- Freeradius-Users - lists.freeradius.org

SQL: radpostauth empty fields
by Stephane Bourque 20 Sep '23

20 Sep '23

Hi, We are using FreeRadius with SQL and everything is working fine right now. We are using PostgreSQL. We are noticing all empty fields in the radpostauth DB, namely callingstationid and calledstationid. All of our sites have the following: post-auth { update { &reply: += &session-state: } sql06 exec remove_reply_message_if_eap Post-Auth-Type REJECT { eap06 remove_reply_message_if_eap } Post-Auth-Type Challenge { } } I am assuming this is where something is missing to update these fields. I am not finding information of what we would need to add or modify in order to populate the fields. Is there a link you can point me to or an explanation on how to solve this problem? We have not modified the basic SQL queries or DB schemas. Thank you. -- *Stephane Bourque* *CEO & Founder* *Arilia Wireless Inc.* *"Everything connected"* stephane.bourque(a)arilia.com +1(778)558-3524 *www.arilia.com <http://www.arilia.com>*

3 4

Send logs from the linelog module to stdout
by work vlpl 20 Sep '23

20 Sep '23

Hi, I am running radiusd in Docker container. In configuration radiusd.conf I had set the user and group variable to drop permission after the start. Radiusd process is started with `-fl stdout` to redirect radiusd process logs to stdout and let Docker collect necessary logs. But in the linelog module if I will use /dev/stdout as filename radiusd seems can't open it for writing. Also, Docker requires `tty=true`, or permissions to /dev/stdout granted only to root. May I ask if there is an option that I am missing, to redirect linelog output to stdout? Best regards, Valdimir

3 4

EAP-PEAP Issue with new Android device
by dlux＠lux-it-systeme.de 19 Sep '23

19 Sep '23

Hi, while trying to setup a new Android device an issue started to appear: Short Story: Authentication fails in the (i guess) P1 phase of EAP-PEAP with a message: certificate expired. Long Story: The radius server is using LetsEncrypt Server certs for ist TLS configuration. That setups works with every device i know of in this network. A new Android device however seems to behave weird with it. Logging Freeradius with the -X flag results with the log below. The device is set to not validate the server cert and use EAP-PEAP for P1 and MSCHAPv2 for P2. kp@<domain-stripped> is the anonymous identity. The last message seems rather short (TLS Length 7) which doesn't sound right. I know there is an issue with the domain detection because its only checking for ntdomain. Thats work for another day. Thank you in advance, Daniel Lux ``` (298) Received Access-Request Id 166 from 10.2.254.253:60831 to 10.0.0.248:1812 length 208 (298) User-Name = "kp@<domain-stripped>" (298) NAS-IP-Address = 10.2.254.253 (298) NAS-Port = 0 (298) NAS-Identifier = "10.2.254.253" (298) NAS-Port-Type = Wireless-802.11 (298) Calling-Station-Id = "843E1D87F5BF" (298) Called-Station-Id = "204C03033278" (298) Service-Type = Framed-User (298) Framed-MTU = 1100 (298) EAP-Message = 0x0201001b016b70407261747367796d6e617369756d2d70652e6465 (298) Aruba-Essid-Name = "RatseNetL" (298) Aruba-Location-Id = "AP18" (298) Aruba-AP-Group = "OS-Trakt" (298) Message-Authenticator = 0xd4fead8cee934d4d691b8e1218e4220d (298) # Executing section authorize from file /etc/freeradius/sites-enabled/default (298) authorize { (298) [preprocess] = ok (298) ntdomain: Checking for prefix before "\" (298) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (298) ntdomain: No such realm "NULL" (298) [ntdomain] = noop (298) update control { (298) &Proxy-To-Realm := LOCAL (298) } # update control = noop (298) [chap] = noop (298) [mschap] = noop (298) [digest] = noop (298) eap: Peer sent EAP Response (code 2) ID 1 length 27 (298) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (298) [eap] = ok (298) } # authorize = ok (298) Found Auth-Type = eap (298) # Executing group from file /etc/freeradius/sites-enabled/default (298) authenticate { (298) eap: Peer sent packet with method EAP Identity (1) (298) eap: Calling submodule eap_peap to process data (298) eap_peap: Initiating new EAP-TLS session (298) eap_peap: [eaptls start] = request (298) eap: Sending EAP Request (code 1) ID 2 length 6 (298) eap: EAP session adding &reply:State = 0xe37f3d5de37d24b2 (298) [eap] = handled (298) } # authenticate = handled (298) Using Post-Auth-Type Challenge (298) Post-Auth-Type sub-section not found. Ignoring. (298) # Executing group from file /etc/freeradius/sites-enabled/default (298) Sent Access-Challenge Id 166 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (298) EAP-Message = 0x010200061920 (298) Message-Authenticator = 0x00000000000000000000000000000000 (298) State = 0xe37f3d5de37d24b242773e627ff3f802 (298) Finished request (299) Received Access-Request Id 47 from 10.2.254.253:60831 to 10.0.0.248:1812 length 340 (299) User-Name = "kp@<domain-stripped>" (299) NAS-IP-Address = 10.2.254.253 (299) NAS-Port = 0 (299) NAS-Identifier = "10.2.254.253" (299) NAS-Port-Type = Wireless-802.11 (299) Calling-Station-Id = "843E1D87F5BF" (299) Called-Station-Id = "204C03033278" (299) Service-Type = Framed-User (299) Framed-MTU = 1100 (299) EAP-Message = 0x0202008d198000000083160301007e0100007a03039cd3aa393b421414e62481d34c86e861 c1dd382868b4f29944d0c04c62ae43ec00001ec02bc02fc02cc030cca9cca8c009c013c00ac0 14009c009d002f0035000a0100003300170000ff01000100000a00080006001d00170018000b 00020100000d (299) State = 0xe37f3d5de37d24b242773e627ff3f802 (299) Aruba-Essid-Name = "RatseNetL" (299) Aruba-Location-Id = "AP18" (299) Aruba-AP-Group = "OS-Trakt" (299) Message-Authenticator = 0x6761200777d3cba4c291bc097f235982 (299) session-state: No cached attributes (299) # Executing section authorize from file /etc/freeradius/sites-enabled/default (299) authorize { (299) [preprocess] = ok (299) ntdomain: Checking for prefix before "\" (299) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (299) ntdomain: No such realm "NULL" (299) [ntdomain] = noop (299) update control { (299) &Proxy-To-Realm := LOCAL (299) } # update control = noop (299) [chap] = noop (299) [mschap] = noop (299) [digest] = noop (299) eap: Peer sent EAP Response (code 2) ID 2 length 141 (299) eap: Continuing tunnel setup (299) [eap] = ok (299) } # authorize = ok (299) Found Auth-Type = eap (299) # Executing group from file /etc/freeradius/sites-enabled/default (299) authenticate { (299) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (299) eap: Finished EAP session with state 0xe37f3d5de37d24b2 (299) eap: Previous EAP request found for state 0xe37f3d5de37d24b2, released from the list (299) eap: Peer sent packet with method EAP PEAP (25) (299) eap: Calling submodule eap_peap to process data (299) eap_peap: Continuing EAP-TLS (299) eap_peap: Peer indicated complete TLS record size will be 131 bytes (299) eap_peap: Got complete TLS record (131 bytes) (299) eap_peap: [eaptls verify] = length included (299) eap_peap: (other): before/accept initialization (299) eap_peap: TLS_accept: before/accept initialization (299) eap_peap: <<< recv TLS 1.2 [length 007e] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 0039] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 149f] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 014d] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: >>> send TLS 1.2 [length 0004] (299) eap_peap: TLS_accept: unknown state (299) eap_peap: TLS_accept: unknown state (299) eap_peap: TLS_accept: unknown state (299) eap_peap: TLS_accept: Need to read more data: unknown state (299) eap_peap: TLS_accept: Need to read more data: unknown state (299) eap_peap: In SSL Handshake Phase (299) eap_peap: In SSL Accept mode (299) eap_peap: [eaptls process] = handled (299) eap: Sending EAP Request (code 1) ID 3 length 1004 (299) eap: EAP session adding &reply:State = 0xe37f3d5de27c24b2 (299) [eap] = handled (299) } # authenticate = handled (299) Using Post-Auth-Type Challenge (299) Post-Auth-Type sub-section not found. Ignoring. (299) # Executing group from file /etc/freeradius/sites-enabled/default (299) Sent Access-Challenge Id 47 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (299) EAP-Message = 0x010303ec19c00000163d16030300390200003503032221981d91de057e15a5d627e7d85254 fb02778827cee35a6895f65d00e6180c00c02f00000dff01000100000b000403000102160303 149f0b00149b001498000a1130820a0d308208f5a00302010202120314c38ef6206d2a5d13b5 c8cb45752f9f (299) Message-Authenticator = 0x00000000000000000000000000000000 (299) State = 0xe37f3d5de27c24b242773e627ff3f802 (299) Finished request (240) Cleaning up request packet ID 111 with timestamp +10 (241) Cleaning up request packet ID 60 with timestamp +10 (300) Received Access-Request Id 62 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (300) User-Name = "kp@<domain-stripped>" (300) NAS-IP-Address = 10.2.254.253 (300) NAS-Port = 0 (300) NAS-Identifier = "10.2.254.253" (300) NAS-Port-Type = Wireless-802.11 (300) Calling-Station-Id = "843E1D87F5BF" (300) Called-Station-Id = "204C03033278" (300) Service-Type = Framed-User (300) Framed-MTU = 1100 (300) EAP-Message = 0x020300061900 (300) State = 0xe37f3d5de27c24b242773e627ff3f802 (300) Aruba-Essid-Name = "RatseNetL" (300) Aruba-Location-Id = "AP18" (300) Aruba-AP-Group = "OS-Trakt" (300) Message-Authenticator = 0x808be1cbe0d6892e798f1d3413c760b5 (300) session-state: No cached attributes (300) # Executing section authorize from file /etc/freeradius/sites-enabled/default (300) authorize { (300) [preprocess] = ok (300) ntdomain: Checking for prefix before "\" (300) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (300) ntdomain: No such realm "NULL" (300) [ntdomain] = noop (300) update control { (300) &Proxy-To-Realm := LOCAL (300) } # update control = noop (300) [chap] = noop (300) [mschap] = noop (300) [digest] = noop (300) eap: Peer sent EAP Response (code 2) ID 3 length 6 (300) eap: Continuing tunnel setup (300) [eap] = ok (300) } # authorize = ok (300) Found Auth-Type = eap (300) # Executing group from file /etc/freeradius/sites-enabled/default (300) authenticate { (300) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (300) eap: Finished EAP session with state 0xe37f3d5de27c24b2 (300) eap: Previous EAP request found for state 0xe37f3d5de27c24b2, released from the list (300) eap: Peer sent packet with method EAP PEAP (25) (300) eap: Calling submodule eap_peap to process data (300) eap_peap: Continuing EAP-TLS (300) eap_peap: Peer ACKed our handshake fragment (300) eap_peap: [eaptls verify] = request (300) eap_peap: [eaptls process] = handled (300) eap: Sending EAP Request (code 1) ID 4 length 1000 (300) eap: EAP session adding &reply:State = 0xe37f3d5de17b24b2 (300) [eap] = handled (300) } # authenticate = handled (300) Using Post-Auth-Type Challenge (300) Post-Auth-Type sub-section not found. Ignoring. (300) # Executing group from file /etc/freeradius/sites-enabled/default (300) Sent Access-Challenge Id 62 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (300) EAP-Message = 0x010403e8194069756d2d70652e6465821b686170726f78792e7261747367796d6e61736975 6d2d70652e64658218686f6d652e7261747367796d6e617369756d2d70652e64658218696d61 702e7261747367796d6e617369756d2d70652e6465821d696e666f62726574742e7261747367 796d6e617369 (300) Message-Authenticator = 0x00000000000000000000000000000000 (300) State = 0xe37f3d5de17b24b242773e627ff3f802 (300) Finished request (242) Cleaning up request packet ID 16 with timestamp +10 (301) Received Access-Request Id 64 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (301) User-Name = "kp@<domain-stripped>" (301) NAS-IP-Address = 10.2.254.253 (301) NAS-Port = 0 (301) NAS-Identifier = "10.2.254.253" (301) NAS-Port-Type = Wireless-802.11 (301) Calling-Station-Id = "843E1D87F5BF" (301) Called-Station-Id = "204C03033278" (301) Service-Type = Framed-User (301) Framed-MTU = 1100 (301) EAP-Message = 0x020400061900 (301) State = 0xe37f3d5de17b24b242773e627ff3f802 (301) Aruba-Essid-Name = "RatseNetL" (301) Aruba-Location-Id = "AP18" (301) Aruba-AP-Group = "OS-Trakt" (301) Message-Authenticator = 0x87340687e4ff778e7567a60a6fad3440 (301) session-state: No cached attributes (301) # Executing section authorize from file /etc/freeradius/sites-enabled/default (301) authorize { (301) [preprocess] = ok (301) ntdomain: Checking for prefix before "\" (301) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (301) ntdomain: No such realm "NULL" (301) [ntdomain] = noop (301) update control { (301) &Proxy-To-Realm := LOCAL (301) } # update control = noop (301) [chap] = noop (301) [mschap] = noop (301) [digest] = noop (301) eap: Peer sent EAP Response (code 2) ID 4 length 6 (301) eap: Continuing tunnel setup (301) [eap] = ok (301) } # authorize = ok (301) Found Auth-Type = eap (301) # Executing group from file /etc/freeradius/sites-enabled/default (301) authenticate { (301) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (301) eap: Finished EAP session with state 0xe37f3d5de17b24b2 (301) eap: Previous EAP request found for state 0xe37f3d5de17b24b2, released from the list (301) eap: Peer sent packet with method EAP PEAP (25) (301) eap: Calling submodule eap_peap to process data (301) eap_peap: Continuing EAP-TLS (301) eap_peap: Peer ACKed our handshake fragment (301) eap_peap: [eaptls verify] = request (301) eap_peap: [eaptls process] = handled (301) eap: Sending EAP Request (code 1) ID 5 length 1000 (301) eap: EAP session adding &reply:State = 0xe37f3d5de07a24b2 (301) [eap] = handled (301) } # authenticate = handled (301) Using Post-Auth-Type Challenge (301) Post-Auth-Type sub-section not found. Ignoring. (301) # Executing group from file /etc/freeradius/sites-enabled/default (301) Sent Access-Challenge Id 64 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (301) EAP-Message = 0x010503e81940796d6e617369756d2d70652e64658223776c616e2d636f6e74726f6c6c6572 2e7261747367796d6e617369756d2d70652e646582177777772e7261747367796d6e61736975 6d2d70652e6465821a7a61626269782e7261747367796d6e617369756d2d70652e6465301306 03551d20040c (301) Message-Authenticator = 0x00000000000000000000000000000000 (301) State = 0xe37f3d5de07a24b242773e627ff3f802 (301) Finished request (302) Received Access-Request Id 52 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (302) User-Name = "kp@<domain-stripped>" (302) NAS-IP-Address = 10.2.254.253 (302) NAS-Port = 0 (302) NAS-Identifier = "10.2.254.253" (302) NAS-Port-Type = Wireless-802.11 (302) Calling-Station-Id = "843E1D87F5BF" (302) Called-Station-Id = "204C03033278" (302) Service-Type = Framed-User (302) Framed-MTU = 1100 (302) EAP-Message = 0x020500061900 (302) State = 0xe37f3d5de07a24b242773e627ff3f802 (302) Aruba-Essid-Name = "RatseNetL" (302) Aruba-Location-Id = "AP18" (302) Aruba-AP-Group = "OS-Trakt" (302) Message-Authenticator = 0xa55c00579b9ed3c4554238f83309a7be (302) session-state: No cached attributes (302) # Executing section authorize from file /etc/freeradius/sites-enabled/default (302) authorize { (302) [preprocess] = ok (302) ntdomain: Checking for prefix before "\" (302) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (302) ntdomain: No such realm "NULL" (302) [ntdomain] = noop (302) update control { (302) &Proxy-To-Realm := LOCAL (302) } # update control = noop (302) [chap] = noop (302) [mschap] = noop (302) [digest] = noop (302) eap: Peer sent EAP Response (code 2) ID 5 length 6 (302) eap: Continuing tunnel setup (302) [eap] = ok (302) } # authorize = ok (302) Found Auth-Type = eap (302) # Executing group from file /etc/freeradius/sites-enabled/default (302) authenticate { (302) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (302) eap: Finished EAP session with state 0xe37f3d5de07a24b2 (302) eap: Previous EAP request found for state 0xe37f3d5de07a24b2, released from the list (302) eap: Peer sent packet with method EAP PEAP (25) (302) eap: Calling submodule eap_peap to process data (302) eap_peap: Continuing EAP-TLS (302) eap_peap: Peer ACKed our handshake fragment (302) eap_peap: [eaptls verify] = request (302) eap_peap: [eaptls process] = handled (302) eap: Sending EAP Request (code 1) ID 6 length 1000 (302) eap: EAP session adding &reply:State = 0xe37f3d5de77924b2 (302) [eap] = handled (302) } # authenticate = handled (302) Using Post-Auth-Type Challenge (302) Post-Auth-Type sub-section not found. Ignoring. (302) # Executing group from file /etc/freeradius/sites-enabled/default (302) Sent Access-Challenge Id 52 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (302) EAP-Message = 0x010603e819400b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34 c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f8 30175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60 677566b3f118 (302) Message-Authenticator = 0x00000000000000000000000000000000 (302) State = 0xe37f3d5de77924b242773e627ff3f802 (302) Finished request (243) Cleaning up request packet ID 156 with timestamp +10 Waking up in 0.9 seconds. (303) Received Access-Request Id 130 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (303) User-Name = "kp@<domain-stripped>" (303) NAS-IP-Address = 10.2.254.253 (303) NAS-Port = 0 (303) NAS-Identifier = "10.2.254.253" (303) NAS-Port-Type = Wireless-802.11 (303) Calling-Station-Id = "843E1D87F5BF" (303) Called-Station-Id = "204C03033278" (303) Service-Type = Framed-User (303) Framed-MTU = 1100 (303) EAP-Message = 0x020600061900 (303) State = 0xe37f3d5de77924b242773e627ff3f802 (303) Aruba-Essid-Name = "RatseNetL" (303) Aruba-Location-Id = "AP18" (303) Aruba-AP-Group = "OS-Trakt" (303) Message-Authenticator = 0x718692290105f2acae5e8598d3db3aad (303) session-state: No cached attributes (303) # Executing section authorize from file /etc/freeradius/sites-enabled/default (303) authorize { (303) [preprocess] = ok (303) ntdomain: Checking for prefix before "\" (303) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (303) ntdomain: No such realm "NULL" (303) [ntdomain] = noop (303) update control { (303) &Proxy-To-Realm := LOCAL (303) } # update control = noop (303) [chap] = noop (303) [mschap] = noop (303) [digest] = noop (303) eap: Peer sent EAP Response (code 2) ID 6 length 6 (303) eap: Continuing tunnel setup (303) [eap] = ok (303) } # authorize = ok (303) Found Auth-Type = eap (303) # Executing group from file /etc/freeradius/sites-enabled/default (303) authenticate { (303) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (303) eap: Finished EAP session with state 0xe37f3d5de77924b2 (303) eap: Previous EAP request found for state 0xe37f3d5de77924b2, released from the list (303) eap: Peer sent packet with method EAP PEAP (25) (303) eap: Calling submodule eap_peap to process data (303) eap_peap: Continuing EAP-TLS (303) eap_peap: Peer ACKed our handshake fragment (303) eap_peap: [eaptls verify] = request (303) eap_peap: [eaptls process] = handled (303) eap: Sending EAP Request (code 1) ID 7 length 1000 (303) eap: EAP session adding &reply:State = 0xe37f3d5de67824b2 (303) [eap] = handled (303) } # authenticate = handled (303) Using Post-Auth-Type Challenge (303) Post-Auth-Type sub-section not found. Ignoring. (303) # Executing group from file /etc/freeradius/sites-enabled/default (303) Sent Access-Challenge Id 130 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (303) EAP-Message = 0x010703e8194002010202104001772137d4e942b8ee76aa3c640ab7300d06092a864886f70d 01010b0500303f31243022060355040a131b4469676974616c205369676e6174757265205472 75737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3231 303132303139 (303) Message-Authenticator = 0x00000000000000000000000000000000 (303) State = 0xe37f3d5de67824b242773e627ff3f802 (303) Finished request Waking up in 0.8 seconds. (304) Received Access-Request Id 7 from 10.2.254.253:60831 to 10.0.0.248:1812 length 205 (304) User-Name = "kp@<domain-stripped>" (304) NAS-IP-Address = 10.2.254.253 (304) NAS-Port = 0 (304) NAS-Identifier = "10.2.254.253" (304) NAS-Port-Type = Wireless-802.11 (304) Calling-Station-Id = "843E1D87F5BF" (304) Called-Station-Id = "204C03033278" (304) Service-Type = Framed-User (304) Framed-MTU = 1100 (304) EAP-Message = 0x020700061900 (304) State = 0xe37f3d5de67824b242773e627ff3f802 (304) Aruba-Essid-Name = "RatseNetL" (304) Aruba-Location-Id = "AP18" (304) Aruba-AP-Group = "OS-Trakt" (304) Message-Authenticator = 0x2c0fc1bf87744bffe4e874075c9484f0 (304) session-state: No cached attributes (304) # Executing section authorize from file /etc/freeradius/sites-enabled/default (304) authorize { (304) [preprocess] = ok (304) ntdomain: Checking for prefix before "\" (304) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (304) ntdomain: No such realm "NULL" (304) [ntdomain] = noop (304) update control { (304) &Proxy-To-Realm := LOCAL (304) } # update control = noop (304) [chap] = noop (304) [mschap] = noop (304) [digest] = noop (304) eap: Peer sent EAP Response (code 2) ID 7 length 6 (304) eap: Continuing tunnel setup (304) [eap] = ok (304) } # authorize = ok (304) Found Auth-Type = eap (304) # Executing group from file /etc/freeradius/sites-enabled/default (304) authenticate { (304) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (304) eap: Finished EAP session with state 0xe37f3d5de67824b2 (304) eap: Previous EAP request found for state 0xe37f3d5de67824b2, released from the list (304) eap: Peer sent packet with method EAP PEAP (25) (304) eap: Calling submodule eap_peap to process data (304) eap_peap: Continuing EAP-TLS (304) eap_peap: Peer ACKed our handshake fragment (304) eap_peap: [eaptls verify] = request (304) eap_peap: [eaptls process] = handled (304) eap: Sending EAP Request (code 1) ID 8 length 729 (304) eap: EAP session adding &reply:State = 0xe37f3d5de57724b2 (304) [eap] = handled (304) } # authenticate = handled (304) Using Post-Auth-Type Challenge (304) Post-Auth-Type sub-section not found. Ignoring. (304) # Executing group from file /etc/freeradius/sites-enabled/default (304) Sent Access-Challenge Id 7 from 10.0.0.248:1812 to 10.2.254.253:60831 length 0 (304) EAP-Message = 0x010802d919007970742e6f7267303c0603551d1f043530333031a02fa02d862b687474703a 2f2f63726c2e6964656e74727573742e636f6d2f445354524f4f544341583343524c2e63726c 301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a8648 86f70d01010b (304) Message-Authenticator = 0x00000000000000000000000000000000 (304) State = 0xe37f3d5de57724b242773e627ff3f802 (304) Finished request Waking up in 0.8 seconds. (305) Received Access-Request Id 157 from 10.2.254.253:60831 to 10.0.0.248:1812 length 216 (305) User-Name = "kp@<domain-stripped>" (305) NAS-IP-Address = 10.2.254.253 (305) NAS-Port = 0 (305) NAS-Identifier = "10.2.254.253" (305) NAS-Port-Type = Wireless-802.11 (305) Calling-Station-Id = "843E1D87F5BF" (305) Called-Station-Id = "204C03033278" (305) Service-Type = Framed-User (305) Framed-MTU = 1100 (305) EAP-Message = 0x020800111980000000071503030002022d (305) State = 0xe37f3d5de57724b242773e627ff3f802 (305) Aruba-Essid-Name = "RatseNetL" (305) Aruba-Location-Id = "AP18" (305) Aruba-AP-Group = "OS-Trakt" (305) Message-Authenticator = 0x2db17bbdf81f36dcb1577a0066f224d2 (305) session-state: No cached attributes (305) # Executing section authorize from file /etc/freeradius/sites-enabled/default (305) authorize { (305) [preprocess] = ok (305) ntdomain: Checking for prefix before "\" (305) ntdomain: No '\' in User-Name = "kp@<domain-stripped>", looking up realm NULL (305) ntdomain: No such realm "NULL" (305) [ntdomain] = noop (305) update control { (305) &Proxy-To-Realm := LOCAL (305) } # update control = noop (305) [chap] = noop (305) [mschap] = noop (305) [digest] = noop (305) eap: Peer sent EAP Response (code 2) ID 8 length 17 (305) eap: Continuing tunnel setup (305) [eap] = ok (305) } # authorize = ok (305) Found Auth-Type = eap (305) # Executing group from file /etc/freeradius/sites-enabled/default (305) authenticate { (305) eap: Expiring EAP session with state 0x2b35f9422b37e0b9 (305) eap: Finished EAP session with state 0xe37f3d5de57724b2 (305) eap: Previous EAP request found for state 0xe37f3d5de57724b2, released from the list (305) eap: Peer sent packet with method EAP PEAP (25) (305) eap: Calling submodule eap_peap to process data (305) eap_peap: Continuing EAP-TLS (305) eap_peap: Peer indicated complete TLS record size will be 7 bytes (305) eap_peap: Got complete TLS record (7 bytes) (305) eap_peap: [eaptls verify] = length included (305) eap_peap: <<< recv TLS 1.2 [length 0002] (305) eap_peap: ERROR: TLS Alert read:fatal:certificate expired (305) eap_peap: ERROR: TLS_accept: Failed in error (305) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read) (305) eap_peap: ERROR: error:14094415:SSL routines:ssl3_read_bytes:sslv3 alert certificate expired (305) eap_peap: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure (305) eap_peap: ERROR: System call (I/O) error (-1) (305) eap_peap: ERROR: TLS receive handshake failed during operation (305) eap_peap: ERROR: [eaptls process] = fail (305) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (305) eap: Sending EAP Failure (code 4) ID 8 length 4 (305) eap: Failed in EAP select (305) [eap] = invalid (305) } # authenticate = invalid (305) Failed to authenticate the user (305) Using Post-Auth-Type Reject (305) Post-Auth-Type sub-section not found. Ignoring. (305) # Executing group from file /etc/freeradius/sites-enabled/default (305) Login incorrect (eap_peap: TLS Alert read:fatal:certificate expired): [kp@<domain-stripped>/<via Auth-Type = eap>] (from client wlan_controller port 0 cli 843E1D87F5BF) (305) Delaying response for 1.000000 seconds ```

2 1

Problem with datetime and mysql
by ANGEL LUIS MATEO MARTINEZ 19 Sep '23

19 Sep '23

Hello, I have a running freeradius with Ubuntu 18.04 and freeradius 3.0.19. In this system I'm using mysql to store accounting records in a MySQL database (radacct). To achieve this, I'm using the buffered-sql site. This is working fine. Now I'm developing a new updated system with Ubuntu 22.04 and freeradius 3.0.26. I'm trying to configure this same MySQL database. I'm using the same database. Although the store in the database is working, I have a problem with datetime stored in acctstarttime, aactupdatetime and acctstoptime columns. The problem is that the datetime stored is 1 hour ahead of my current time. I have both SO configured with the same timezone. In my case, it's Europe/Madrid (CEST, GMT+2 now). I have also the same queries.conf file in both systems. I'm using the queries.conf distributed with the freeradius 3.0.26 22.04 package. In this file: ... event_timestamp_epoch = "%{%{integer:Event-Timestamp}:-%l}" # event_timestamp is the SQL snippet for converting an epoch timestamp # to an SQL date. event_timestamp = "FROM_UNIXTIME(${event_timestamp_epoch})" ... start { # # Insert a new record into the sessions table # query = "\ INSERT INTO ${....acct_table1} \ (${...column_list}) \ VALUES \ ('%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ '%{Realm}', \ '%{NAS-IP-Address}', \ '%{%{NAS-Port-ID}:-%{NAS-Port}}', \ '%{NAS-Port-Type}', \ ${....event_timestamp}, \ ${....event_timestamp}, \ NULL, \ '0', \ '%{Acct-Authentic}', \ '%{Connect-Info}', \ '', \ '0', \ '0', \ '%{Called-Station-Id}', \ '%{Calling-Station-Id}', \ '', \ '%{Service-Type}', \ '%{Framed-Protocol}', \ '%{Framed-IP-Address}', \ '%{Framed-IPv6-Address}', \ '%{Framed-IPv6-Prefix}', \ '%{Framed-Interface-Id}', \ '%{Delegated-IPv6-Prefix}' \ ${....class.packet_xlat})" ... With this configuration, I have this Start record in my old system: Fri Sep 15 09:33:10 2023 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 15728730 NAS-Port-Type = Virtual User-Name = "XXXXX(a)um.es" Calling-Station-Id = "155.54.67.5" Called-Station-Id = "155.54.213.7" MS-CHAP-Domain = "um.es" Acct-Session-Id = "81a00056" Framed-IP-Address = 155.54.192.37 Acct-Authentic = RADIUS Event-Timestamp = "Sep 15 2023 09:33:10 CEST" Acct-Status-Type = Start NAS-Identifier = "MikroTik-Pruebas" Acct-Delay-Time = 0 Mikrotik-Realm = "um.es" NAS-IP-Address = 155.54.213.7 Huntgroup-Name = "vpn" X-Atica-Service = "vpn" X-Atica-Service-Filter = "vpn" Stripped-User-Name = "XXXXX" Realm = "um.es" Timestamp = 1694763190 and the corresponding insert query in the database is: use dbradiuslog; SET timestamp=1694763191; INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('81a00056', 'eb9b9fe238b5a46ac0e6be64acd6ec58', 'XXXXX(a)um.es', 'um.es', '155.54.213.7', '15728730', 'Virtual', FROM_UNIXTIME(1694763190), FROM_UNIXTIME(1694763190), NULL, '0', 'RADIUS', '', '', '0', '0', '155.54.213.7', '155.54.67.5', '', 'Framed-User', 'PPP', '155.54.192.37', '', '', '', '' ); where the 1694763191 timestamp is "Fri Sep 15 2023 09:33:11 GMT+0200" and 1694763190 is "Fri Sep 15 2023 09:33:10 GMT+0200" and datetimes are correct. But in the updated system I have this detail entry: Fri Sep 15 09:35:47 2023 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 15728731 NAS-Port-Type = Virtual User-Name = "XXXXX(a)um.es" Calling-Station-Id = "155.54.67.5" Called-Station-Id = "155.54.213.7" MS-CHAP-Domain = "um.es" Acct-Session-Id = "81a00057" Framed-IP-Address = 155.54.194.50 Acct-Authentic = RADIUS Event-Timestamp = "Sep 15 2023 09:35:47 CEST" Acct-Status-Type = Start NAS-Identifier = "MikroTik-Pruebas" Acct-Delay-Time = 0 Mikrotik-Realm = "um.es" NAS-IP-Address = 155.54.213.7 Huntgroup-Name = "vpn" X-Atica-Service = "vpn" X-Atica-Service-Filter = "vpn" Stripped-User-Name = "XXXXX" Realm = "um.es" Timestamp = 1694763347 and the insert query is: use dbradiuslog; SET timestamp=1694763348; INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('81a00057', '186c6d4ebe375d3178097fe46f3bdaae', 'XXXXX(a)um.es', 'um.es', '155.54.213.7', '15728731', 'Virtual', FROM_UNIXTIME(1694766947), FROM_UNIXTIME(1694766947), NULL, '0', 'RADIUS', '', '', '0', '0', '155.54.213.7', '155.54.67.5', '', 'Framed-User', 'PPP', '155.54.194.50', '', '', '', '' ); in this case, the first 1694763348 datetime (the used in SET) corresponds to "Fri Sep 15 2023 09:35:48 GMT+0200" (it's fine), but the 1694766947 used in FROM_UNIX(1694766947) corresponds to "Fri Sep 15 2023 10:35:47 GMT+0200" which is wrong. The date stored in the database is wrong too. It seems that there is a problem somewhere in the transformation from the Event-Timestamp entry in the detail to the epoch used in the SQL query. Any help with this? Thank you.

2 4

MySQL Client Issue
by Selahattin CILEK 18 Sep '23

18 Sep '23

I have been installing FreeRADIUS 3 on pfSense for about out 5 years and it always came bundled with some version of *mysql57-client* (this or that minor version) and it always worked well with *mysql57-server* (again, this or that minor version), which FreeRADIUS connected to. To give you a context, the last time I installed was about a month ago and the versions were as follows: pfSense -> 2.6.0 (FreeBSD 1.3-STABLE) FreeRADIUS -> 3.0.25 MySQL Client -> 5.736 But the guys at pfSense decided to skip version 13 of FreeBSD and build version 2.7.0 on FreeBSDversion 14. The 2.7.0 version of pfSense comes with *freeradius3-3.2.2* and *mysql80-client-8.0.32_2* . Of course, I could just install *mysql80-client-8.0.32_2* and modify my SQL code a little bit and it would still work. But the problem is that I have Syslog-NG installed on the system and it too connects to the same MySQL instance and though it has been upgraded to version 4.20, it still uses the old *mysql57-client. * So is there a way to get FreeRADIUS 3.2.2 to work with the old MySQL client, you know, using the good old "libdbi" driver? * * -- This email has been checked for viruses by Avast antivirus software. www.avast.com

4 12

When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work
by 平林哲 15 Sep '23

15 Sep '23

Hi! When using DOUBLE_QUOTED_STRING, passwords with '\"' may not work. Register a user in ActiveDirectory with the password "pass\"word@2022", the following LDAP settings. === # cat /usr/local/etc/raddb/mods-enabled/ldap1 ldap { server = '192.168.1.6' identity = 'cn=tkt10886-3,cn=users,dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' password = "pass\"word@2022" base_dn = 'dc=srv2022,dc=rdd-osaka,dc=soliton,dc=example,dc=jp' === When attempting to start the RADIUS service in this state, a syntax error occurred. ===== # /usr/local/sbin/radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/ldap1 /usr/local/etc/raddb/mods-enabled/ldap1[4]: Syntax error: Expected comma after 'pass\\': word@2022" Errors reading or parsing /usr/local/etc/raddb/radiusd.conf ===== We also tried several patterns and summarised the results. Password | Configration | Result -------------------|-----------------------|------- pass"word@2022 | "pass\"word@2022" | OK pass\"word@2022 | "pass\\"word@2022" | Syntax error pass\\"word@2022 | "pass\\\"word@2022" | OK pass\\\"word@2022 | "pass\\\\"word@2022" | Syntax error As mentioned above, a Syntax Error occurs when '\' is an even number in the configuration. After investigating the cause of this, it appears that there is a problem with the determination of '˶' in the following section. === /* * Convert backslash-quote to quote, but * leave everything else alone. */ if (p[1] == quote) { /* convert '\'' --> ' */ p++; } else { if (buflen < 2) { fr_strerror_printf("Truncated input"); return T_INVALID; } *(s++) = *(p++); } *(s++) = *(p++); } === This problem was solved by changing the above section as follows. === } else { /* * Convert backslash-quote to quote, but * leave everything else alone. */ if (p[1] == quote) { /* convert '\'' --> ' */ if (p[2] != '\0') { p++; } } *(s++) = *(p++); } === Is this the right approach? Any advice would be appreciated.

4 24

Windows and TLS 1.0 / TLS 1.1
by Alan DeKok 11 Sep '23

11 Sep '23

Microsoft is disabled TLS 1.0 and TLS 1.1 in newer versions of Windows. This shouldn't affect most people. However, if you're running a very old RADIUS server (e.g. 5+ years), then it's time to upgrade. Your users will not be able to get online. https://www.theregister.com/2023/09/04/tls_windows_deprecation/ Alan DeKok.

2 2

How to cleanly shut down a PEAP TLS tunnel
by Joe Garcia 11 Sep '23

11 Sep '23

I've got a client that tries to shut down the TLS tunnel used for PEAP after running through the full authentication process and getting the Access-Accept/Success at the end. However the Access-Accept/Success comes in without a State attribute, and if the TLS Close-Alert (appropriately wrapped in several layers of outer protocols) is sent that way then FreeRADIUS reports: (18) eap: ERROR: EAP requires the State attribute to work, but no State exists in the Access-Request packet. (18) eap: ERROR: The RADIUS client is broken. No amount of changing FreeRADIUS will fix the RADIUS client. (18) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request If OTOH I use the State value from the last message preceding the Access-Accept/Success I get: (37) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0x57f74ed950ff57da (37) eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request What's the correct way to perform a clean shutdown of the TLS tunnel after completing the PEAP authentication process? Or do you just leave it hanging? Although no two diagrams seem to be able to agree on what happens at this point, one example is this: https://mrncciew.files.wordpress.com/2014/08/eap-peap-20.png which tears down the tunnel at step 15 and then the client gets the Access-Accept/Success at step 16/17, while with FreeRADIUS I'm getting the Access-Accept/Success before the TLS tunnel is torn down and then one of the two errors above with an attempt to tear down the tunnel. JG.

2 2

Is Radius Authorization bound to Radius Authentication?
by little-nemo＠virgilio.it 08 Sep '23

08 Sep '23

Dear members, I managed to autenticate users through MschapV2/ntlm_auth vs Active Directory (reference#1 https://networkradius.com/articles/2021/02/04/active-directory-with-FreeRAD…, reference#2 https://networkradius.com/articles/2021/09/29/configure-authentication-with…) Freeradius version: 3.0.21. Then I read "Authentication systems and protocol compatibility https://networkradius.com/articles/2021/10/08/authentication-system-and-pro…" and "Authenticating Users with LDAP https://freeradius.org/documentation/freeradius-server/3.2.4/concepts/modul…", so now I wonder whether I could also use LDAP(S) for the Authorization phase-only. The doubt comes from the presence of the "identity" in mods-available/ldap. Is that Identity used for the binding to AD? I guess so. Thus, username/password of the user trying to authenticate are not involved in the LDAP binding. Am I wrong? Is it worth to spend additional time to study how to setup LDAP Authorization? The primary goal is to read group membership but in future other needs may arise. Thanks in advance for your time. Pietro

2 1

freeradius windows machine authentication
by Härtl, Calvin 04 Sep '23

04 Sep '23

Hi all, first of all thanks for your great help in my past questions! Sadly, I have yet another one, that I can not quite figure out. Maybe I missed something, I don’t know. I tried looking for past list-threads, to no avail. When my Windows client connects to the WiFi and subsequently to the FreeRADIUS server, it first authenticates via machine authentication (host/HOSTNAME.MYDOMAIN.COM) This fails and the client cannot connect to the WiFi: (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) eap_mschapv2: authenticate { (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: Client is using MS-CHAPv2 (6) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (6) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (6) mschap: --> --username=host/HOSTNAME.DOMAIN.COM (6) mschap: Creating challenge hash with username: host/HOSTNAME.DOMAIN.COM (6) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (6) mschap: --> --challenge=ef98e59da6aea4aa (6) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (6) mschap: --> --nt-response=1e7106295666480efb781446f97f618e57e09017da042590 (6) mschap: ERROR: Program returned code (1) and output 'The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d)' (6) mschap: External script failed (6) mschap: ERROR: External script says: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xc000006d) (6) mschap: ERROR: MS-CHAP2-Response is incorrect (6) eap_mschapv2: [mschap] = reject (6) eap_mschapv2: } # authenticate = reject However, if I manually configure the WiFi on my Windows device to only use user authentication, it works flawlessly (as expected): (14) eap_mschapv2: authenticate { (14) mschap: Creating challenge hash with username: calvin.haertl (14) mschap: Client is using MS-CHAPv2 (14) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (14) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (14) mschap: --> --username=MYUSERNAME (14) mschap: Creating challenge hash with username: MYUSERNAME (14) mschap: Program returned code (0) (14) mschap: Adding MS-CHAPv2 MPPE keys (14) eap_mschapv2: [mschap] = ok (14) eap_mschapv2: } # authenticate = ok (14) eap_mschapv2: MSCHAP Success (14) eap: Sending EAP Request (code 1) ID 9 length 51 My FreeRADIUS server is connected to our Active Directory via SAMBA and winbind, and I checked that the users can authenticate via radtest. Is FreeRADIUS natively capable of doing machine authentication via AD, do I have to configure some additional files or are there any modules that I can install to do this for me? Kind regards, Calvin

4 5