- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 113, Issue 26
by Rui Ribeiro 09 Sep '14

09 Sep '14

Hi Felix, The best approach is to use the LDAP groups to select your VLAN. As you are starting, I would also advise to upgrade to 2.2.5 or better yet, version 3. It would be better too, if you create a group for Wifi access instead of using the administrator group. You can select write the logic for the VLAN in the users file, or with unlang, if you search the arquive list you will find plenty of examples. Taken from the end of my post-auth, inner-tunnel. I still advise you to peruse the arquive, to understand it better. if ( Ldap-Group == "staff" ) { if (!(Operator-Name)) { update reply { User-Name := "%{request:User-Name}" Service-Type := "Framed-User" Framed-MTU := 1300 Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "7" Reply-Message := "staff VLAN" } } } elsif ( Ldap-Group == "student" ) { if (!(Operator-Name)) { update reply { User-Name := "%{request:User-Name}" Service-Type := "Framed-User" Framed-MTU := 1300 Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "9" Reply-Message := "student VLAN" } } } else { reject } Regards, Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > > Message: 2 > Date: Mon, 8 Sep 2014 04:14:31 -0400 > From: Lord Felix <felix107(a)msn.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: How-To for setting up ldap for Active Directory > Message-ID: <BAY172-W14882D57281A381E1D91438DC10(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > Hi Everyone, > > I'm new to freeRadius and I've been reading some of the mailing list > e-mails. > > I've got freeRadius with Cento 6 which is version 2.1.12 installed. > > So I've followed the instructions for getting freeRadius working ntlm_auth > with Windows 2012 Active Directory, based on the link below: > http://deployingradius.com/documents/configuration/active_directory.html > > Everything works great! > > The only issue is now I need Dynamic Vlan working and I also need to look > up mac address via from a mssql database to validate the user to allow > access to the network. > > After reading more about ntlm_auth, it will only respond to true or false > and this method doesn't really help with want I want to accomplish. > > What I need to do is based on what group the user belongs to, they are > assigned to that specific vlan. i.e. if you are a staff you go to VLAN 7 > and if you are a student you go to vlan 9. > > Is there any How-To guide for setting up ldap for Active Directory just > like the link above? > > I've tried to setup the ldap module and I'm running into issues. > > This is how my ldap config looks like: > > ldap { > server = "xxx.xxx.xxx" > basedn = "dc=xxx,dc=xxx,dc=xxx" > filter = > (&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) > groupmembership_attribute = "Administrators" > ldap_connections_number = 5 > timeout = 40 > timelimit = 30 > net_timeout = 10 > tls { > start_tls = no > } > dictionary_mapping = ${confdir}/ldap.attrmap > edir_account_policy_check = no > groupname_attribute = cn > groupmembership_filter = > "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" > groupmembership_attribute = memberOf > chase_referrals = yes > rebind = yes > ldap_debug = 0x0028 > keepalive { > idle = 60 > probes = 3 > interval = 3 > } > } > > > Here is my debug info, and I know it's not working, because I don't even > see it trying to contact the radius server, which is why I'm asking if > there is quick HowTo: > rad_recv: Access-Request packet from host 127.0.0.1 port 33583, id=125, > length=74 > User-Name = "xxxxxxx" > User-Password = "xxxxxxx" > NAS-IP-Address = xx.xx.xxxx > NAS-Port = 0 > Message-Authenticator = 0x1c451a3ee1cd4caabec9e764c4006d2b > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] No '@' in User-Name = "xxxxxx", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > ++[files] returns noop > [sql] expand: %{User-Name} -> xxxx > [sql] sql_set_user escaped user --> 'xxxxxx' > rlm_sql (sql): Reserving sql socket id: 3 > [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE > Username = '%{SQL-User-Name}' ORDER BY id -> SELECT > id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'username' > ORDER BY id > [sql] expand: SELECT groupname FROM radusergroup WHERE username = > '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup > WHERE username = 'xxxxxx' ORDER BY priority > rlm_sql (sql): Released sql socket id: 3 > [sql] User username not found > ++[sql] returns notfound > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this. > ++[pap] returns noop > ERROR: No authenticate method (Auth-Type) found for the request: Rejecting > the user > Failed to authenticate the user. > Using Post-Auth-Type Reject > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> xxxxx > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 1 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 1 > Sending Access-Reject of id 125 to 127.0.0.1 port 33583 > Waking up in 4.9 seconds. > Cleaning up request 1 ID 125 with timestamp +2007 > Ready to process requests. > > > Someone also posted that they can get ntlm_auth working with groups and > you need to chat the stuff around? It would be great if someone can provide > a how on this to work with dynamic vlan. > > Any help would be greatly appreciated. > > Thanks > > -----

2 2

eapol_test works but not wpa_supplicant with wired interface
by xxiao8 09 Sep '14

09 Sep '14

Hello, I just set up freeradius 2.1.2(default) on debian and try to do wpa_supplicant via wired interface to it. while eapol_test worked fine, when wpa_supplicant is used on the freeradius server side I can never see any incoming RADIUS packets(or any packets) at all. I'm running wpa_supplicant/eapol_test on a ubuntu 12.04 while the freeradius is hosted on a VM/debian-wheezy in the same bridged network. Am I missing something basic? all logs are below. Thanks, xxiao ==========config file used================== $cat ttls-mschapv2.conf ctrl_interface=/var/run/wpa_supplicant ap_scan=0 fast_reauth=1 network={ key_mgmt=IEEE8021X identity="bob" password="hello" eapol_flags=0 eap=TTLS anonymous_identity="anonymous" phase2="auth=MSCHAPV2" } ===============eapol_test works==================== $sudo eapol_test -c ttls-mschapv2.conf -a192.168.1.132 -p1812 -stesting123 -r2 RADIUS packet matching with station MS-MPPE-Send-Key (sign) - hexdump(len=32): 0e 41 0d 3b 24 75 5f 43 08 cc 1c 63 c6 f8 21 d5 9c 2f f2 89 dd ab d9 d9 31 18 39 00 16 c3 92 86 MS-MPPE-Recv-Key (crypt) - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0 37 10 75 58 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f decapsulated EAP packet (code=3 id=6 len=4) from RADIUS server: EAP Success EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: Status notification: completion (param=success) EAP: EAP entering state SUCCESS CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully EAPOL: SUPP_PAE entering state AUTHENTICATED EAPOL: SUPP_BE entering state RECEIVE EAPOL: SUPP_BE entering state SUCCESS EAPOL: SUPP_BE entering state IDLE eapol_sm_cb: result=1 EAPOL: Successfully fetched key (len=32) PMK from EAPOL - hexdump(len=32): e2 9b ce e2 c6 69 e9 d9 c0 37 10 75 58 53 ba 51 a1 a4 38 b8 86 3d dc f5 6d 71 35 b1 18 a8 53 0f No EAP-Key-Name received from server EAP: deinitialize previously used EAP method (21, TTLS) at EAP deinit ENGINE: engine deinit MPPE keys OK: 3 mismatch: 0 SUCCESS ======wpa_supplicant wired does not work=========== $ sudo wpa_supplicant -Dwired -ieth0 -cttls-mschapv2.conf -d wpa_supplicant v2.2 random: Trying to read entropy from /dev/random Successfully initialized wpa_supplicant Initializing interface 'eth0' conf 'ttls-mschapv2.conf' driver 'wired' ctrl_interface 'N/A' bridge 'N/A' Configuration file 'ttls-mschapv2.conf' -> '/tmp/ttls-mschapv2.conf' Reading configuration file '/tmp/ttls-mschapv2.conf' ctrl_interface='/var/run/wpa_supplicant' ap_scan=0 fast_reauth=1 Priority group 0 id=0 ssid='' wpa_driver_wired_init: Added multicast membership with packet socket Add interface eth0 to a new radio N/A eth0: Own MAC address: 18:03:73:e0:ba:f1 eth0: RSN: flushing PMKID list in the driver eth0: Setting scan request: 0.100000 sec EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: Supplicant port status: Unauthorized EAPOL: KEY_RX entering state NO_KEY_RECEIVE EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED eth0: Added interface eth0 eth0: State: DISCONNECTED -> DISCONNECTED random: Got 20/20 bytes from /dev/random EAPOL: External notification - EAP success=0 EAPOL: External notification - EAP fail=0 EAPOL: External notification - portControl=Auto eth0: Already associated with a configured network - generating associated event eth0: Event ASSOC (0) received eth0: Association info event eth0: State: DISCONNECTED -> ASSOCIATED eth0: Associated to a new BSS: BSSID=01:80:c2:00:00:03 eth0: Select network based on association information eth0: Network configuration found for the current AP eth0: WPA: clearing AP WPA IE eth0: WPA: clearing AP RSN IE eth0: WPA: clearing own WPA/RSN IE eth0: Failed to get scan results EAPOL: External notification - EAP success=0 EAPOL: External notification - EAP fail=0 EAPOL: External notification - portControl=Auto eth0: Associated with 01:80:c2:00:00:03 eth0: WPA: Association event - clear replay counter eth0: WPA: Clear old PTK EAPOL: External notification - portEnabled=0 EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE eth0: Cancelling scan request EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart TX EAPOL: dst=01:80:c2:00:00:03 EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart TX EAPOL: dst=01:80:c2:00:00:03 EAPOL: idleWhile --> 0 EAP: EAP entering state FAILURE eth0: CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: Supplicant port status: Unauthorized EAPOL: SUPP_BE entering state IDLE EAPOL authentication completed - result=FAILURE ^Ceth0: Removing interface eth0 eth0: Request to deauthenticate - bssid=01:80:c2:00:00:03 pending_bssid=00:00:00:00:00:00 reason=3 state=ASSOCIATED eth0: Event DEAUTH (12) received eth0: Deauthentication notification eth0: * reason 3 (locally generated) Deauthentication frame IE(s) - hexdump(len=0): [NULL] eth0: CTRL-EVENT-DISCONNECTED bssid=01:80:c2:00:00:03 reason=3 locally_generated=1 eth0: CTRL-EVENT-SSID-TEMP-DISABLED id=0 ssid="" auth_failures=1 duration=10 reason=AUTH_FAILED eth0: Auto connect disabled: do not try to re-connect eth0: Ignore connection failure indication since interface has been put into disconnected state eth0: State: ASSOCIATED -> DISCONNECTED EAPOL: External notification - portEnabled=0 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: Supplicant port status: Unauthorized EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 eth0: State: DISCONNECTED -> DISCONNECTED EAPOL: External notification - portEnabled=0 EAPOL: External notification - portValid=0 eth0: Cancelling scan request eth0: Cancelling authentication timeout Remove interface eth0 from radio Remove radio eth0: CTRL-EVENT-TERMINATING

2 1

Want to include LDAP group information in Access-Accept message
by Justin Michael Schwartzbeck 09 Sep '14

09 Sep '14

Hello, I am set up FreeRadius for LDAP authentication. I know that you can configure so that when Access-Accept message is sent, you can have custom attributes, using a dictionary file. I am wondering if I can set up FreeRadius to send back the LDAP groups that a user is a member of. Authentication with LDAP should use the username. Is it possible to get FreeRadius to query the LDAP server to find the groups associated with that username, then send this group list back to the connecting user in the Access-Accept message? Will this require a plugin? Can someone give me some guidance on how to do this? Thank you, -Justin

3 2

Virtual Server
by nicolas.clo＠ricoh-industrie.fr 09 Sep '14

09 Sep '14

Hi List, Sorry if it's a stupid question but since Freeradius 3.0.4 ( Version 3.0.4 (git #9b5c955) ), my custom virtual server is ignored by freeradius at startup Log: rlm_sql (sql): Executing query: 'SELECT id, nasname, shortname, type, secret, server FROM nas' rlm_sql (sql): Adding client 192.168.0.1 (AP01) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.2 (AP02) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.3 (AP03) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.4 (AP04) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.5 (AP05) to rif clients list Failed to find virtual server rif Failed to add client, possible duplicate? rlm_sql (sql): Adding client 192.168.0.6 (AP06) to rif clients list Thanks.

5 18

EAP-Fast Support
by Matthew Ceroni 08 Sep '14

08 Sep '14

Hi: Does Freeradius support EAP-FAST? I am looking to use FreeRadius as the radius server in a CiscoTrust Sec deployment. Thanks

3 8

Send custom accounting packet on login
by Julius Plenz 08 Sep '14

08 Sep '14

Hi, whenever a user successfully logs in, I want to send a custom accounting packet with derived information to a server. Is there a way to do that from the config directly? I have searched for some time now but couldn't find anything like that... Right now I'm using a script that uses the "Authen::Radius" Perl module, but I want to get rid of this solution. If there's no built-in mechanism, my plan would be to write a module that uses libfreeradius.so's library functions (and already initialized dictionaries etc.) to create a queue, send a packet etc. -- are there any problems with this approach? Functions like fr_packet_list_create(), rad_send(), fr_packet_list_recv() etc. are all reentrant, aren't they? Any hints are appreciated. Thanks! Julius

3 2

EAP Session problems
by Cardinal-Richards, Emma 08 Sep '14

08 Sep '14

Hi, I'm experiencing a problem with EAP sessions/new conversations not starting when I'm using the Janet testing as shown below. https://community.ja.net/library/janet-services-documentation/orps-role-des… We've run up 2 new pre-prod RADIUS servers with a newer release of freeradius and have indicated they are 'testdev' under our site's eduroam support. When we attempt to login with an account 'username(a)test.ucl.ac.uk' to our production ORPS we see the request reach our testdev ORPS but it fails to authenticate locally. (We've declared test.ucl.ac.uk as a realm in proxy.conf to be authorised locally to avoid looping back up to the NRPS and back to us etc). It fails with an EAP 'did not finish' (in the style as shown at the bottom section of here http://wiki.freeradius.org/guide/Certificate-Compatibility, the client is linux) failing to see it as a new session. Our certificates are the same on both production and testdev. The other odd behaviour is that despite getting a REJECT from this testdev server, I get authenticated by our production ORPS using 'username(a)test.ucl.ac.uk' which is not a declared local realm on the production ORPS. If I connect directly to the testdev ORPS it's fine. I've contacted the Janet Service desk but not got anywhere as yet, but they suggested I contact here to. I've attached the debug output (zipped to reduce size). Regards, Emma

4 4

Re: Fwd: Failed Authentication user on EAP-SIM,
by Iman Rahmat 08 Sep '14

08 Sep '14

(SOLVE) i put configuration like this 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 The Log show this rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 And you see this log too [eap] processing type sim can not initiate sim, no RAND1 attribute >From the RAND1 can't read from rlm_sim_files , because i write on users file mnc001 change with mnc000 so you must change that with : 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 WOW,,,, FAILED TOO, BUT THE MESSAGE DIFFERENT LOG APPEAR rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 <---> this is same.. but no problem because the different message of LOG its : [eap] processing type sim eap-sim can not find sim-challenge3 <----> different can not initiate sim, missing attributes from this message , we know the sim-challange3 cant be read. Because RAND3,SRES3, AND KC3 Dont write on Users files.. HAHHAHAHA TYPO... SO FINAL CHANGE ITS 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand3 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES3 = 0xF77daa16, EAP-Sim-KC3 = 0x71e9bd629Cee3000 AND CONNECTED, THANKS FOR EVERYONE WHO GIVE ME THE ADVICE AND HELP. indeed sometimes we need someone else to correct our mistakes. The man will never be perfect. thank you very much my friend, I can only pray I hope you are in good health and is always given in abundance. THIS IS LOG OF SUCCESSFULL rad_recv: Access-Request packet from host 111.111.111.195 port 55800, id=56, length=254 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.195 NAS-Identifier = "24a43c7c6ae2" NAS-Port = 0 Called-Station-Id = "26-A4-3C-7D-6A-E2:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02ec001c120b00000b0500008a3fb55d96159c743672996d4b57837a State = 0xaa2b3666abc72410f629694487c8517c Message-Authenticator = 0x470076d7d8eb5e312d290b18dff1d70f # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 236 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org at line 205 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 237 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/ default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 56 to 111.111.111.195 port 55800 MS-MPPE-Recv-Key = 0x69ee128ecad5e1edba8e336bc1c6a9f8843f83d7d8c052e34f7033a60bfbb91e MS-MPPE-Send-Key = 0xe7abe44f40dbce7cce6b2e093db05f23f39d01e5fb0458fd97f9312e86f33a3f EAP-Message = 0x03ed0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" Finished request 2. Going to the next request Waking up in 4.4 seconds. rad_recv: Accounting-Request packet from host 111.111.111.195 port 51808, id=57, length=213 Acct-Session-Id = "540D4EDB-00000005" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.195 NAS-Identifier = "24a43c7c6ae2" NAS-Port = 0 Called-Station-Id = "26-A4-3C-7D-6A-E2:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" # Executing section preacct from file /etc/freeradius/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "24a43c7c6ae2",NAS-IP-Address = 111.111.111.195,Acct-Session-Id = "540D4EDB-00000005",User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org"' [acct_unique] Acct-Unique-Session-ID = "d6d4b84652de2068". ++[acct_unique] = ok [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop ++[files] = noop +} # group preacct = ok # Executing section accounting from file /etc/freeradius/sites-enabled/ default +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 111.111.111.195 [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/111.111.111.195/detail-20140908 [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{ Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/111.111.111.195/detail-20140908 [detail] expand: %t -> Mon Sep 8 21:45:00 2014 ++[detail] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 57 to 111.111.111.195 port 51808 Finished request 3. Cleaning up request 3 ID 57 with timestamp +3 Going to the next request Waking up in 4.3 seconds. Cleaning up request 0 ID 54 with timestamp +2 Cleaning up request 1 ID 55 with timestamp +2 Waking up in 0.5 seconds. Cleaning up request 2 ID 56 with timestamp +3 Ready to process requests.

1 1

Re: Failed Authentication user on EAP-SIM,
by Iman Rahmat 08 Sep '14

08 Sep '14

(SOLVE) i put configuration like this 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 The Log show this rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 And you see this log too [eap] processing type sim can not initiate sim, no RAND1 attribute >From the RAND1 can't read from rlm_sim_files , because i write on users file mnc001 change with mnc000 so you must change that with : 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 WOW,,,, FAILED TOO, BUT THE MESSAGE DIFFERENT LOG APPEAR rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 <---> this is same.. but no problem because the different message of LOG its : [eap] processing type sim eap-sim can not find sim-challenge3 <----> different can not initiate sim, missing attributes from this message , we know the sim-challange3 cant be read. Because RAND3,SRES3, AND KC3 Dont write on Users files.. HAHHAHAHA TYPO... SO FINAL CHANGE ITS 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand3 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES3 = 0xF77daa16, EAP-Sim-KC3 = 0x71e9bd629Cee3000 AND CONNECTED, THANKS FOR EVERYONE WHO GIVE ME THE ADVICE AND HELP. indeed sometimes we need someone else to correct our mistakes. The man will never be perfect. thank you very much my friend, I can only pray I hope you are in good health and is always given in abundance. THIS IS LOG OF SUCCESSFULL rad_recv: Access-Request packet from host 111.111.111.195 port 55800, id=56, length=254 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.195 NAS-Identifier = "24a43c7c6ae2" NAS-Port = 0 Called-Station-Id = "26-A4-3C-7D-6A-E2:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02ec001c120b00000b0500008a3fb55d96159c743672996d4b57837a State = 0xaa2b3666abc72410f629694487c8517c Message-Authenticator = 0x470076d7d8eb5e312d290b18dff1d70f # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 236 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org at line 205 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 237 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 56 to 111.111.111.195 port 55800 MS-MPPE-Recv-Key = 0x69ee128ecad5e1edba8e336bc1c6a9f8843f83d7d8c052e34f7033a60bfbb91e MS-MPPE-Send-Key = 0xe7abe44f40dbce7cce6b2e093db05f23f39d01e5fb0458fd97f9312e86f33a3f EAP-Message = 0x03ed0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" Finished request 2. Going to the next request Waking up in 4.4 seconds. rad_recv: Accounting-Request packet from host 111.111.111.195 port 51808, id=57, length=213 Acct-Session-Id = "540D4EDB-00000005" Acct-Status-Type = Start Acct-Authentic = RADIUS User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.195 NAS-Identifier = "24a43c7c6ae2" NAS-Port = 0 Called-Station-Id = "26-A4-3C-7D-6A-E2:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" # Executing section preacct from file /etc/freeradius/sites-enabled/default +group preacct { ++[preprocess] = ok [acct_unique] Hashing 'NAS-Port = 0,NAS-Identifier = "24a43c7c6ae2",NAS-IP-Address = 111.111.111.195,Acct-Session-Id = "540D4EDB-00000005",User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org"' [acct_unique] Acct-Unique-Session-ID = "d6d4b84652de2068". ++[acct_unique] = ok [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop ++[files] = noop +} # group preacct = ok # Executing section accounting from file /etc/freeradius/sites-enabled/default +group accounting { [detail] expand: %{Packet-Src-IP-Address} -> 111.111.111.195 [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/111.111.111.195/detail-20140908 [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/111.111.111.195/detail-20140908 [detail] expand: %t -> Mon Sep 8 21:45:00 2014 ++[detail] = ok ++[exec] = noop [attr_filter.accounting_response] expand: %{User-Name} -> 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] = updated +} # group accounting = updated Sending Accounting-Response of id 57 to 111.111.111.195 port 51808 Finished request 3. Cleaning up request 3 ID 57 with timestamp +3 Going to the next request Waking up in 4.3 seconds. Cleaning up request 0 ID 54 with timestamp +2 Cleaning up request 1 ID 55 with timestamp +2 Waking up in 0.5 seconds. Cleaning up request 2 ID 56 with timestamp +3 Ready to process requests.

1 0

About the file pointed at by setting "certificate_file"
by Axel Luttgens 08 Sep '14

08 Sep '14

Hello, Currently, I have in raddb/mods-available/eap the equivalent of: tls-config tls-common { private_key_password = whatever private_key_file = /path/to/my_server_key.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If ca_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. certificate_file = /path/to/my_server_cert.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. ca_file = /path/to/my_root_ca_cert.pem where the server's certificate (my_server_cert.pem) has been signed with the help of an ad hoc root CA (whose certificate is my_root_ca_cert.pem). It "works", in the sense that a client connecting thru TTLS receives both certificates, which is exactly what I want. :-) Now, it is true that I currently don't implement TLS. Putting above comments together, it seems that I could thus comment out the "ca_file = ..." line, and merge both certificates, my_server_cert.pem and my_root_ca_cert.pem, into a single file, say "my_combined_certs". And then define: certificate_file = /path/to/my_combined_certs What format(s) is (are) allowed by FR for that file "my_combined_certs"? Would a simple cat of the two certificates (currently in PEM format) be sufficient? TIA, Axel

3 10