- Freeradius-Users - lists.freeradius.org

Enhanced regex support
by Arran Cudbard-Bell 13 Dec '14

13 Dec '14

Regular expressions were one of the few non binary safe functions of the expression evaluation code. The reason for this was the POSIX specified regexec and regcomp functions didn't take a length argument and would stop parsing if they hit an embedded \0. This has been well known security vulnerability in the PHP world for the past 10 years, where in some cases form validation could be bypassed by adding an embedded null to a string being validated. It could have been used in a similar way for RADIUS, though the likelihood of someone using it to expose a critical vulnerability in a site's configuration was slim, so it was never a priority to fix. The latest series of commits introduces some changes in how regexes are handled. * If you're building on a POSIX compliant non-BSD system without libpcre (i.e. most Linuxes) and if the regex code finds an embedded \0 in the pattern or subject of the regular expression, evaluation will fail. * If you're building on a POSIX compliant BSD system, regncomp and regnexec are used. These are non-portable BSD functions which take a length argument. In this case a string with an embedded \0 will be treated like any other string. * If you're building on a system with libpcre, the native libpcre functions are used (previously we relied on the pcreposix shim). As pcre_compile, pcre_study and pcre_exec all take length arguments, a string with an embedded \0 will be treated like any other string. In addition to being mostly (apart from POSIX) binary safe, switching to the native libpcre library has some advantages. If using libpcre > 8.20 the JIT compiler is now used for precompiled expressions (the majority of unlang if statements). The JIT compiler converts the compiled expression to architecture specific byte code, which should execute significantly faster, especially in expressions with lots of alternation. Named capture groups are also available if using libpcre, and may be accessed using %{regex:<named capture group>}. Reworking the subcapture storage code has removed the performance penalty for large numbers of subcaptures, so the limit has been increased to 32. The limit is completely arbitrary, but is compiled in, so can't be changed in the config. If people really want more capture groups then it can be increased again. The memory cost is 12 bytes for every PCRE capture group or 16 bytes for every POSIX capture group, and access is O(1). -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 1

Fwd: Inner Tunnel User-Name - PEAP/MSCHAPV2
by Chris Arg 12 Dec '14

12 Dec '14

Hello FR Users, I'm currently using 3.0.x via github on RHEL 7. My issue is that I'm unable to get the User-Name attribute out of the inner tunnel. My setup is very simple, I'm proxying my authentication requests to an NPS server. It appears that part of my issue is spawning from the fact that NPS replies *without* a User-Name attribute. I've seen a couple of examples demonstrating how to update the reply or update outer.reply in the inner-tunnel post-auth section. After reading the debug output, that section doesn't seem to run. Instead, post-proxy is run which looks like a good alternative. This is what I've tried in the post-proxy section: update { &reply:User-Name += &User-Name } And this is what happens: (8) # Executing section post-proxy from file /etc/raddb/sites-enabled/inner-tunnel (8) post-proxy { (8) update { (8) &reply:User-Name += &User-Name -> 'mydomain\user000' (8) } # update = noop This is obviously wrong since it doesn't work. Any help would be greatly appreciated. Thanks, Chris --------------- *raddb/mods-enabled/eap* peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } --------------- *raddb/sites-enabled/inner-tunnel* server inner-tunnel { authorize { ntdomain suffix eap { ok = return } expiration logintime pap } authenticate { eap } post-auth { update { &outer.session-state: += &reply: &outer.session-state:User-Name += &User-Name } Post-Auth-Type REJECT { attr_filter.access_reject update outer.session-state { Module-Failure-Message := &request:Module-Failure-Message } } } post-proxy { update { &reply:User-Name += &User-Name } eap } --------------- *raddb/sites-enabled/default* server default { authorize { filter_username preprocess ntdomain suffix eap { ok = return } -ldap expiration logintime } authenticate { eap } preacct { preprocess acct_unique suffix files } accounting { detail unix exec attr_filter.accounting_response } post-auth { update { &reply: += &session-state: } exec remove_reply_message_if_eap Post-Auth-Type REJECT { attr_filter.access_reject eap remove_reply_message_if_eap } } post-proxy { eap } } --------------- *DEBUG* (7) Received Access-Request Id 28 from 172.23.242.165:1645 to 192.168.244.230:1812 length 276 (7) User-Name = 'anon1337' (7) Service-Type = Framed-User (7) Framed-IP-Address = 192.168.243.38 (7) Framed-MTU = 1500 (7) Called-Station-Id = '00-00-00-00-AA-AA' (7) Calling-Station-Id = '00-00-00-00-BB-BB' (7) EAP-Message = 0x026e0060190017030192.1680e6cb89aa98510fc404f1b7eb4933b8fc6042f461ca57ff5c3ac6d28f635e8367170301003003e93d2105ca95de4eb989a97f8beadb2ea20de1f5482dd4163a672bf875c413a29e3028b2e95d53c5b2856b29fe1deb (7) Message-Authenticator = 0xd5950daf85b25b80689292da899bdd86 (7) NAS-Port-Type = Ethernet (7) NAS-Port = 50002 (7) NAS-Port-Id = 'FastEthernet0/2' (7) Called-Station-Id = '00-00-00-00-AA-AA' (7) State = 0x2196d8c927f8c10ed58b5f9872208c8c (7) NAS-IP-Address = 172.23.242.165 (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (!&User-Name) { (7) if (!&User-Name) -> FALSE (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@.*@/ ) { (7) if (&User-Name =~ /@.*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) ntdomain: Checking for prefix before "\" (7) ntdomain: No '\' in User-Name = "anon1337", looking up realm NULL (7) ntdomain: No such realm "NULL" (7) [ntdomain] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "anon1337", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) eap: Peer sent code Response (2) ID 110 length 96 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x2196d8c927f8c10e (7) eap: Finished EAP session with state 0x2196d8c927f8c10e (7) eap: Previous EAP request found for state 0x2196d8c927f8c10e, released from the list (7) eap: Peer sent method PEAP (25) (7) eap: EAP PEAP (25) (7) eap: Calling eap_peap to process EAP data (7) eap_peap: processing EAP-TLS (7) eap_peap: eaptls_verify returned 7 (7) eap_peap: Done initial handshake (7) eap_peap: eaptls_process returned 7 (7) eap_peap: FR_TLS_OK (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state WAITING FOR INNER IDENTITY (7) eap_peap: Identity - mydomain\user000 (7) eap_peap: Got inner identity 'mydomain\user000' (7) eap_peap: Setting default EAP type for tunneled EAP session (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x026e001201676c6f62616c5c636872697361 (7) eap_peap: Setting User-Name to mydomain\user000 (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x026e001201676c6f62616c5c636872697361 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = 'mydomain\user000' (7) eap_peap: Service-Type = Framed-User (7) eap_peap: Framed-IP-Address = 192.168.243.38 (7) eap_peap: Framed-MTU = 1500 (7) eap_peap: Called-Station-Id = '00-00-00-00-AA-AA' (7) eap_peap: Called-Station-Id = '00-00-00-00-AA-AA' (7) eap_peap: Calling-Station-Id = '00-00-00-00-BB-BB' (7) eap_peap: NAS-Port-Type = Ethernet (7) eap_peap: NAS-Port = 50002 (7) eap_peap: NAS-Port-Id = 'FastEthernet0/2' (7) eap_peap: NAS-IP-Address = 172.23.242.165 (7) eap_peap: Event-Timestamp = 'Dec 11 2014 16:55:38 EST' (7) Virtual server received request (7) EAP-Message = 0x026e001201676c6f62616c5c636872697361 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = 'mydomain\user000' (7) Service-Type = Framed-User (7) Framed-IP-Address = 192.168.243.38 (7) Framed-MTU = 1500 (7) Called-Station-Id = '00-00-00-00-AA-AA' (7) Called-Station-Id = '00-00-00-00-AA-AA' (7) Calling-Station-Id = '00-00-00-00-BB-BB' (7) NAS-Port-Type = Ethernet (7) NAS-Port = 50002 (7) NAS-Port-Id = 'FastEthernet0/2' (7) NAS-IP-Address = 172.23.242.165 (7) Event-Timestamp = 'Dec 11 2014 16:55:38 EST' (7) server inner-tunnel { (7) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (7) authorize { (7) ntdomain: Checking for prefix before "\" (7) ntdomain: Looking up realm "mydomain" for User-Name = "mydomain\user000" (7) ntdomain: Found realm "mydomain" (7) ntdomain: Adding Realm = "mydomain" (7) ntdomain: Proxying request from user mydomain\user000 to realm mydomain (7) ntdomain: Preparing to proxy authentication request to realm "mydomain" (7) [ntdomain] = updated (7) suffix: Request already has destination realm set. Ignoring (7) [suffix] = noop (7) eap: Request is supposed to be proxied to Realm mydomain. Not doing EAP. (7) [eap] = noop (7) [expiration] = noop (7) [logintime] = noop (7) [pap] = noop (7) } # authorize = updated (7) } # server inner-tunnel (7) Virtual server sending reply (7) eap_peap: Got tunneled reply code 0 (7) eap_peap: Calling authenticate in order to initiate tunneled EAP session (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) authenticate { (7) eap: Peer sent method Identity (1) (7) eap: Calling eap_mschapv2 to process EAP data (7) eap_mschapv2: Issuing Challenge (7) eap: EAP session adding &reply:State = 0xd948b86bd927a2af (7) [eap] = handled (7) } # authenticate = handled (7) eap_peap: Cancelling proxy to realm mydomain until the tunneled EAP session has been established (7) eap_peap: Got tunneled reply RADIUS code 11 (7) eap_peap: EAP-Message = 0x016f00271a016f002210909415ffc9c1692d6de6f744d7a31428676c6f62616c5c636872697361 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0xd948b86bd927a2af4aa0b84f98aa7925 (7) eap_peap: Got tunneled Access-Challenge (7) eap: EAP session adding &reply:State = 0x2196d8c926f9c10e (7) [eap] = handled (7) } # authenticate = handled (7) Sent Access-Challenge Id 28 from 192.168.244.230:1812 to 172.23.242.165:1645 length 133 (7) EAP-Message = 0x016f004b190017030100401cc068f51a055ef75f0322d45ae7db44e69bc57efebdde94cc83224d0ddc8f49c26e121d7bee4c248be63d944a02d3802b6e51e1c040b12040c57ef3e03ef1ff (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x2196d8c926f9c10ed58b5f9872208c8c (7) Finished request Waking up in 0.2 seconds. (8) Received Access-Request Id 29 from 172.23.242.165:1645 to 192.168.244.230:1812 length 324 (8) User-Name = 'anon1337' (8) Service-Type = Framed-User (8) Framed-IP-Address = 192.168.243.38 (8) Framed-MTU = 1500 (8) Called-Station-Id = '00-00-00-00-AA-AA' (8) Calling-Station-Id = '00-00-00-00-BB-BB' (8) EAP-Message = 0x026f0090190017030192.16805f6aa95b7c5dff8199c9f7ea839908b524917466ca42abdd8169c148bb2fad7d17030100609e65f129d587f058f9ad84b662ab933e21f1fdc8b1d06fc07a353ac69160d38fa1cea74279db7816d337173b79c195d37433626c4ed7aa543ade8ef91f341da2ddb4d7425c5173 (8) Message-Authenticator = 0xae08a4251146eef68e6aef5915fb17cb (8) NAS-Port-Type = Ethernet (8) NAS-Port = 50002 (8) NAS-Port-Id = 'FastEthernet0/2' (8) Called-Station-Id = '00-00-00-00-AA-AA' (8) State = 0x2196d8c926f9c10ed58b5f9872208c8c (8) NAS-IP-Address = 172.23.242.165 (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/raddb/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (!&User-Name) { (8) if (!&User-Name) -> FALSE (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@.*@/ ) { (8) if (&User-Name =~ /@.*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) ntdomain: Checking for prefix before "\" (8) ntdomain: No '\' in User-Name = "anon1337", looking up realm NULL (8) ntdomain: No such realm "NULL" (8) [ntdomain] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "anon1337", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent code Response (2) ID 111 length 144 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0xd948b86bd927a2af (8) eap: Finished EAP session with state 0x2196d8c926f9c10e (8) eap: Previous EAP request found for state 0x2196d8c926f9c10e, released from the list (8) eap: Peer sent method PEAP (25) (8) eap: EAP PEAP (25) (8) eap: Calling eap_peap to process EAP data (8) eap_peap: processing EAP-TLS (8) eap_peap: eaptls_verify returned 7 (8) eap_peap: Done initial handshake (8) eap_peap: eaptls_process returned 7 (8) eap_peap: FR_TLS_OK (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state phase2 (8) eap_peap: EAP type MSCHAPv2 (26) (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x026f00481a026f004331bce4b4548870ee6a96268e682a0e42560000000000000000f418c2cd895d3b885d533428bcd934bf8ebeadb11a9e889b00676c6f62616c5c636872697361 (8) eap_peap: Setting User-Name to mydomain\user000 (8) eap_peap: Sending tunneled request to inner-tunnel (8) eap_peap: EAP-Message = 0x026f00481a026f004331bce4b4548870ee6a96268e682a0e42560000000000000000f418c2cd895d3b885d533428bcd934bf8ebeadb11a9e889b00676c6f62616c5c636872697361 (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = 'mydomain\user000' (8) eap_peap: State = 0xd948b86bd927a2af4aa0b84f98aa7925 (8) eap_peap: Service-Type = Framed-User (8) eap_peap: Framed-IP-Address = 192.168.243.38 (8) eap_peap: Framed-MTU = 1500 (8) eap_peap: Called-Station-Id = '00-00-00-00-AA-AA' (8) eap_peap: Called-Station-Id = '00-00-00-00-AA-AA' (8) eap_peap: Calling-Station-Id = '00-00-00-00-BB-BB' (8) eap_peap: NAS-Port-Type = Ethernet (8) eap_peap: NAS-Port = 50002 (8) eap_peap: NAS-Port-Id = 'FastEthernet0/2' (8) eap_peap: NAS-IP-Address = 172.23.242.165 (8) eap_peap: Event-Timestamp = 'Dec 11 2014 16:55:38 EST' (8) Virtual server received request (8) EAP-Message = 0x026f00481a026f004331bce4b4548870ee6a96268e682a0e42560000000000000000f418c2cd895d3b885d533428bcd934bf8ebeadb11a9e889b00676c6f62616c5c636872697361 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = 'mydomain\user000' (8) State = 0xd948b86bd927a2af4aa0b84f98aa7925 (8) Service-Type = Framed-User (8) Framed-IP-Address = 192.168.243.38 (8) Framed-MTU = 1500 (8) Called-Station-Id = '00-00-00-00-AA-AA' (8) Called-Station-Id = '00-00-00-00-AA-AA' (8) Calling-Station-Id = '00-00-00-00-BB-BB' (8) NAS-Port-Type = Ethernet (8) NAS-Port = 50002 (8) NAS-Port-Id = 'FastEthernet0/2' (8) NAS-IP-Address = 172.23.242.165 (8) Event-Timestamp = 'Dec 11 2014 16:55:38 EST' (8) server inner-tunnel { (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) ntdomain: Checking for prefix before "\" (8) ntdomain: Looking up realm "mydomain" for User-Name = "mydomain\user000" (8) ntdomain: Found realm "mydomain" (8) ntdomain: Adding Realm = "mydomain" (8) ntdomain: Proxying request from user mydomain\user000 to realm mydomain (8) ntdomain: Preparing to proxy authentication request to realm "mydomain" (8) [ntdomain] = updated (8) suffix: Request already has destination realm set. Ignoring (8) [suffix] = noop (8) eap: Request is supposed to be proxied to Realm mydomain. Not doing EAP. (8) [eap] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) } # server inner-tunnel (8) Virtual server sending reply (8) eap_peap: Got tunneled reply code 0 (8) eap_peap: Calling authenticate in order to initiate tunneled EAP session (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0xd948b86bd927a2af (8) eap: Finished EAP session with state 0xd948b86bd927a2af (8) eap: Previous EAP request found for state 0xd948b86bd927a2af, released from the list (8) eap: Peer sent method MSCHAPv2 (26) (8) eap: EAP MSCHAPv2 (26) (8) eap: Calling eap_mschapv2 to process EAP data (8) eap_mschapv2: cancelling authentication and letting it be proxied (8) eap: No EAP proxy set. Not composing EAP (8) [eap] = handled (8) } # authenticate = handled (8) eap_peap: Tunnelled authentication will be proxied to mydomain (8) eap_peap: Remembering to do EAP-MS-CHAP-V2 post-proxy (8) eap: Tunneled session will be proxied. Not doing EAP (8) [eap] = handled (8) } # authenticate = handled Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 48355 (8) Proxying request to home server 192.168.1.103 port 1812 timeout 30.000000 (8) Sent Access-Request Id 198 from 0.0.0.0:48355 to 192.168.1.103:1812 length 255 (8) User-Name = 'mydomain\user000' (8) Service-Type = Framed-User (8) Framed-IP-Address = 192.168.243.38 (8) Framed-MTU = 1500 (8) Called-Station-Id = '00-00-00-00-AA-AA' (8) Called-Station-Id = '00-00-00-00-AA-AA' (8) Calling-Station-Id = '00-00-00-00-BB-BB' (8) NAS-Port-Type = Ethernet (8) NAS-Port = 50002 (8) NAS-Port-Id = 'FastEthernet0/2' (8) NAS-IP-Address = 172.23.242.165 (8) Event-Timestamp = 'Dec 11 2014 16:55:38 EST' (8) MS-CHAP-Challenge = 0x909415ffc9c1692d6de6f744d7a31428 (8) MS-CHAP2-Response = 0x6f6cbce4b4548870ee6a96268e682a0e42560000000000000000f418c2cd895d3b885d533428bcd934bf8ebeadb11a9e889b (8) Message-Authenticator := 0x00 (8) Proxy-State = 0x3239 (8) Received Access-Accept Id 198 from 192.168.1.103:1812 to 192.168.244.230:48355 length 256 (8) Proxy-State = 0x3239 (8) Framed-Protocol = PPP (8) Service-Type = Framed-User (8) Class = 0x3fc704f900000137000102000a02016700000000000000000000000001d006be3dc74c5b000000000004f90c (8) MS-MPPE-Recv-Key = 0xc91f6a04dccbaf84f7c206510152cae5 (8) MS-MPPE-Send-Key = 0xf2de36fbd643948f1f803fc4e177494f (8) MS-CHAP2-Success = 0x6f533d32453435313836344430354331393343313530383231384636304635433738463535413139383035 (8) MS-CHAP-Domain = 'oMYDOMAIN' (8) MS-Link-Utilization-Threshold = 50 (8) MS-Link-Drop-Time-Limit = 120 (8) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (8) post-proxy { (8) eap: Doing post-proxy callback (8) eap: Passing reply from proxy back into the tunnel server inner-tunnel { (8) eap: Passing reply back for EAP-MS-CHAP-V2 (8) # Executing section post-proxy from file /etc/raddb/sites-enabled/inner-tunnel (8) post-proxy { (8) update { (8) &reply:User-Name += &User-Name -> 'mydomain\user000' (8) } # update = noop (8) eap: Doing post-proxy callback (8) eap: Passing reply from proxy back into the tunnel 2. (8) eap: Proxied authentication succeeded MSCHAP Success (8) eap: EAP session adding &reply:State = 0xd948b86bd838a2af (8) [eap] = ok (8) } # post-proxy = ok } # server inner-tunnel (8) eap: Final reply from tunneled session code 11 (8) eap: Proxy-State = 0x3239 (8) eap: Framed-Protocol = PPP (8) eap: Service-Type = Framed-User (8) eap: Class = 0x3fc704f900000137000102000a02016700000000000000000000000001d006be3dc74c5b000000000004f90c (8) eap: MS-CHAP-Domain = 'oMYDOMAIN' (8) eap: MS-Link-Utilization-Threshold = 50 (8) eap: MS-Link-Drop-Time-Limit = 120 (8) eap: User-Name += 'mydomain\user000' (8) eap: EAP-Message = 0x017000331a036f002e533d32453435313836344430354331393343313530383231384636304635433738463535413139383035 (8) eap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap: State = 0xd948b86bd838a2af4aa0b84f98aa7925 (8) eap: Got reply 11 (8) eap: Got tunneled reply RADIUS code 11 (8) eap: Proxy-State = 0x3239 (8) eap: Framed-Protocol = PPP (8) eap: Service-Type = Framed-User (8) eap: Class = 0x3fc704f900000137000102000a02016700000000000000000000000001d006be3dc74c5b000000000004f90c (8) eap: MS-CHAP-Domain = 'oMYDOMAIN' (8) eap: MS-Link-Utilization-Threshold = 50 (8) eap: MS-Link-Drop-Time-Limit = 120 (8) eap: User-Name += 'mydomain\user000' (8) eap: EAP-Message = 0x017000331a036f002e533d32453435313836344430354331393343313530383231384636304635433738463535413139383035 (8) eap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap: State = 0xd948b86bd838a2af4aa0b84f98aa7925 (8) eap: Got tunneled Access-Challenge (8) eap: Reply was handled (8) eap: EAP session adding &reply:State = 0x2196d8c929e6c10e (8) [eap] = ok (8) } # post-proxy = ok (8) Sent Access-Challenge Id 29 from 192.168.244.230:1812 to 172.23.242.165:1645 length 149 (8) EAP-Message = 0x0170005b19001703010050e4af81c9ecf1135b817b48ffecdbdfedb6922e5cfe1d463f7e8ef93564a8bdc26e5ae1ef16598d2dfa622c69a1408d9be0a0ddc629ee1dc6c28f94be0e7342f5bba962637645ef95bdec9fb40ad5f6ab (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x2196d8c929e6c10ed58b5f9872208c8c (8) Finished request Waking up in 0.2 seconds. Waking up in 3.7 seconds. (9) Received Access-Request Id 30 from 172.23.242.165:1645 to 192.168.244.230:1812 length 260 (9) User-Name = 'anon1337' (9) Service-Type = Framed-User (9) Framed-IP-Address = 192.168.243.38 (9) Framed-MTU = 1500 (9) Called-Station-Id = '00-00-00-00-AA-AA' (9) Calling-Station-Id = '00-00-00-00-BB-BB' (9) EAP-Message = 0x02700050190017030192.1680ceb524c34f543d34a2114a5dc0162c1506dcb23023b799d1a6b01fd094a36bbe17030192.1680ac40f2c24559bd0245d1add229486b46e0ddc7e84ece128eed9af83704914517 (9) Message-Authenticator = 0x2db32972e884849ee872929fee306127 (9) NAS-Port-Type = Ethernet (9) NAS-Port = 50002 (9) NAS-Port-Id = 'FastEthernet0/2' (9) Called-Station-Id = '00-00-00-00-AA-AA' (9) State = 0x2196d8c929e6c10ed58b5f9872208c8c (9) NAS-IP-Address = 172.23.242.165 (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (!&User-Name) { (9) if (!&User-Name) -> FALSE (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@.*@/ ) { (9) if (&User-Name =~ /@.*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) ntdomain: Checking for prefix before "\" (9) ntdomain: No '\' in User-Name = "anon1337", looking up realm NULL (9) ntdomain: No such realm "NULL" (9) [ntdomain] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "anon1337", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent code Response (2) ID 112 length 80 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = EAP (9) # Executing group from file /etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0xd948b86bd838a2af (9) eap: Finished EAP session with state 0x2196d8c929e6c10e (9) eap: Previous EAP request found for state 0x2196d8c929e6c10e, released from the list (9) eap: Peer sent method PEAP (25) (9) eap: EAP PEAP (25) (9) eap: Calling eap_peap to process EAP data (9) eap_peap: processing EAP-TLS (9) eap_peap: eaptls_verify returned 7 (9) eap_peap: Done initial handshake (9) eap_peap: eaptls_process returned 7 (9) eap_peap: FR_TLS_OK (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP type MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x027000061a03 (9) eap_peap: Setting User-Name to mydomain\user000 (9) eap_peap: Sending tunneled request to inner-tunnel (9) eap_peap: EAP-Message = 0x027000061a03 (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = 'mydomain\user000' (9) eap_peap: State = 0xd948b86bd838a2af4aa0b84f98aa7925 (9) eap_peap: Service-Type = Framed-User (9) eap_peap: Framed-IP-Address = 192.168.243.38 (9) eap_peap: Framed-MTU = 1500 (9) eap_peap: Called-Station-Id = '00-00-00-00-AA-AA' (9) eap_peap: Called-Station-Id = '00-00-00-00-AA-AA' (9) eap_peap: Calling-Station-Id = '00-00-00-00-BB-BB' (9) eap_peap: NAS-Port-Type = Ethernet (9) eap_peap: NAS-Port = 50002 (9) eap_peap: NAS-Port-Id = 'FastEthernet0/2' (9) eap_peap: NAS-IP-Address = 172.23.242.165 (9) eap_peap: Event-Timestamp = 'Dec 11 2014 16:55:39 EST' (9) Virtual server received request (9) EAP-Message = 0x027000061a03 (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = 'mydomain\user000' (9) State = 0xd948b86bd838a2af4aa0b84f98aa7925 (9) Service-Type = Framed-User (9) Framed-IP-Address = 192.168.243.38 (9) Framed-MTU = 1500 (9) Called-Station-Id = '00-00-00-00-AA-AA' (9) Called-Station-Id = '00-00-00-00-AA-AA' (9) Calling-Station-Id = '00-00-00-00-BB-BB' (9) NAS-Port-Type = Ethernet (9) NAS-Port = 50002 (9) NAS-Port-Id = 'FastEthernet0/2' (9) NAS-IP-Address = 172.23.242.165 (9) Event-Timestamp = 'Dec 11 2014 16:55:39 EST' (9) server inner-tunnel { (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (9) authorize { (9) ntdomain: Checking for prefix before "\" (9) ntdomain: Looking up realm "mydomain" for User-Name = "mydomain\user000" (9) ntdomain: Found realm "mydomain" (9) ntdomain: Adding Realm = "mydomain" (9) ntdomain: Proxying request from user mydomain\user000 to realm mydomain (9) ntdomain: Preparing to proxy authentication request to realm "mydomain" (9) [ntdomain] = updated (9) suffix: Request already has destination realm set. Ignoring (9) [suffix] = noop (9) eap: Request is supposed to be proxied to Realm mydomain. Not doing EAP. (9) [eap] = noop (9) [expiration] = noop (9) [logintime] = noop (9) [pap] = noop (9) } # authorize = updated (9) } # server inner-tunnel (9) Virtual server sending reply (9) eap_peap: Got tunneled reply code 0 (9) eap_peap: Calling authenticate in order to initiate tunneled EAP session (9) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (9) authenticate { (9) eap: Expiring EAP session with state 0xd948b86bd838a2af (9) eap: Finished EAP session with state 0xd948b86bd838a2af (9) eap: Previous EAP request found for state 0xd948b86bd838a2af, released from the list (9) eap: Peer sent method MSCHAPv2 (26) (9) eap: EAP MSCHAPv2 (26) (9) eap: Calling eap_mschapv2 to process EAP data (9) eap: Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) eap_peap: Got tunneled reply RADIUS code 2 (9) eap_peap: MS-MPPE-Send-Key = 0xf2de36fbd643948f1f803fc4e177494f (9) eap_peap: MS-MPPE-Recv-Key = 0xc91f6a04dccbaf84f7c206510152cae5 (9) eap_peap: Proxy-State = 0x3239 (9) eap_peap: Framed-Protocol = PPP (9) eap_peap: Service-Type = Framed-User (9) eap_peap: Class = 0x3fc704f900000137000102000a02016700000000000000000000000001d006be3dc74c5b000000000004f90c (9) eap_peap: MS-CHAP-Domain = 'oMYDOMAIN' (9) eap_peap: MS-Link-Utilization-Threshold = 50 (9) eap_peap: MS-Link-Drop-Time-Limit = 120 (9) eap_peap: User-Name += 'mydomain\user000' (9) eap_peap: EAP-Message = 0x03700004 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: Tunneled authentication was successful (9) eap_peap: SUCCESS (9) eap: EAP session adding &reply:State = 0x2196d8c928e7c10e (9) [eap] = handled (9) } # authenticate = handled (9) Sent Access-Challenge Id 30 from 192.168.244.230:1812 to 172.23.242.165:1645 length 101 (9) EAP-Message = 0x017192.168b190017030192.1680c6fab14adc6c0ced5f0317c798fa57aff8a040ecf4384af7e1490a42279ff4f7 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0x2196d8c928e7c10ed58b5f9872208c8c (9) Finished request Waking up in 0.3 seconds. (10) Received Access-Request Id 31 from 172.23.242.165:1645 to 192.168.244.230:1812 length 260 (10) User-Name = 'anon1337' (10) Service-Type = Framed-User (10) Framed-IP-Address = 192.168.243.38 (10) Framed-MTU = 1500 (10) Called-Station-Id = '00-00-00-00-AA-AA' (10) Calling-Station-Id = '00-00-00-00-BB-BB' (10) EAP-Message = 0x02710050190017030192.1680247750954f15ab3e1370c5f04879ba432f948b0645cc5fc91dc71a56f3a9023a17030192.168073c995b596d5ba2ad25adc110c3ab7125de7738c7273a6e7533fb295d897bc9b (10) Message-Authenticator = 0xabddfb24ce3d43a042ea662e5ac514ef (10) NAS-Port-Type = Ethernet (10) NAS-Port = 50002 (10) NAS-Port-Id = 'FastEthernet0/2' (10) Called-Station-Id = '00-00-00-00-AA-AA' (10) State = 0x2196d8c928e7c10ed58b5f9872208c8c (10) NAS-IP-Address = 172.23.242.165 (10) session-state: No cached attributes (10) # Executing section authorize from file /etc/raddb/sites-enabled/default (10) authorize { (10) policy filter_username { (10) if (!&User-Name) { (10) if (!&User-Name) -> FALSE (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@.*@/ ) { (10) if (&User-Name =~ /@.*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /(a)\./) { (10) if (&User-Name =~ /(a)\./) -> FALSE (10) } # policy filter_username = notfound (10) [preprocess] = ok (10) ntdomain: Checking for prefix before "\" (10) ntdomain: No '\' in User-Name = "anon1337", looking up realm NULL (10) ntdomain: No such realm "NULL" (10) [ntdomain] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "anon1337", looking up realm NULL (10) suffix: No such realm "NULL" (10) [suffix] = noop (10) eap: Peer sent code Response (2) ID 113 length 80 (10) eap: Continuing tunnel setup (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = EAP (10) # Executing group from file /etc/raddb/sites-enabled/default (10) authenticate { (10) eap: Expiring EAP session with state 0x2196d8c928e7c10e (10) eap: Finished EAP session with state 0x2196d8c928e7c10e (10) eap: Previous EAP request found for state 0x2196d8c928e7c10e, released from the list (10) eap: Peer sent method PEAP (25) (10) eap: EAP PEAP (25) (10) eap: Calling eap_peap to process EAP data (10) eap_peap: processing EAP-TLS (10) eap_peap: eaptls_verify returned 7 (10) eap_peap: Done initial handshake (10) eap_peap: eaptls_process returned 7 (10) eap_peap: FR_TLS_OK (10) eap_peap: Session established. Decoding tunneled attributes (10) eap_peap: PEAP state send tlv success (10) eap_peap: Received EAP-TLV response (10) eap_peap: Success (10) eap_peap: No information to cache: session caching will be disabled for session 092599a5df0926e3e9440ae53c451e4b253e8e1516b2447e289ce1b5904239c5 SSL: Removing session 092599a5df0926e3e9440ae53c451e4b253e8e1516b2447e289ce1b5904239c5 from the cache (10) eap: Freeing handler (10) [eap] = ok (10) } # authenticate = ok (10) # Executing section post-auth from file /etc/raddb/sites-enabled/default (10) post-auth { (10) update { (10) No attributes updated (10) } # update = noop (10) [exec] = noop (10) policy remove_reply_message_if_eap { (10) if (&reply:EAP-Message && &reply:Reply-Message) { (10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (10) else { (10) [noop] = noop (10) } # else = noop (10) } # policy remove_reply_message_if_eap = noop (10) } # post-auth = noop (10) Sent Access-Accept Id 31 from 192.168.244.230:1812 to 172.23.242.165:1645 length 170 (10) MS-MPPE-Recv-Key = 0xb5c9941fdf7d63b2f617b2faafb5552e075691a9b617df1da24c2cd77e86cbaa (10) MS-MPPE-Send-Key = 0xdd5153f339ed2bc1e6c3fd7b68b36d9070688f4700dda0170c2086fc24f99e8a (10) EAP-Message = 0x03710004 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) User-Name = 'anon1337' (10) Finished request Waking up in 0.3 seconds. Waking up in 2.7 seconds. (11) Received Accounting-Request Id 186 from 172.23.242.165:1646 to 192.168.244.230:1813 length 173 (11) Acct-Session-Id = '00018AE4' (11) Calling-Station-Id = '00-00-00-00-BB-BB' (11) Framed-IP-Address = 192.168.243.38 (11) User-Name = 'anon1337' (11) Acct-Session-Time = 6124 (11) Acct-Input-Octets = 572933 (11) Acct-Output-Octets = 1640076 (11) Acct-Input-Packets = 4773 (11) Acct-Output-Packets = 16442 (11) Acct-Authentic = RADIUS (11) Acct-Status-Type = Interim-Update (11) NAS-Port-Type = Ethernet (11) NAS-Port = 50002 (11) NAS-Port-Id = 'FastEthernet0/2' (11) Called-Station-Id = '00-00-00-00-AA-AA' (11) Service-Type = Framed-User (11) NAS-IP-Address = 172.23.242.165 (11) Acct-Delay-Time = 0 (11) # Executing section preacct from file /etc/raddb/sites-enabled/default (11) preacct { (11) [preprocess] = ok (11) policy acct_unique { (11) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) { (11) EXPAND %{string:Class} (11) --> (11) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (11) else { (11) Acct-Session-Id = '00018AE4' (11) Calling-Station-Id = '00-00-00-00-BB-BB' (11) Framed-IP-Address = 192.168.243.38 (11) User-Name = 'anon1337' (11) Acct-Session-Time = 6124 (11) Acct-Input-Octets = 572933 (11) Acct-Output-Octets = 1640076 (11) Acct-Input-Packets = 4773 (11) Acct-Output-Packets = 16442 (11) Acct-Authentic = RADIUS (11) Acct-Status-Type = Interim-Update (11) NAS-Port-Type = Ethernet (11) NAS-Port = 50002 (11) NAS-Port-Id = 'FastEthernet0/2' (11) Called-Station-Id = '00-00-00-00-AA-AA' (11) Service-Type = Framed-User (11) NAS-IP-Address = 172.23.242.165 (11) Acct-Delay-Time = 0 (11) # Executing section preacct from file /etc/raddb/sites-enabled/default (11) preacct { (11) [preprocess] = ok (11) policy acct_unique { (11) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) { (11) EXPAND %{string:Class} (11) --> (11) if ("%{string:Class}" =~ /ai:([0-9a-f]{32})/i) -> FALSE (11) else { (11) update request { (11) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}} (11) --> 38f99589b6e9b39e24fcf277e9459a58 (11) &Acct-Unique-Session-Id := "38f99589b6e9b39e24fcf277e9459a58" (11) } # update request = noop (11) } # else = noop (11) } # policy acct_unique = noop (11) suffix: Checking for suffix after "@" (11) suffix: No '@' in User-Name = "anon1337", looking up realm NULL (11) suffix: No such realm "NULL" (11) [suffix] = noop (11) [files] = noop (11) } # preacct = ok (11) # Executing section accounting from file /etc/raddb/sites-enabled/default (11) accounting { (11) detail: EXPAND /var/log/radiusd/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d (11) detail: --> /var/log/radiusd/radacct/172.23.242.165/detail-20141211 (11) detail: /var/log/radiusd/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radiusd/radacct/172.23.242.165/detail-20141211 (11) detail: EXPAND %t (11) detail: --> Thu Dec 11 16:55:40 2014 (11) [detail] = ok (11) [unix] = noop (11) [exec] = noop (11) attr_filter.accounting_response: EXPAND %{User-Name} (11) attr_filter.accounting_response: --> anon1337 (11) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (11) [attr_filter.accounting_response] = updated (11) } # accounting = updated (11) Sent Accounting-Response Id 186 from 192.168.244.230:1813 to 172.23.242.165:1646 length 20 (11) Finished request

2 9

Request password missing or cleartext password not found
by carl leopold 12 Dec '14

12 Dec '14

Hi, I am new to freeradius and am trying to setup freeradius 2.1.12 with mysql used by strongswan. Strongswan is talking to freeradius using eap-radius using Ikev2. I have been able to get Strongswan Ikev1 working talking to freeradius/mysql using eap-Xauth. But i cant get it to work with Ikev2 and eap-radius. In my database table radcheck i have: | id | username | attribute | op | value | +----+----------+--------------------+----+----------+ | 1 | darwin | Password | == | mypass | | 3 | frodo | Password | == | baggins | | 4 | carl | Cleartext-Password | := | connect1 | I am using username 'carl' and have changed the DB attribute from Password to Cleartext-Password and updated the op to := from == but this did not make any difference. I am finding that i get these errors and authentication fails. More detailed logs are further below. Logs: [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. Is it possible either the password is not being passed in as its not show in the logs ? I looked in my config files and dont see any Auth-Type=Local I am not sure what to do next. Advice is much needed. Many Thanks Carl My config : authorize { filter_username preprocess auth_log chap mschap digest suffix eap { ok = return } files sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest # pam unix eap } preacct { preprocess acct_unique suffix files } Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 44311, id=219, length=133 User-Name = "carl" NAS-Port-Type = Virtual Service-Type = Framed-User NAS-Port = 6 NAS-Port-Id = "win7" NAS-IP-Address = 178.62.119.121 Called-Station-Id = "178.62.119.121[4500]" Calling-Station-Id = "191.101.55.203[4500]" NAS-Identifier = "strongSwan" Message-Authenticator = 0xcf65b96f46f3e40a5066f6f4111c48fa # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20141211 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20141211 [auth_log] expand: %t -> Thu Dec 11 18:35:52 2014 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "carl", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry carl at line 1 ++[files] returns ok [sql] expand: %{User-Name} -> carl [sql] sql_set_user escaped user --> 'carl' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'carl' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'carl' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'carl' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> carl attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 219 to 127.0.0.1 port 44311 Waking up in 4.9 seconds. Cleaning up request 0 ID 219 with timestamp +3 Ready to process requests.

3 2

ldap-server with Self-Signed Certificate
by Paul Kuntke 12 Dec '14

12 Dec '14

Hello to all, I'm trying to setup freeradius to authenticate with an ldap-Server. My Radius-Version: FreeRADIUS Version 3.0.4 If I start: radiusd -f -X it says': rlm_ldap (ldap): Could not set ca_file: Success rlm_ldap (ldap): Could not set certificate_file: Success rlm_ldap (ldap): Could not set random_file: Success rlm_ldap (ldap): Could not set require_cert: Success TLS certificate verification: Error, self signed certificate TLS: can't connect. In the ldap-Module I've set the following: tls { ca_file = "/etc/ssl/certs/ldap.cert" certificate_file = "/usr/local/etc/raddb/certs/ldap.cert" random_file = "/usr/local/etc/raddb/certs/random" start_tls = no require_cert = "allow" } Verifying the server via: openssl s_client -CAfile /etc/ssl/certs/ldap.cert -connect <SERVERURL> Returns: Verify return code: 0 (ok) Can anybody help me to make freeradius accepting the certificate? Thanks, Paul

1 0

FreeRadius and WPA2-Enterprise machine authentication - With Active Directory interconnection..
by Tim Reimers 11 Dec '14

11 Dec '14

Hi everyone - I'm trying to design something here that I'm sure has been done before, but AFAIK, it crosses through a few different howto documents, and being new to this, I'm just not certain that I have pieced together all the relevant HOWTo docs and not missed a point at which the design won't communicate the needed information. The plan is to authenticate wireless users AND their computers. (so that a user cannot BYOD to the secure network; only laptops joined to the domain will work) I know that WPA2-Enterprise is what I need, to be able to have rotating keys, use Radius for authentication, etc. I know that WPA2-Enterprise requires certificates to validate the machines I already have a Microsoft CA server running in my AD environment, with the GPO needed to push out workstation certificate enrollment and so on, for other applications. My question is - Can FreeRadius (3.0.1) on centos 7 be configured to do the machine authentication using certs from the Microsoft CA server? Meraki is the wireless infrastructure, if that helps. Thanks, Tim

3 4

freeradius 3 - proxing
by Khapare Joshi 11 Dec '14

11 Dec '14

Hi I testing freeradius 3 version for upgrade our old version 2 freeradius server. Local auth works well but when I need to proxy realm I always got "no response from the server", I spoke to the guy who look after the remote radius server and he confirms it is running. my version 2 configuration is working well though. this is what i get in debug mode: Received Access-Request Id 36 from 192.168.1.20:1814 to 10.128.1.10:1812 length 141 User-Name = 'bob(a)test.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f Proxy-State = 0x30 (0) Received Access-Request packet from host 192.168.1.20 port 1814, id=36, length=141 (0) User-Name = 'bob(a)test.com' (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = '02-00-00-00-00-01' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'CONNECT 11Mbps 802.11b' (0) EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 (0) Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f (0) Proxy-State = 0x30 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) auth_log : EXPAND /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log : --> /var/log/radacct/192.168.1.20/auth-detail-20141208 (0) auth_log : /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radacct/192.168.1.20/auth-detail-20141208 (0) auth_log : EXPAND %t (0) auth_log : --> Mon Dec 8 16:38:14 2014 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : Looking up realm "test.com" for User-Name = "bob(a)test.com" (0) suffix : Found realm "test.com" (0) suffix : Adding Realm = "test.com" (0) suffix : Proxying request from user bob(a)test.com to realm test.com (0) suffix : Preparing to proxy authentication request to realm "test.com" (0) [suffix] = updated (0) eap : Request is supposed to be proxied to Realm test.com. Not doing EAP. (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated (0) # Executing section pre-proxy from file /usr/local/etc/raddb/sites-enabled/default (0) pre-proxy { (0) operator-name.pre-proxy operator-name.pre-proxy { (0) if (("%{request:Packet-Type}" == 'Access-Request') && "%{client:Operator-Name}") (0) EXPAND %{request:Packet-Type} (0) --> Access-Request (0) Client does not contain config item "Operator-Name" (0) EXPAND %{client:Operator-Name} (0) --> (0) if (("%{request:Packet-Type}" == 'Access-Request') && "%{client:Operator-Name}") -> FALSE (0) } # operator-name.pre-proxy operator-name.pre-proxy = noop (0) pre_proxy_log : EXPAND /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d (0) pre_proxy_log : --> /var/log/radacct/ 192.168.1.20/pre-proxy-detail-20141208 (0) pre_proxy_log : /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d expands to /var/log/radacct/192.168.1.20/pre-proxy-detail-20141208 (0) pre_proxy_log : EXPAND %t (0) pre_proxy_log : --> Mon Dec 8 16:38:14 2014 (0) [pre_proxy_log] = ok (0) } # pre-proxy = ok Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 37396 (0) Proxying request to home server remote-rad-server port 1812 timeout 30.000000 (0) Sending Access-Request packet to host remote-rad-server port 1812, id=175, length=0 (0) User-Name = 'bob(a)test.com' (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = '02-00-00-00-00-01' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'CONNECT 11Mbps 802.11b' (0) EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 (0) Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f (0) Proxy-State = 0x30 (0) Event-Timestamp = 'Dec 8 2014 16:38:14 GMT' (0) Realm = 'test.com' (0) EAP-Type = Identity (0) Proxy-State = 0x3336 Sending Access-Request Id 175 from 0.0.0.0:37396 to remote-rad-server:1812 User-Name = 'bob(a)test.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f Proxy-State = 0x30 Event-Timestamp = 'Dec 8 2014 16:38:14 GMT' Proxy-State = 0x3336 Waking up in 0.3 seconds. Waking up in 0.1 seconds. (0) Expecting proxy response no later than 29.488865 seconds from now Waking up in 29.4 seconds. Received Access-Request Id 36 from 192.168.1.20:1814 to 10.128.1.10:1812 length 141 (0) Sending duplicate proxied request to home server remote-rad-server port 1812 - ID: 175 (0) Sending Access-Request packet to host remote-rad-server port 1812, id=175, length=151 (0) User-Name = 'bob(a)test.com' (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = '02-00-00-00-00-01' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'CONNECT 11Mbps 802.11b' (0) EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 (0) Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f (0) Proxy-State = 0x30 (0) Event-Timestamp = 'Dec 8 2014 16:38:14 GMT' (0) Realm = 'test.com' (0) EAP-Type = Identity (0) Proxy-State = 0x3336 Sending Access-Request Id 175 from 0.0.0.0:37396 to remote-rad-server:1812 User-Name = 'bob(a)test.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f Proxy-State = 0x30 Event-Timestamp = 'Dec 8 2014 16:38:14 GMT' Proxy-State = 0x3336 Waking up in 26.9 seconds. Received Access-Request Id 36 from 192.168.1.20:1814 to 10.128.1.10:1812 length 141 (0) Sending duplicate proxied request to home server remote-rad-server port 1812 - ID: 175 (0) Sending Access-Request packet to host remote-rad-server port 1812, id=175, length=151 (0) User-Name = 'bob(a)test.com' (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = '02-00-00-00-00-01' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'CONNECT 11Mbps 802.11b' (0) EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 (0) Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f (0) Proxy-State = 0x30 (0) Event-Timestamp = 'Dec 8 2014 16:38:14 GMT' (0) Realm = 'test.com' (0) EAP-Type = Identity (0) Proxy-State = 0x3336 Sending Access-Request Id 175 from 0.0.0.0:37396 to remote-rad-server:1812 User-Name = 'bob(a)test.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f Proxy-State = 0x30 Event-Timestamp = 'Dec 8 2014 16:38:14 GMT' Proxy-State = 0x3336 Waking up in 20.9 seconds. Received Access-Request Id 36 from 192.168.1.20:1814 to 10.128.1.10:1812 length 141 (0) Sending duplicate proxied request to home server remote-rad-server port 1812 - ID: 175 (0) Sending Access-Request packet to host remote-rad-server port 1812, id=175, length=151 (0) User-Name = 'bob(a)test.com' (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = '02-00-00-00-00-01' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'CONNECT 11Mbps 802.11b' (0) EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 (0) Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f (0) Proxy-State = 0x30 (0) Event-Timestamp = 'Dec 8 2014 16:38:14 GMT' (0) Realm = 'test.com' (0) EAP-Type = Identity (0) Proxy-State = 0x3336 Sending Access-Request Id 175 from 0.0.0.0:37396 to remote-rad-server:1812 User-Name = 'bob(a)test.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x02000014016e656d616e646940756e616b2e6973 Message-Authenticator = 0xe32df9f6e41ef3d00ac9a5943427a59f Proxy-State = 0x30 Event-Timestamp = 'Dec 8 2014 16:38:14 GMT' Proxy-State = 0x3336 Waking up in 8.9 seconds. Received Status-Server Id 248 from 192.168.1.20:1814 to 10.128.1.10:1812 length 68 Message-Authenticator = 0x9f4f11180db5f0c2be4113388ea12cbf NAS-Identifier = 'Status Check. Are you alive?' (1) Received Status-Server packet from host 192.168.1.20 port 1814, id=248, length=68 (1) Message-Authenticator = 0x9f4f11180db5f0c2be4113388ea12cbf (1) NAS-Identifier = 'Status Check. Are you alive?' (1) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (1) post-auth { (1) reply_log : EXPAND /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (1) reply_log : --> /var/log/radacct/192.168.1.20/reply-detail-20141208 (1) reply_log : /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radacct/192.168.1.20/reply-detail-20141208 (1) reply_log : EXPAND %t (1) reply_log : --> Mon Dec 8 16:38:44 2014 (1) [reply_log] = ok (1) [exec] = noop (1) remove_reply_message_if_eap remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else else { (1) [noop] = noop (1) } # else else = noop (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (1) } # post-auth = ok (1) Sending Access-Accept packet to host 192.168.1.20 port 1814, id=248, length=0 Sending Access-Accept Id 248 from 10.128.1.10:1812 to 192.168.1.20:1814 (1) Finished request (0) No proxy response, giving up on request and marking it done [1mMarking home server remote-rad-server port 1812 as zombie (it has not responded in 30.000000 seconds).[0m PING: Waiting 4 seconds for response to ping Sending Status-Server Id 44 from 0.0.0.0:37396 to remote-rad-server:1812 Message-Authenticator := 0x00 NAS-Identifier := 'Status Check 0. Are you alive?' PING: Next status packet in 60 seconds [1m[31m(0) ERROR: Failing proxied request, due to lack of any response from home server remote-rad-server port 1812[0m Waking up in 0.3 seconds. Waking up in 3.6 seconds. [31mNo response to status check 2 for home server remote-rad-server port 1812[0m Waking up in 0.8 seconds. (1) Cleaning up request packet ID 248 with timestamp +40 (0) Cleaning up request packet ID 36 with timestamp +10 Waking up in 57.0 seconds. ^C

3 4

FreeRadius-EAP-AKA Support
by anusha mule 11 Dec '14

11 Dec '14

Hi Team, Please let me know which version of FreeRadius will support EAP-AKA authentication. Currently I am using FreeRadius version 2.1.12 But in this I couldn't able to see the type rlm_eap_aka. Note: In few sites in internet has given the patches for eap-aka support. If patch is required for eap-aka, please suggest me which one is working fine with the latest version of freeradius. Thanks in Advance. Regards, Anusha M

2 3

Creating certificates with a password that has spaces in it
by Jasvinder S. Bahra 10 Dec '14

10 Dec '14

Hi, I am setting up FreeRadius on a FreeBSD system in an EAP-TLS configuration. As part of that process, I need to create a number of certificates. To do so, I am following the instructions detailed in the README file (in the /usr/local/etc/raddb/certs folder). The passwords i've set in the three CNF files are made up of multiple words. However, when I try and execute the "make server.pem" command, I get an error. As a test, I set the input and output passwords both to "One Two Three 4" in the ca.cnf file, and executed the "make ca.pem" and "make ca.der" steps successfully. When I tried to execute "make server.pem" however... =====8<===== [root@server certs]# make server.pem /usr/local/bin/openssl req -new -out server.csr -keyout server.key -config ./se rver.cnf Generating a 2048 bit RSA private key ................................+++ .............................................................+++ writing new private key to 'server.key' ----- /usr/local/bin/openssl ca -batch -keyfile ca.key -cert ca.pem -in erver.csr -k ey `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extens ions xpserver_ext -extfile xpextensions -config ./server.cnf unknown option Two usage: ca args =====8<===== The "unknown options Two" line suggests that only the first word of the password is used and that openssl thinks the rest of the password are other parameters. I've tried enclosing the passwords (in the CNF files) in both single quotes and double quotes, but have had no success. Is it possible to create certificates with passwords that have spaces in them, using these make commands? Regards, Jazz

3 4

3.0.4: proxy-to-vserver and proxied post-auth?
by Stefan Winter 10 Dec '14

10 Dec '14

Hello, I've migrated almost all my virtual servers - but one - to 3.0.4. There's one thing which I had expected to work, but it doesn't, but I do recall some discussions around this on the list; but not what the final verdict was. My proxied-to vserver needs to do some stuff in post-auth. However it looks like post-auth is not actually called; instead, only the post-auth of the original vserver is. Is that desired/expected behaviour in 3.0.4? The symptoms of this boils down to these two lines: Debug: (55) modsingle[authenticate]: returned from pap (rlm_pap) for request 55 Debug: (55) [pap] = ok Debug: (55) } # Auth-Type PAP = ok Debug: (55) Empty post-proxy section. Using default return values. Debug: (55) Found Auth-Type = Accept Debug: (55) Auth-Type = Accept, accepting the user Debug: (55) # Executing section post-auth from file /usr/local/freeradius/config/raddb/sites-enabled/AAI The PAP instance there is the one from the proxied-to vserver; must be, as it knows my password and the retrieval of that password is unique to the vserver in question. The next line speaks about empty post-proxy; that looks like the initial vserver kicks in right after authenticate { } with its PAP is finished. It then executes post-auth from the initial vserver, not the one from proxied-to (the proxied-to vserver is called "staff", not "AAI"). That's not helpful for my setup :-( So... just wondering if this is a bug or if I'm going to need a majorish rethink of my post-auth logic here... Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 3

ldapperf - v0.3 released
by Arran Cudbard-Bell 09 Dec '14

09 Dec '14

If anyone's still interested in ldapperf: https://github.com/arr2036/ldapperf/releases/tag/v0.3 Now crash free! -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

2 1