b08d1696245a9ec41ef1217886079fb904b69a94a18850f4466ad3a02b93b8f31513380bff48b14fb078107bf7315a24ddd5c5291e2ccefc90e5fb7843736f94f0203010001a30d300b30090603551d1304023000 EAP-Message = 0x300d06092a864886f70d01010b050003820101008fd5f2ec9307ad98a5dbf620f21b24f98cf32ed1a453bcf22085e9692fb5977e35ff5f0f6aefadc54842a27aa218781437dbaa12faed330c7cc83b03050fba03df50b7fd0ce055ee9054eb68419972d23bbc3db135fa1b82cfe35d643a08604efea8e7c172d7f6bb36952dac4b7aeb2487348dec01e8db8439c148d93cfcda6f71cecf8fa95608a18878223271e6d3968c9ebc5a874a35a6daefd538f869cfb34da300dc28d66f241139effcb13fc1020616b089b2eeffc3f0c5fd91a8f6fa42c6d3e4af83a16baf71070ed626361dac26a24164e975c4f183e7ecde28c737019b90c0eec445dc5c76 EAP-Message = 0xae8c81dd943c66e928762e55622a0b19d7c9f0ddb7ffff160303014d0c00014903001741048e7fe751552742003b186c7c3534cd294315fb4afb7d1191e3923cd601b69b0b683e76c3fc3a3dfb78c8c9d375e935410315b7952a3f6fda178961e26091a38b040101004f0e161de68fcca962694554b02d8309d071adf0c2c64bbb85621ed5ef227ba40ce6b4c1e2d3a02d43c18a4f79ded7db78f53d1e2c44d51b083a1d102aead8c8690e1d576a54ce475945dc1a3e8ce9e9f9b551cf5c05ec60dc97e00dc08607a149cf4b31b346ba259d0bcfd572922b1c6106f065ac2f0d800174716e7b82d157bcfa0387c21499a2e02ca2ac443474ca0a87198c EAP-Message = 0x4e7414ea4ce39155cc8a4031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xabbe8980aabc9c62469ee671636876ab Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 41457, id=248, length=178 User-Name = "xxx" NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 11 NAS-Port-Id = "ikev1_iPhone" NAS-IP-Address = 55.55.55.55 Called-Station-Id = "55.55.55.55[500]" Calling-Station-Id = "10.8.0.41[500]" EAP-Message = 0x0202001115800000000715030300020231 NAS-Identifier = "xxx" State = 0xabbe8980aabc9c62469ee671636876ab Message-Authenticator = 0xb28272a72ca2d41818e008e8659849f9 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "xxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 17 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 7 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< Unknown TLS version [length 0002] TLS Alert read:fatal:access denied TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094419:SSL routines:SSL3_READ_BYTES:tlsv1 alert access denied SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Login incorrect (TLS Alert read:fatal:access denied): [xxx/<via Auth-Type = EAP>] (from client localhost port 11 cli 10.8.0.41[500]) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> xxx attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 248 to 127.0.0.1 port 41457 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 246 with timestamp +6 Cleaning up request 1 ID 247 with timestamp +6 Waking up in 1.0 seconds. Gabriel

3 2

EAP authentication failure
by Pratik 19 May '15

19 May '15

Hi, I am trying to setup freeradius on my linux machine to work with a Cisco WRV210 router. When testing with the router, I get the following error on the freeradius log (just posting bits and pieces as the entire log is long...please let me know if the full log is required). Thanks for you help. -- Pratik ********************************************************************************* (5) Received Access-Request Id 41 from 192.168.0.106:1164 to 192.168.0.102:1812 length 169 (5) User-Name = 'pratik' (5) NAS-IP-Address = 192.168.1.1 (5) NAS-Port = 0 (5) Called-Station-Id = '6C-50-4D-C0-57-A0' (5) Calling-Station-Id = '4C-EB-42-62-1B-69' (5) Framed-MTU = 1400 (5) NAS-Port-Type = Wireless-802.11 (5) Connect-Info = 'CONNECT 11Mbps 802.11b' (5) EAP-Message = 0x0206001119800000000715030100020230 (5) State = 0xe5d173fbe1d76a19b8fdf8f1dc552dae (5) Message-Authenticator = 0x95a5086a3556a2d23f48f06c0fe39055 (5) session-state: No cached attributes (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (!&User-Name) { (5) if (!&User-Name) -> FALSE (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@.*@/ ) { (5) if (&User-Name =~ /@.*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "pratik", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent code Response (2) ID 6 length 17 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0xe5d173fbe1d76a19 (5) eap: Finished EAP session with state 0xe5d173fbe1d76a19 (5) eap: Previous EAP request found for state 0xe5d173fbe1d76a19, released from the list (5) eap: Peer sent method PEAP (25) (5) eap: EAP PEAP (25) (5) eap: Calling eap_peap to process EAP data (5) eap_peap: processing EAP-TLS (5) eap_peap: TLS Length 7 (5) eap_peap: Length Included (5) eap_peap: eaptls_verify returned 11 (5) eap_peap: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca *(5) eap_peap: ERROR: TLS Alert read:fatal:unknown CA* *(5) eap_peap: ERROR: TLS_accept: Failed in SSLv3 read client certificate A* *(5) eap_peap: ERROR: SSL says: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca* *SSL: SSL_read failed inside of TLS (-1), TLS session fails.* TLS receive handshake failed during operation (5) eap_peap: eaptls_process returned 4 (5) eap_peap: FR_TLS_OTHERS *(5) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed* (5) eap: Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> pratik (5) attr_filter.access_reject: Matched entry DEFAULT at line 18 (5) [attr_filter.access_reject] = updated (5) [eap] = noop (5) policy remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) { (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else { (5) [noop] = noop (5) } # else = noop (5) } # policy remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (5) Discarding duplicate request from client ciscoSwitch port 1164 - ID: 41 due to delayed response Waking up in 0.1 seconds. (5) <delay>: Sending delayed response (5) <delay>: Sent Access-Reject Id 41 from 192.168.0.102:1812 to 192.168.0.106:1164 length 44 (5) <delay>: EAP-Message = 0x04060004 (5) <delay>: Message-Authenticator = 0x00000000000000000000000000000000 *********************************************************************************

2 3

Radwho ?
by Olivier CALVANO 19 May '15

19 May '15

Hi when i want know a list of users: [root@auth-srv1]# radwho radwho: No configuration information in radutmp section of radiusd.conf! i use freeradius 2.2.5 on Centos 6 i have a file radutmp in modules/ anyone have a idea of my error ? regards olivier

2 4

How to log sites-available/default variables
by mdii 19 May '15

19 May '15

> > Hi, > >* Hi, > *> >* In my sites-available/default file I set a post-proxy variable that is > *>* added to the proxy-reply: > *> >* > post-proxy { > *>* > > *>* update reply { > *>* > Filter-Id := `/usr/sbin/ldap_get_group_info.sh %{User-Name}` > *>* > } > *>* > > *>* } > *>* > > *> >* I'm trying to add the Filter-Id value into the auth-detail-<date> file, is > *>* it possible? > * > everything gets logged - but i reckon you are calling the detail module BEFORE you've done > this update reply call..... > > alan > > Thanks for your answer Alan, How exactly it's logged? How can I add the Filter-Id information to the log? My auth-detail-20150518 log file looks like: Mon May 18 06:46:16 2015 Packet-Type = Access-Request User-Name = "user(a)domain.com" Acct-Session-Id = "1431935176I23fkb" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "Localhost" NAS-Port = 0 Calling-Station-Id = "1115551212" Message-Authenticator = 0x2a9e87211fd9ce73f6e6faf739da0732 I've tried to play with the "Log" section in the radius.conf file but it didn't change nothing. I imagine it could be in the modules/detail.log but I couldn't find any info of how to set this up... thanks again, Marc <freeradius-users%40lists.freeradius.org?Subject=Re%3A%20How%20to%20log%20sites-available/default%20variables&In-Reply-To=%3C20150519063917.GB955%40lboro.ac.uk%3E>

2 1

How to log sites-available/default variables
by mdii 19 May '15

19 May '15

Hi, In my sites-available/default file I set a post-proxy variable that is added to the proxy-reply: > post-proxy { > update reply { > Filter-Id := `/usr/sbin/ldap_get_group_info.sh %{User-Name}` > } > } > I'm trying to add the Filter-Id value into the auth-detail-<date> file, is it possible? Thanks in advance, Marc

2 1

LDAP authentication
by chenjiang 19 May '15

19 May '15

Hi! Experts Sorry for disturbing, I try to use LDAP as FreeRADIUS backend DB to authentication Windows2008 domain users but the POC test is failed, do you have experience on this and could shed some light on it? Thanks for your support. My FreeRADIUS LDAP related configuration listed below: more /etc/raddb/modules/ldap â¦... ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "192.168.254.102" identity = "cn=Administrator,cn=Users,dc=ms,dc=local" password = "1qaz!QAZ" basedn = "dc=ms,dc=local" filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 20 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 20 â¦â¦ And my radiusd -X output as below, you could see there is Access-Reject messages sent to NAS. rad_recv: Access-Request packet from host 192.168.253.254 port 49603, id=77, length=253 NAS-IP-Address = 192.168.253.254 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "lab" Service-Type = Login-User Calling-Station-Id = "F437B7011933" Called-Station-Id = "000B86999D57" MS-CHAP-Challenge = 0xbd38014db9614219e63be5946a2e5e37 MS-CHAP2-Response = 0x09001650f03ffa8a6d6ce04f76d60a8cf4c900000000000000008be9d324ae40a1063 66c1ee86933dacd17bf520297182190 Aruba-Essid-Name = "microshield-lab" Aruba-Location-Id = "lab-AP-1" Aruba-Attr-10 = 0x6d6963726f736869656c642d6c6162 Aruba-Attr-12 = 0x6950686f6e65 Message-Authenticator = 0x530723b754043a3c9ff8cdc151e2ed87 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "lab", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ldap] performing user authorization for lab [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> lab [ldap] expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (sAMAccountName=lab) [ldap] expand: dc=ms,dc=local -> dc=ms,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=ms,dc=local, with filter (sAMAccountName=lab) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user lab authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> lab [sql] sql_set_user escaped user --> 'lab' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'lab', '', 'Access-Reject', '2015-05-18 13:53:47') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'lab', '', 'Access-Reject', '2015-05-18 13:53:47') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> lab attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 77 to 192.168.253.254 port 49603 Finished request 26. BR! Chen Jiang Microshield Technology Co., Ltd åäº¬å¸æµ·æ·åºè¥¿ä¸ç¯åè·¯50å·è±ªæå¤§å¦C2åº§18-19å± 100048 (86)10-88518768 (86)18612696123 [1]chenjiang(a)microshield.com.cn References 1. mailto:chenjiang@microshield.com.cn

2 1