- Freeradius-Users - lists.freeradius.org

Re: FreeRadius 3 deb packages upgrade
by Rui Ribeiro 08 Sep '14

08 Sep '14

Hi Fajar, Our local repo, from freeradius git, latest 3.1.0. Thanks for the pointers, will modify configuration accordingly. Regards > Date: Mon, 8 Sep 2014 16:27:43 +0700 > From: "Fajar A. Nugraha" <list(a)fajar.net> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius 3 deb packages upgrade > Message-ID: > <CAG1y0sehheH_a4XxFSbuQ7+k6R= > 5Ptfsh4WB5iTQH21yJudUqw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > On Mon, Sep 8, 2014 at 4:04 PM, Rui Ribeiro <ruyrybeyro(a)gmail.com> wrote: > > > > > Hi, > > > > Been using FreeRadius 3 deb compiled packages for a while here. At first > > I installed them locally and had no problem; however when doing the > upgrade > > from a repository, > > > > which repo? > > > > > the upgrades always overwrite my eap file in /etc/freeradius/mods-enabled > > with the original file. > > > > In the modules directory I am doing links to the files I have not > > modified, and I have the full files when modifying them. > > > > Is this intended behaviour or should I leave only links in mods-enabled > > and do full modifications in mods-available? (will also test this > situation > > in my next upgrade) > > > > > Basically yes, mods-enabled should only be symlinks. > > -- > Fajar > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

2 1

Re: Freeradius-Users Digest, Vol 113, Issue 28
by Rui Ribeiro 08 Sep '14

08 Sep '14

Hi Emma, For debbuging problems I usually use raddebug, and then only more difficult ones, or to send the output to the list are the ones that deserve running in full debug mode. Regards, Rui Ribeiro > > Message: 3 > Date: Mon, 8 Sep 2014 09:21:23 +0000 > From: "Cardinal-Richards, Emma" <e.cardinal-richards(a)ucl.ac.uk> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: EAP Session problems > Message-ID: > < > 7a18137e1a7c4d51b84031b037eb9166(a)AM3PR01MB209.eurprd01.prod.exchangelabs.com > > > > Content-Type: text/plain; charset="us-ascii" > > > On 8 Sep 2014, at 09:18, Cardinal-Richards, Emma <e.cardinal- > > richards(a)ucl.ac.uk> wrote: > > > I'm experiencing a problem with EAP sessions/new conversations not > > starting when I'm using the Janet testing as shown below. > > > > I'm not sure I fully understand your current configuration - are you > saying > > that you're routing test.ucl.ac.uk from your production radius servers, > via the > > national proxies, back to your pre-production servers? > > I believe that's the process of the test as per the guidance from JANET > here? This is for testing purposes, not our final configuration. > > "ORPS Testing > Setting an ORPS to testdev allows organisations to bring up a test box and > for it to only be sent specific test traffic during logic/rules checking > etc. eduroam administrators will need to generate such test traffic > themselves, eg. by using rad_eap_test with the username ' > testuser(a)test.youruniversity.ac.uk' to do a 'loopback test' to the new > systems. This can be done by using your live systems: > > 'testuser(a)test.youruniversity.ac.uk' -> Production ORPS -> NRPS -> > Testdev ORPS > > For this test realm handling facility to work eduroam administrators do > NOT have to specifically configure a 'test' sub-realm (eg.' > test.youruniversity.ac.uk') in the Realms section of eduroam Support." > > https://community.ja.net/library/janet-services-documentation/orps-role-des… > > I was just concerned that this behaviour would mean our roaming clients > would fail to authenticate back to us when they're visiting another > institution. > > > > > The issue seems to be that your client is responding too slowly: > > > > > Finished request 0. > > > Going to the next request > > > Waking up in 4.9 seconds. > > > Cleaning up request 0 ID 1 with timestamp +17 > > > > Increase the cleanup delay in radiusd.conf and requests should complete - > > but over 5 seconds is an obscenely long time, things should be much > faster. > > Dropping it to 3 seconds fixes it.. > > > Could you give an overview of where the requests being transmitted to the > > NRPS are originating from? > > Sorry do you mean the client? I tested from my Linux (Ubuntu) laptop and > my colleagues Windows 7 laptop with the same behaviour. > > > > > > The other odd behaviour is that despite getting a REJECT from this > testdev > > server, I get authenticated by our production ORPS using > > 'username(a)test.ucl.ac.uk' which is not a declared local realm on the > > production ORPS. > > > > We'd need to see a log from the production servers to investigate this. > > Just wondering is this technically correct behaviour (will have to > organise a specific time to run it in debug on our live servers..) my > 'test' user gets authenticated on my test ORPS so the NRPS tell my > production ORPS (as if they are another institution I'm visiting) to allow > me on the network? > > Regards, > Emma > > >

1 0

FreeRadius 3 deb packages upgrade
by Rui Ribeiro 08 Sep '14

08 Sep '14

Hi, Been using FreeRadius 3 deb compiled packages for a while here. At first I installed them locally and had no problem; however when doing the upgrade from a repository, the upgrades always overwrite my eap file in /etc/freeradius/mods-enabled with the original file. In the modules directory I am doing links to the files I have not modified, and I have the full files when modifying them. Is this intended behaviour or should I leave only links in mods-enabled and do full modifications in mods-available? (will also test this situation in my next upgrade) -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 2

How-To for setting up ldap for Active Directory
by Lord Felix 08 Sep '14

08 Sep '14

Hi Everyone, I'm new to freeRadius and I've been reading some of the mailing list e-mails. I've got freeRadius with Cento 6 which is version 2.1.12 installed. So I've followed the instructions for getting freeRadius working ntlm_auth with Windows 2012 Active Directory, based on the link below: http://deployingradius.com/documents/configuration/active_directory.html Everything works great! The only issue is now I need Dynamic Vlan working and I also need to look up mac address via from a mssql database to validate the user to allow access to the network. After reading more about ntlm_auth, it will only respond to true or false and this method doesn't really help with want I want to accomplish. What I need to do is based on what group the user belongs to, they are assigned to that specific vlan. i.e. if you are a staff you go to VLAN 7 and if you are a student you go to vlan 9. Is there any How-To guide for setting up ldap for Active Directory just like the link above? I've tried to setup the ldap module and I'm running into issues. This is how my ldap config looks like: ldap { server = "xxx.xxx.xxx" basedn = "dc=xxx,dc=xxx,dc=xxx" filter = (&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) groupmembership_attribute = "Administrators" ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf chase_referrals = yes rebind = yes ldap_debug = 0x0028 keepalive { idle = 60 probes = 3 interval = 3 } } Here is my debug info, and I know it's not working, because I don't even see it trying to contact the radius server, which is why I'm asking if there is quick HowTo: rad_recv: Access-Request packet from host 127.0.0.1 port 33583, id=125, length=74 User-Name = "xxxxxxx" User-Password = "xxxxxxx" NAS-IP-Address = xx.xx.xxxx NAS-Port = 0 Message-Authenticator = 0x1c451a3ee1cd4caabec9e764c4006d2b # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "xxxxxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> xxxx [sql] sql_set_user escaped user --> 'xxxxxx' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'username' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'xxxxxx' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User username not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> xxxxx attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 125 to 127.0.0.1 port 33583 Waking up in 4.9 seconds. Cleaning up request 1 ID 125 with timestamp +2007 Ready to process requests. Someone also posted that they can get ntlm_auth working with groups and you need to chat the stuff around? It would be great if someone can provide a how on this to work with dynamic vlan. Any help would be greatly appreciated. Thanks

2 1

d.iskandarov
by d.iskandarov 08 Sep '14

08 Sep '14

http://houtwormbestrijding-houtwormbestrijding.nl/oikluvdq/kzdzfglodp.khldtf

1 0

send parameter to radclient
by Mehdi Ravanbakhsh 08 Sep '14

08 Sep '14

Hi All I need to send about 22 attribute parameter to radclient but it is not working in this way : echo "Service-Type=Framed-User,Framed-Protocol=PPP,NAS-Port=11115644,NAS-Port-Type=Ethernet,User-Name=test1,Calling-Station-Id=D8:5D:4C:BC:C7:6B,NAS-Port-Id=ADSL-PARSIAN(906),Acct-Session-Id=81a57fe5,Framed-IP-Address=2.184.215.124,Acct-Session-Time =777,Acct-Input-Octets=999999,Acct-Input-Gigawords=0,Acct-Output-Octets=999,Acct-Output-Gigawords=0,Acct-Status-Type=Interim-Update,NAS-IP-Address=127.0.0.1" | radclient -x 127.0.0.1:1813 acct ''test'' I get this error : radclient:: Expected end of line or comma radclient: Nothing to send. I need to send parameter in file or something like that I can not find any document or sample . Any one can help me ? Best regards.

3 2

Brand new beginner need help!
by Frank Wei 08 Sep '14

08 Sep '14

Hi, I'm brand new to FreeRadius and just installed server 2.2.5. I have followed the wiki instruction (basic Configuration section) to do the simple test. The only thing I added is to add testing Cleartext-Password := "password" in the /raddb/users Here is the debug information I had when I run radtest testing password localhost 0 testing123 rad_recv: Access-Request packet from host 127.0.0.1 port 32775, id=195, length=77 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 Message-Authenticator = 0x024f3a845461e5597651150741f365fd # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 195 to 127.0.0.1 port 32775 Waking up in 4.9 seconds. Cleaning up request 2 ID 195 with timestamp +530 Could anybody help to me to explain why it was rejected? (it looks like a no "known good" password issue but I don't know why) Great thanks, 4RF Limited The information in this email communication (inclusive of attachments) is confidential to 4RF Limited and the intended recipient(s). If you are not the intended recipient(s), please note that any use, disclosure, distribution or copying of this information or any part thereof is strictly prohibited and that the author accepts no liability for the consequences of any action taken on the basis of the information provided. If you have received this email in error, please notify the sender immediately by return email and then delete all instances of this email from your system. 4RF Limited will not accept responsibility for any consequences associated with the use of this email (including, but not limited to, damages sustained as a result of any viruses and/or any action or lack of action taken in reliance on it).

1 0

For peap with ms-chapv2 are the MPPE keys derived from ms-chap or TLS material?
by mark.leese＠stfc.ac.uk 06 Sep '14

06 Sep '14

Hi, This is hopefully a simple question and so apologises if I'm being stupid :-) When using PEAP with an inner method of MS-CHAPv2, are the encryption keys (MS-MPPE-Recv-Key and MS-MPPE-Send-Key) derived from the MS-CHAP material or the TLS tunnel information? I always thought it was from the TLS tunnel, just like RFC3079 says it is when using EAP-TLS, but I could not find a definitive answer for PEAP. Thanks in advance, Mark. -- Scanned by iCritical.

2 1

Fwd: Failed Authentication user on EAP-SIM,
by Iman Rahmat 06 Sep '14

06 Sep '14

Dear All hello , i was installed freeradius-server 2.2.5 on ubuntu 10.04 The configuration was i done is : - i was installed Eap-Sim server and rlm_sim_files.so was in /usr/lib/freeradius - i was input sim { } on eap.conf in last before } closing. - i was make simtriplets.dat in /etc/freeradius with this : 1510011642151135,634B1828FE9F4cd987EE44A54D25DD80,0638e55f,15c22dc20A8ae000 1510011642151135,DD00F2D8D6FB4095B2BD8A2AE11FB600,02ed2e94,536655a061778400 1510011642151135,A852B0E55BC741f5A8C5B6ABF1E81504,F77daa16,71e9bd629Cee3000 - i was input in users file with this : 1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x634B1828FE9F4cd987EE44A54D25DD80, EAP-Sim-SRES1 = 0x0638e55f, EAP-Sim-KC1 = 0x15c22dc20A8ae000, EAP-Sim-Rand2 = 0xDD00F2D8D6FB4095B2BD8A2AE11FB600, EAP-Sim-SRES2 = 0x02ed2e94, EAP-Sim-KC2 = 0x536655a061778400, EAP-Sim-Rand2 = 0xA852B0E55BC741f5A8C5B6ABF1E81504, EAP-Sim-SRES2 = 0xF77daa16, EAP-Sim-KC2 = 0x71e9bd629Cee3000 - i was make sim files on /etc/freeradius/modules, with this : sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } - i was input sim_files @ /etc/freeradius/sites-enabled/default on authorized { } directly befor eap { ok=return } - i was input my ipp address network on clients.conf thank you for advanced, i really apreciate and respect your help :-)/ freeradius -X freeradius: FreeRADIUS Version 2.2.5, for host i486-pc-linux-gnu, built on Sep 2 2014 at 01:14:34 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/sim_files including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/cache including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/dhcp_sqlippool including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/radrelay including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 111.111.111.0/24 { require_message_authenticator = no secret = "imanajadeh" shortname = "unifi" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ��?�?2� modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sim_files Module: Instantiating module "sim_files" from file /etc/freeradius/modules/sim_files sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:208 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user "1510011642151135(a)wlan.mnc001.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 46286 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. authentication failed with this debug log : rad_recv: Access-Request packet from host 111.111.111.219 port 56787, id=148, length=232 User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" NAS-IP-Address = 111.111.111.219 NAS-Identifier = "dc9fdb9c7513" NAS-Port = 0 Called-Station-Id = "26-9F-DB-9D-75-13:SuperWiFi-SIM_A" Calling-Station-Id = "D4-97-0B-47-3F-10" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02a300060312 State = 0xb03003e9b0930724bdcb3e1f451eecdb Message-Authenticator = 0xcebc5c917498be5780531a7fd0daead0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] Looking up realm "wlan.mnc000.mcc510.3gppnetwork.org" for User-Name = "1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc000.mcc510.3gppnetwork.org" ++[suffix] = noop rlm_sim_files: insufficient number of challenges for imsi 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org: 0 ++[sim_files] = notfound [eap] EAP packet type response id 163 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/sim [eap] processing type sim can not initiate sim, no RAND1 attribute [eap] Default EAP type sim failed in initiate [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> 1510011642151135(a)wlan.mnc000.mcc510.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 33 for 1 seconds Going to the next request Waking up in 0.5 seconds. Cleaning up request 30 ID 145 with timestamp +1518 Waking up in 0.4 seconds. Sending delayed reject for request 33 Sending Access-Reject of id 148 to 111.111.111.219 port 56787 EAP-Message = 0x04a30004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.5 seconds. Cleaning up request 31 ID 146 with timestamp +1518 Waking up in 3.4 seconds. Cleaning up request 32 ID 147 with timestamp +1523 Waking up in 1.0 seconds. Cleaning up request 33 ID 148 with timestamp +1523 Ready to process requests. thank you before

1 0

Re: Virtual server can't set reply attributes
by Paul 05 Sep '14

05 Sep '14

Alan wrote: > That's wrong. Why are you using Cisco-AVPair twice? It should be: > Cisco-AVPair > += > "ip:inacl=ACL_VIRT_SECURE_IN" I just badly pasted. The SQL table is fine. > OK... and what does the debug log look like for 2.2.5? Are you using the same SQL tables? Or different ones? The same tables. 2.2.5 output: rad_recv: Access-Request packet from host 193.151.53.4 port 1645, id=59, length=121 Framed-Protocol = PPP User-Name = "test1" CHAP-Password = 0x0123554ba1746f7fd30486bd0bd46c39de Calling-Station-Id = "0024.c435.f7e4" NAS-Port-Type = Ethernet NAS-Port = 33554632 NAS-Port-Id = "0/0/2/200" Connect-Info = "POL_Vlan200_500M" Service-Type = Framed-User NAS-IP-Address = 193.151.53.4 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/srv_default +group authorize { ++[preprocess] = ok [suffix] No '@' in User-Name = "test1", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "test1" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user test1 to realm NULL [suffix] Preparing to proxy authentication request to realm "NULL" ++[suffix] = updated +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. >>> Sending proxied request internally to virtual server. server srv_null { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/srv_null +group authorize { ++[preprocess] = ok [chap] Setting 'Auth-Type := CHAP' ++[chap] = ok [files] users: Matched entry DEFAULT at line 172 ++[files] = ok [sql] expand: %{Stripped-User-Name} -> test1 [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> test1 [sql] sql_set_user escaped user --> 'test1' rlm_sql (sql): Reserving sql socket id: 26 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'test1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'test1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'test1' ORDER BY priority rlm_sql (sql): Released sql socket id: 26 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop +} # group authorize = ok Found Auth-Type = CHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/srv_null +group CHAP { [chap] login attempt by "test1" with CHAP password [chap] Using clear text password "test121" for user test1 authentication. [chap] chap user test1 authenticated succesfully ++[chap] = ok +} # group CHAP = ok WARNING: Empty post-auth section. Using default return values. } # server srv_null Going to the next request <<< Received proxied response code 2 from internal virtual server. WARNING: Empty post-proxy section. Using default return values. Found Auth-Type = Accept Auth-Type = Accept, accepting the user WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/srv_default WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/srv_default Sending Access-Accept of id 59 to 193.151.53.4 port 1645 Framed-Protocol = PPP Cisco-AVPair += "ip:inacl=ACL_VIRT_SECURE_IN" Finished request 5. Going to the next request Waking up in 4.9 seconds. -- Regards, Paul

2 2