- Freeradius-Users - lists.freeradius.org

Re: Re: Some inconsistencies concerning OpenSSL include configuration in FRS 3
by rieke＠isl.de 27 Jul '14

27 Jul '14

Alan DeKok wrote: > Dr. Andreas Rieke wrote: >> On 26 Jul 2014, at 20:56, Arran Cudbard-Bell wrote: >> 1. The current v3.0.x source does not compile because of a problem in pcap.c. >> There is no pcap installed on my machine, and configure has detected that correctly. >> However, there are two functions at the end of pcap.c which are not included >> in the "#ifdef HAVE_LIBPCAP" and for that reason, the compiler creates errors. >> If you simply put everything in pcap.c between the "#ifdef HAVE_LIBPCAP" and >> "#endif", everything works well on my machine. > > I've pushed a fix. Thanks - I have tested it, it works great. >> 2. The configuration for types/rlm_eap_pwd does not yet work: >>> checking for openssl/ec.h... no >>> checking for openssl/ec.h in /usr/local/include/... no >>> checking for openssl/ec.h in /opt/include/... no >>> checking for OpenSSL support... yes >>> checking for EVP_sha256 in -lc -lcrypto -lssl... no >>> configure: WARNING: EVP_sha256 not found, may have issues wirh WiMAX certificates >>> checking for EC_GROUP_free... no >>> configure: WARNING: silently not building rlm_eap_pwd. >>> configure: WARNING: FAILURE: rlm_eap_pwd requires: EC_GROUP_free. >> I am sure that ec.h is in the directory where it should be. > > Is it in the directories which are printed out above? > > What does the "config.log" file say? i.e. > src/modules/rlm_eap/types/rlm_eap_pwd/config.log It should be filled > with logs from all of the attempts to compile the source. > >> 3. The configuration of src/modules/rlm_unbound does not yet work: >>> checking for openssl/crypto.h... no >>> checking for openssl/crypto.h in /usr/local/include/... no >>> checking for openssl/crypto.h in /opt/include/... no >>> configure: WARNING: silently not building rlm_unbound. >>> configure: WARNING: FAILURE: rlm_unbound requires: libunbound unbound.h openssl/crypto.h. >> Again, I am sure that openssl/crypto.h is in place and readable by the compiler. > > The same comments apply as above. > >> 4. This issue is about src/modules/rlm_wimax: >>> checking openssl/hmac.h usability... no >>> checking openssl/hmac.h presence... no >>> checking for openssl/hmac.h... no >>> configure: WARNING: silently not building rlm_wimax. >>> configure: WARNING: FAILURE: rlm_wimax requires: openssl/hmac.h. > > The same comments apply here, too. Let us merge the three problems types/rlm_eap_pwd, src/modules/rlm_unbound and src/modules/rlm_wimax: All of the configuration scripts are somehow called by the main configuration script, and the two parameters for the OpenSSL directories are passed to each of the three "sub" configuration scripts. However, in contrast to the main configure script, none of the three knows the parameters for the OpenSSL directories: > [rieke@archer freeradius-server-2014-07-27_21-23]$ grep -i openssl-.*-dir configure src/modules/rlm_eap/types/rlm_eap_pwd/configure src/modules/rlm_unbound/configure src/modules/rlm_wimax/configure > configure: --with-openssl-lib-dir=DIR > configure: --with-openssl-include-dir=DIR > configure:# Check whether --with-openssl-lib-dir was given. > configure:# Check whether --with-openssl-include-dir was given. > configure:as_fn_error $? "failed linking to libssl. Use --with-openssl-lib-dir=<path>, or --with-openssl=no (builds without OpenSSL) > configure:as_fn_error $? "failed linking to libcrypto. Use --with-openssl-lib-dir=<path>, or --with-openssl=no (builds without OpenSSL) > configure:as_fn_error $? "failed locating OpenSSL headers. Use --with-openssl-include-dir=<path>, or --with-openssl=no (builds without OpenSSL) For that reason, the config.log files show that the parameters are passed correctly to the configure "sub" script, but since these parameters are ignored the compiler is not able to find the header files. The following log lines are from rlm_eap_pwd, but the others have the same problem: > configure:2758: checking for openssl/ec.h > configure:2773: gcc -c -g -O2 conftest.c >&5 > conftest.c:10:30: error: openssl/ec.h: No such file or directory ... > configure:2850: checking for openssl/ec.h in /usr/local/include/ > configure:2865: gcc -c -g -O2 -isystem /usr/local/include/ conftest.c >&5 > conftest.c:10:30: error: openssl/ec.h: No such file or directory ... > configure:2850: checking for openssl/ec.h in /opt/include/ > configure:2865: gcc -c -g -O2 -isystem /opt/include/ conftest.c >&5 > conftest.c:10:30: error: openssl/ec.h: No such file or directory I am quite sure that FRS compiles without problems on many other systems, but in those cases, the compiler takes the OpenSSL header files from the system and not from the specified directories - on my machine, I have removed the openssl-devel RPM package (CentOS), and thus, I get that failure. However, maybe the failure is better than a wrong header file... When I pass 'CPPFLAGS="-I /opt/openssl/include"' to the main configure script, the problems are solved for the headers - as an example, ec.h is found immediately. However, FRS still uses the system libraries :-( > checking for openssl/ec.h... yes > checking for OpenSSL support... yes > checking for EVP_sha256 in -lc -lcrypto -lssl... no > configure: WARNING: EVP_sha256 not found, may have issues wirh WiMAX certificates Please let me know if I can do anything to help you solving the issue, Andreas

2 1

Re: EAP-GTC configuration
by Levavi, Yariv 27 Jul '14

27 Jul '14

Hello Alan and thanks for answering. More questions were raised: 1) Is the first entered password being transferred to FreeRadius? What attributes can we use in order to obtain it? In which way is it encoded? 2) May you please send us an example for attribute to check, redirect sentence and where should the check be placed? 3) Can we configure FreeRadius as a client of another Radius (to whom we want to redirect to) and so we can establish a secured channel through? 4) The documents you refer us to are not complete. Are there any other documentation regarding FreeRadius full configuration? Regards, Yariv Levavi SafeNet's Integration Team The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

3 2

Re: Re: Some inconsistencies concerning OpenSSL include configuration in FRS 3
by rieke＠isl.de 27 Jul '14

27 Jul '14

On 26 Jul 2014, at 20:56, Arran Cudbard-Bell wrote: > > On 26 Jul 2014, at 14:13, Dr. Andreas Rieke <rieke(a)isl.de> wrote: > >> On 26 Jul 2014, at 17:31, Arran Cudbard-Bell wrote: >> >>>> However, there is another problem which causes the make process to fail; the problem occurs with rlm_always first: >>>>>>> CC /home/freeradius/freeradius-server-3.0.3/src/modules/rlm_always/rlm_always.c >>>>>>> In file included from /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/radiusd.h:59, >>>>>>> from /home/freeradius/freeradius-server-3.0.3/src/modules/rlm_always/rlm_always.c:27: >>>>>>> /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/tls.h:39:25: error: openssl/err.h: No such file or directory >>>>>>> /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/tls.h:41:30: error: openssl/engine.h: No such file or directory >>>>>>> /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/tls.h:43:25: error: openssl/ssl.h: No such file or directory >>>>> I already tried to use an environment variable CPPFLAGS="-I /opt/openssl/include" for the main configure script, but that did not help. What else can I do to convice FreeRADIUS to use the correct OpenSSL system? >>> You'd set it in Make.inc. >>> >>> With v3.0.x head >>> >>> Works for me with v3.0.x... >>> >>> ./configure --with-openssl-lib-dir=/usr/local/opt/openssl/lib --with-openssl-include-dir=/usr/local/opt/openssl/include >>> ... >>> checking OpenSSL library and header version consistency... library: 1000108f header: 1000108f... yes >>> ... >>> >>> LINK build/lib/libfreeradius-radius.la >>> CC /Users/arr2036/Documents/Repositories/freeradius-server-master/src/tests/rbmonkey.c >>> LINK build/bin/rbmonkey >>> CC /Users/arr2036/Documents/Repositories/freeradius-server-master/src/modules/rlm_always/rlm_always.c >>> LINK build/lib/rlm_always.la >> >> Hi again, >> >> first thanks a lot for your answer. Things work exactly as you said - in 3.0.2, but not in 3.0.3. >> >> The Make.inc file already contains the correct parameters - even without the parameter CPPFLAGS="-I /opt/openssl/include" for the configuration script: >>> CPPFLAGS = -isystem /opt/openssl/include >> If you pass CPPFLAGS="-I /opt/openssl/include" to the configure script, you get the path twice: >>> CPPFLAGS = -isystem /opt/openssl/include -I /opt/openssl/include >> >> However, in both cases make fails compiling the module rlm_always because the >> system can not find openssl/err.h and other openssl header files. Is it >> possible that there are system openssl header files on your machine, maybe in >> /usr/local/include or in /opt/include, which the preprocessor uses? I am sure that such files do not exist on my machine. Could this be the rason why make runs well on your system, but not on my machine? > > No. The runtime version compatibility checks use the OpenSSL version from a macro > in the OpenSSL include files. > > If it were using the system OpenSSL header files, and non system libraries the server > would error out on startup (which it doesn't). > > Could you try with the v3.0.x branch and see if it's been fixed. I remember Alan > complaining about it not working correctly, but I can't remember if his issues > were fixed before 3.0.3 was released or after. Hi, let me start with the good news: The main problem is solved, rlm_always and all other files now compile without errors. However, we have also bad news, let me explain step by step: 1. The current v3.0.x source does not compile because of a problem in pcap.c. There is no pcap installed on my machine, and configure has detected that correctly. However, there are two functions at the end of pcap.c which are not included in the "#ifdef HAVE_LIBPCAP" and for that reason, the compiler creates errors. If you simply put everything in pcap.c between the "#ifdef HAVE_LIBPCAP" and "#endif", everything works well on my machine. 2. The configuration for types/rlm_eap_pwd does not yet work: > checking for openssl/ec.h... no > checking for openssl/ec.h in /usr/local/include/... no > checking for openssl/ec.h in /opt/include/... no > checking for OpenSSL support... yes > checking for EVP_sha256 in -lc -lcrypto -lssl... no > configure: WARNING: EVP_sha256 not found, may have issues wirh WiMAX certificates > checking for EC_GROUP_free... no > configure: WARNING: silently not building rlm_eap_pwd. > configure: WARNING: FAILURE: rlm_eap_pwd requires: EC_GROUP_free. I am sure that ec.h is in the directory where it should be. 3. The configuration of src/modules/rlm_unbound does not yet work: > checking for openssl/crypto.h... no > checking for openssl/crypto.h in /usr/local/include/... no > checking for openssl/crypto.h in /opt/include/... no > configure: WARNING: silently not building rlm_unbound. > configure: WARNING: FAILURE: rlm_unbound requires: libunbound unbound.h openssl/crypto.h. Again, I am sure that openssl/crypto.h is in place and readable by the compiler. 4. This issue is about src/modules/rlm_wimax: > checking openssl/hmac.h usability... no > checking openssl/hmac.h presence... no > checking for openssl/hmac.h... no > configure: WARNING: silently not building rlm_wimax. > configure: WARNING: FAILURE: rlm_wimax requires: openssl/hmac.h. 5. The last issue is good news again: The problems with the otp configuration are solved. Please let me know if I can help you with these issues, best regards, Andreas

2 1

Re: Re: Some inconsistencies concerning OpenSSL include configuration in FRS 3
by rieke＠isl.de 26 Jul '14

26 Jul '14

On 26 Jul 2014, at 17:31, Arran Cudbard-Bell wrote: >> However, there is another problem which causes the make process to fail; the problem occurs with rlm_always first: >>> >> CC /home/freeradius/freeradius-server-3.0.3/src/modules/rlm_always/rlm_always.c >>> >> In file included from /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/radiusd.h:59, >>> >> from /home/freeradius/freeradius-server-3.0.3/src/modules/rlm_always/rlm_always.c:27: >>> >> /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/tls.h:39:25: error: openssl/err.h: No such file or directory >>> >> /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/tls.h:41:30: error: openssl/engine.h: No such file or directory >>> >> /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/tls.h:43:25: error: openssl/ssl.h: No such file or directory >> > I already tried to use an environment variable CPPFLAGS="-I /opt/openssl/include" for the main configure script, but that did not help. What else can I do to convice FreeRADIUS to use the correct OpenSSL system? > You'd set it in Make.inc. > > With v3.0.x head > > Works for me with v3.0.x... > > ./configure --with-openssl-lib-dir=/usr/local/opt/openssl/lib --with-openssl-include-dir=/usr/local/opt/openssl/include > ... > checking OpenSSL library and header version consistency... library: 1000108f header: 1000108f... yes > ... > > LINK build/lib/libfreeradius-radius.la > CC /Users/arr2036/Documents/Repositories/freeradius-server-master/src/tests/rbmonkey.c > LINK build/bin/rbmonkey > CC /Users/arr2036/Documents/Repositories/freeradius-server-master/src/modules/rlm_always/rlm_always.c > LINK build/lib/rlm_always.la Hi again, first thanks a lot for your answer. Things work exactly as you said - in 3.0.2, but not in 3.0.3. The Make.inc file already contains the correct parameters - even without the parameter CPPFLAGS="-I /opt/openssl/include" for the configuration script: > CPPFLAGS = -isystem /opt/openssl/include If you pass CPPFLAGS="-I /opt/openssl/include" to the configure script, you get the path twice: > CPPFLAGS = -isystem /opt/openssl/include -I /opt/openssl/include However, in both cases make fails compiling the module rlm_always because the system can not find openssl/err.h and other openssl header files. Is it possible that there are system openssl header files on your machine, maybe in /usr/local/include or in /opt/include, which the preprocessor uses? I am sure that such files do not exist on my machine. Could this be the rason why make runs well on your system, but not on my machine? Best regards, Andreas

2 1

Some inconsistencies concerning OpenSSL include configuration in FRS 3
by rieke＠isl.de 26 Jul '14

26 Jul '14

Hi, due to the heartbleet bug, I want the FreeRADIUS server to use my own (new) OpenSSL library, and not the (old) system include/lib files. According to the main configuration utility (parameters for openssl include and lib directories) and accoring to Alan DeKok's email from May 16 (How to link to openssl if two versions of libssl are on the system, when building FreeRadius on Debian wheezy 7.4?) this should be possible: > I use it that way every day. However, this stopped working in my environment (CentOS) in the current 3.0.3 version of FRS; but let's start step by step with version 3.0.2. CentOS has own packages for development purposes, for example openssl-devel; to be sure that FreeRADIUS does not include the wrong header file, I have removed this package. Thus, FreeRADIUS will either take the correct file or report a missing file. In version 3.0.2 of FRS, there are two options for the configure script for that purpose (--with-openssl-includes=DIR and --with-openssl-libraries=DIR) which work well. However, there are a few small inconsistencies concerning the modules: - The configure script for rlm_eap_pwd is not able to find openssl/ec.h although the file is present in the folder given by the with-openssl-includes parameter to the main configure script: > checking for openssl/ec.h... no > checking for openssl/ec.h in /usr/local/include... no > checking for openssl/ec.h in /opt/include... no > checking for OpenSSL support... yes - The configure script for rlm_otp reports inconsistencies: > checking openssl/des.h usability... yes > checking openssl/des.h presence... no > configure: WARNING: openssl/des.h: accepted by the compiler, rejected by the preprocessor! > configure: WARNING: openssl/des.h: proceeding with the compiler's result > checking for openssl/des.h... yes - The configure script for rlm_wimax is not able to find openssl/hmac.h although the file is present in the folder given by the with-openssl-includes parameter to the main configure script: > checking openssl/hmac.h usability... no > checking openssl/hmac.h presence... no > checking for openssl/hmac.h... no > configure: WARNING: silently not building rlm_wimax. > configure: WARNING: FAILURE: rlm_wimax requires: openssl/hmac.h. However, most modules in 3.0.2 compile well, and ldd makes sure that the wanted libraries are linked. But several things change in version 3.0.3. First of all, the parameters of the main configuration script changed in the following way: --with-openssl-includes -> --with-openssl-include-dir --with-openssl-libraries -> --with-openssl-lib-dir Unfortunately, this parameter change has been done only for the main configuration script, but not for the modules. Concerning the modules, rlm_otp is the only module which offers configuration parameters for OpenSSL directories, and this module still uses the old parameter names in 3.0.3 and in the git version from today. There is an easy workaround for this problem: Simply pass both (old and new) parameters to the main configuration script! However, there is another problem which causes the make process to fail; the problem occurs with rlm_always first: > CC /home/freeradius/freeradius-server-3.0.3/src/modules/rlm_always/rlm_always.c > In file included from /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/radiusd.h:59, > from /home/freeradius/freeradius-server-3.0.3/src/modules/rlm_always/rlm_always.c:27: > /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/tls.h:39:25: error: openssl/err.h: No such file or directory > /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/tls.h:41:30: error: openssl/engine.h: No such file or directory > /home/freeradius/freeradius-server-3.0.3/src/freeradius-devel/tls.h:43:25: error: openssl/ssl.h: No such file or directory I already tried to use an environment variable CPPFLAGS="-I /opt/openssl/include" for the main configure script, but that did not help. What else can I do to convice FreeRADIUS to use the correct OpenSSL system? Thanks in advance, Andreas Rieke

2 1

HP M200 certificate authentication fails
by Gordon Cook 25 Jul '14

25 Jul '14

Hi. I have been struggling with this for about a week now. We just purchased an HP M200 access point to replace an old cisco. We are using EAP-TLS using certificates. Here is what I have done so far. I have both access points using the same freeRadius2 server which is running FreeBSD 9 The client can authenticate using the certificate through the cisco. The client can authenticate using PAP through the HP The client cannot authenticate using the certificate through the HP. I get the following message Cleaning up request 0 ID 206 with timestamp +281 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xe4bd4b63e4b14652 did not finish! WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Cleaning up request 1 ID 248 with timestamp +281 Cleaning up request 2 ID 239 with timestamp +281 Cleaning up request 3 ID 167 with timestamp +281 Cleaning up request 4 ID 102 with timestamp +281 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x8c4bc3ec8f5acec4 did not finish! WARNING: !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! I have looked through everything I can find and I can't seem to get it to work. Gordon Cook Network Administrator Sault Ste Marie Innovation Centre Work: 705-942-6938 x3042 Cell: 705-971-3852 [comptia]<http://www.comptia.com/> [ssmic-one-2013]

4 12

wildcard/regex Auth-Type in authenticate section
by Zenon Mousmoulas 25 Jul '14

25 Jul '14

Hi again, sorry if this is a trivial question, but I couldn't find a definitive answer and I need to clarify: My understanding is that modules set Auth-Type in the authorize section and the server looks in the authenticate section for a matching sub-section. Different instances of rlm_eap set Auth-Type to their xlat name. The question is: Other than adding an Auth-Type subsection for every such variation, is it possible to match them e.g. in a regex comparison? As far as I can tell, I can only use unlang within Auth-Type subsections and not directly in the authenticate section. Thanks, Z.

2 7

Timeout problem behind load balancer
by Simon Morley 25 Jul '14

25 Jul '14

I've got a few working freeradius servers that we've spread the load with some basic round robin dns shizzle. Today I found out that Google's Compute Engine network load balancers support UDP traffic so I thought I'd try them out. Firstly I thought everything had gone smoothly as I could see Access-Accept appearing in the debug logs. However on further inspection, whilst I always get this message (when using a valid account), my client doesn't actually receive the response and therefore fails. I've tried with a simulator (jradius) and a coova client - all the same. There's no errors in the logs - the last few lines are as so: Thu Jul 24 23:51:23 2014 : Debug: rlm_sql (sql_primary): Reserving sql socket id: 3 Thu Jul 24 23:51:23 2014 : Info: row[0] returned NULL Thu Jul 24 23:51:23 2014 : Debug: rlm_sql (sql_primary): Released sql socket id: 3 Thu Jul 24 23:51:23 2014 : Info: expand: %{sql_primary:select location_id from nas where calledstationid='%{Called-Station-Id-Clean}'} -> Thu Jul 24 23:51:23 2014 : Info: ++} # update request = noop Thu Jul 24 23:51:23 2014 : Info: ++? if ("%{Tmp-String-4}") Thu Jul 24 23:51:23 2014 : Info: expand: %{Tmp-String-4} -> Thu Jul 24 23:51:23 2014 : Info: ? Evaluating ("%{Tmp-String-4}") -> FALSE Thu Jul 24 23:51:23 2014 : Info: ++? if ("%{Tmp-String-4}") -> FALSE Thu Jul 24 23:51:23 2014 : Info: [sql_cache] expand: %{User-Name} -> test Thu Jul 24 23:51:23 2014 : Info: [sql_cache] sql_set_user escaped user --> 'test' Thu Jul 24 23:51:23 2014 : Info: [sql_cache] expand: %{User-Password} -> account Thu Jul 24 23:51:23 2014 : Info: [sql_cache] expand: INSERT INTO radpostauth_cache (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth_cache (username, pass, reply, authdate) VALUES ( 'test', 'account', 'Access-Accept', '2014-07-24 23:51:23') Thu Jul 24 23:51:23 2014 : Debug: rlm_sql (sql_cache) in sql_postauth: query is INSERT INTO radpostauth_cache (username, pass, reply, authdate) VALUES ( 'test', 'account', 'Access-Accept', '2014-07-24 23:51:23') Thu Jul 24 23:51:23 2014 : Debug: rlm_sql (sql_cache): Reserving sql socket id: 2 Thu Jul 24 23:51:23 2014 : Debug: rlm_sql (sql_cache): Released sql socket id: 2 Thu Jul 24 23:51:23 2014 : Info: ++[sql_cache] = ok Thu Jul 24 23:51:23 2014 : Info: ++[exec] = noop Thu Jul 24 23:51:23 2014 : Info: +} # group post-auth = ok Sending Access-Accept of id 8 to 213.205.230.210 port 49080 Thu Jul 24 23:51:23 2014 : Info: Finished request 7. Thu Jul 24 23:51:23 2014 : Debug: Going to the next request Thu Jul 24 23:51:23 2014 : Debug: Waking up in 1.9 seconds. Thu Jul 24 23:51:25 2014 : Info: Cleaning up request 7 ID 8 with timestamp +177 Thu Jul 24 23:51:25 2014 : Info: Ready to process requests. I've discussed with Google and they're saying the connection isn't closed and the load-balancer therefore puts the instance in 'unhealthy' mode. This doesn't sound right to me. I think the traffic is being blocked. The only reference I can find to a similar issue was a user years ago who had network issues.. Has anyone tried this successfully - either on GCE or other UDP load balancer? Does anyone have any thoughts about how I could solve?

4 5

PostgreSQL accounting callingstationid field blank
by Stoycho Ganev 25 Jul '14

25 Jul '14

Hello, I'm using FreeRadius 2.1.12 (Debian stable) with PostgreSQL database to do AAA for wifi (PEAP inner-tunnel) clients via Mikrotik (RouterOS) APs. Everything works fine except that when accounting records are INSERTed in the radacct table, the callingstationid field is left blank instead of being populated with the MAC address of the calling station. This is rather strange, because the Calling-Station-Id is present in the Access-Request, and is the correct format (no wimax rubbish). -- DEBUG -- rad_recv: Access-Request packet from host 192.168.13.4 port 41720, id=192, length=219 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x0200000c01636c6561766572 Message-Authenticator = 0x434e50ee2a38b4327019b1f023d7006e NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 175 ++[files] returns ok [sql] expand: %{User-Name} -> cleaver [sql] sql_set_user escaped user --> 'cleaver' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'cleaver' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'cleaver' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='cleaver' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 192 to 192.168.13.4 port 41720 Session-Timeout := 1800 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053eed241cd2358f2aa5aaaf3fc2 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 59644, id=193, length=433 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053eed241cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020100d01980000000c616030100c1010000bd030153d2019cb70c22292cf72fa06046597aa60d5c8a8c593674b564308f7a8eafeb000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011 Message-Authenticator = 0xe7f541f1fe5aca909fd60af2ce86aa45 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 1 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 00c1], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0039], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 1455], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 193 to 192.168.13.4 port 59644 EAP-Message = 0x0102040019c0000015f1160301003902000035030153d2019c19456f2f53451c3160934c0e061b78cd24d0e8237107a07ad789e70a00c01400000dff01000100000b00040300010216030114550b00145100144e0006403082063c30820524a00302010202030eadac300d06092a864886f70d01010b050030818c310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312b3029060355040b1322536563757265204469676974616c204365727469666963617465205369676e696e67313830360603550403132f5374617274436f6d20436c6173732031205072696d61727920496e7465726d656469617465 EAP-Message = 0x20536572766572204341301e170d3134303232303138353131315a170d3135303232313133343733375a304e310b3009060355040613024247311a3018060355040313117261646975732e646174616d61782e62673123302106092a864886f70d01090116147765626d617374657240646174616d61782e626730820122300d06092a864886f70d01010105000382010f003082010a0282010100c0292ddae54021f9fe735191ff7292fb3eac929d3f958bb8c98aad1e040fbcbac519c7cfb9b64e8344fe7c7fba3c9447c9e6b1d9bdd86776a2343ab1ab141316f030740232147e896627594abab0e45cf4de79a82269e985aa374ba9e482ac351282 EAP-Message = 0x6618d71751108021ba0bc607cbb0c7616bd46c5e266db36faa8ccb063b2329866295968f9d7bd5ff6b83617b9780ef9a2c8668f52a90f9ed73d5308efc93360e6de3e21296b51c40164fc00c9fc4d61f18e759db66b1708362b51cbcbb2ee926a0a59118064cb9c4e8fad26541cb4da5480e654cb4c37a4b3354a22ffffc7f0655929fd1e9d4749950ab2f5a51f054e0851f814523d792b5e6e9fc7958eb0203010001a38202e2308202de30090603551d1304023000300b0603551d0f0404030203a830130603551d25040c300a06082b06010505070301301d0603551d0e04160414ddbc53b20d58f98e6db7e795176aab2ed8f5275d301f0603551d EAP-Message = 0x23041830168014eb4234d098b0ab9ff41b6b08f7cc642eef0e2c4530280603551d110421301f82117261646975732e646174616d61782e6267820a646174616d61782e6267308201560603551d200482014d308201493008060667810c0102013082013b060b2b0601040181b5370102033082012a302e06082b060105050702011622687474703a2f2f7777772e737461727473736c2e636f6d2f706f6c6963792e7064663081f706082b060105050702023081ea302716205374617274436f6d2043657274696669636174696f6e20417574686f7269747930030201011a81be54686973206365727469666963617465207761732069737375656420 EAP-Message = 0x6163636f7264696e6720746f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053eec271cd2358f2aa5aaaf3fc2 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 55690, id=194, length=231 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053eec271cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020200061900 Message-Authenticator = 0xa8463c35eeecca48b017bdafe961171e NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 194 to 192.168.13.4 port 55690 EAP-Message = 0x010303fc19402074686520436c61737320312056616c69646174696f6e20726571756972656d656e7473206f6620746865205374617274436f6d20434120706f6c6963792c2072656c69616e6365206f6e6c7920666f722074686520696e74656e64656420707572706f736520696e20636f6d706c69616e6365206f66207468652072656c79696e67207061727479206f626c69676174696f6e732e30350603551d1f042e302c302aa028a0268624687474703a2f2f63726c2e737461727473736c2e636f6d2f637274312d63726c2e63726c30818e06082b06010505070101048181307f303906082b06010505073001862d687474703a2f2f6f6373 EAP-Message = 0x702e737461727473736c2e636f6d2f7375622f636c617373312f7365727665722f6361304206082b060105050730028636687474703a2f2f6169612e737461727473736c2e636f6d2f63657274732f7375622e636c617373312e7365727665722e63612e63727430230603551d12041c301a8618687474703a2f2f7777772e737461727473736c2e636f6d2f300d06092a864886f70d01010b050003820101005e7443be92a6e0ddc6b48e58d9a0e40059c6328814d556263095548d82d0ebe0f91d34feb0bb1aeaa5d8964fd244c2e6726b66e3a690e8e8156561cc3d75fd9126e726a4a6b00d0b9b0601ba144d2700ae0acd415c9050f7b74aaba7a9 EAP-Message = 0x2e72de4c98719c4845bf68eb2bdaacbb3a1e030f2d429cfa40cdc11fc338a3628beedd09fc2acb6cd6c73ddca416e6ce4d45fbc41d8ebfefb01b54e453e8e34efd6ee615636de6b286639cc44642d7253839632fff191c628d88943bbc3dc1aa3c54704e6fce6aee5958625c597c8ccfd024d96c313283c28eddc52f7fc5c0861cd4a0cd05bbdfc21a031851738200a5a96e8cadfebefa5f8d7a18c91d65b750e5a67f000638308206343082041ca003020102020118300d06092a864886f70d0101050500307d310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312b3029060355040b1322536563757265 EAP-Message = 0x204469676974616c204365727469666963617465205369676e696e6731293027060355040313205374617274436f6d2043657274696669636174696f6e20417574686f72697479301e170d3037313032343230353431375a170d3137313032343230353431375a30818c310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312b3029060355040b1322536563757265204469676974616c204365727469666963617465205369676e696e67313830360603550403132f5374617274436f6d20436c6173732031205072696d61727920496e7465726d6564696174652053657276657220434130820122300d06 EAP-Message = 0x092a864886f70d01 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053eef261cd2358f2aa5aaaf3fc2 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 44014, id=195, length=231 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053eef261cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020300061900 Message-Authenticator = 0x55a162fc3d5e927e809dfa9f7a29e5dd NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 195 to 192.168.13.4 port 44014 EAP-Message = 0x010403fc1940010105000382010f003082010a0282010100b689c6acef09527807ac9263d0f44418188480561f91aee187fa3250b4d34706f0e6075f700e10f71dc0ce103634855a0f92ac83c6ac58523fba38e8fce7a724e240a60876c0926e9e2a6d4d3f6e61200adb59ded27d63b33e46fefa215118d7cd30a6ed076e3b7087b4f9faebee823c056f92f7a4dc0a301e9373fe07cad75f809d225852ae06da8b872369b0e42ad8ea83d2bdf371db705a280faf5a387045123f304dcd3baf17e50fcba0a95d48aab16150cb34cd3c5cc30be810c08c9bf0030362feb26c3e720eee1c432ac9480e5739c43121c810c12c87fe5495521f523c31129b7f EAP-Message = 0xe7c0a0a559d5e28f3ef0d5a8e1d77031a9c4b3cfaf6d532f06f4a70203010001a38201ad308201a9300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414eb4234d098b0ab9ff41b6b08f7cc642eef0e2c45301f0603551d230418301680144e0bef1aa4405ba517698730ca346843d041aef2306606082b06010505070101045a3058302706082b06010505073001861b687474703a2f2f6f6373702e737461727473736c2e636f6d2f6361302d06082b060105050730028621687474703a2f2f7777772e737461727473736c2e636f6d2f73667363612e637274305b0603551d1f0454305230 EAP-Message = 0x27a025a0238621687474703a2f2f7777772e737461727473736c2e636f6d2f73667363612e63726c3027a025a0238621687474703a2f2f63726c2e737461727473736c2e636f6d2f73667363612e63726c3081800603551d20047930773075060b2b0601040181b5370102013066302e06082b060105050702011622687474703a2f2f7777772e737461727473736c2e636f6d2f706f6c6963792e706466303406082b060105050702011628687474703a2f2f7777772e737461727473736c2e636f6d2f696e7465726d6564696174652e706466300d06092a864886f70d010105050003820201002109493ea5886ee00b8b48da314d8ff75657a2e1d3 EAP-Message = 0x6257e9b556f38545753be5501f048be6a05a3ee700ae85d0fbff200364cbad02e1c69172f8a34dd6dee8cc3fa18aa2e37c37a7c64f8f35d6f4d66e067bdd21d9cf56ffcb302249fe8904f385e5aaf1e71fe875904dddf946f74234f745580c110d84b0c6da5d3ef9019ee7e1da5595be741c7bfc4d144fac7e55477d7bf4a50d491e95e8f712c1ccff76a62547d0f37535be97b75816ebaa5c786fec5330afea044dcca902e3f0b60412f630b1113d904e5664d7dc3c435f7339ef4baf87ebf6fe68884472ead207c669b0c1a18bef1749d761b145485f3b2021e95bb2ccf4d7e931f50b15613b7a94e3ebd9bc7f94ae6ae3626296a8647cb887f39932 EAP-Message = 0x7e92a252bebbf865 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053eee211cd2358f2aa5aaaf3fc2 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 33341, id=196, length=231 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053eee211cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020400061900 Message-Authenticator = 0x3842e104ca596ede64f0b0be858ecbeb NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 196 to 192.168.13.4 port 33341 EAP-Message = 0x010503fc1940cfc9f230fc8bc1c2a696d75f89e15c3480f58f47072fb491bfb1a27e5f4b5ad05b9f248605515a690365434971c5e06f94346bf61bd8a9b04c7e53eb8f48dfca33b548fa364a1a53a6330cd089cd4915cd89313c90c072d7654b52358a461144b93d8e2865a63e799e5c084429adb035112e214eb8d2e7103e5d8483b3c3c2e4d2c6fd094b7409ddf1b3d3193e800da20b19f038e7c5c2afe223db61e29d5c6e2089492e236ab262c145b49faf8ba7f1223bf87de290d07a19fb4a4ce3d27d5f4a8303ed27d6239e6b8db459a2d9ef6c8229dd75193c3f4c108defbb7527d2ae83a7a8ce5ba70007cd308207c9308205b1a00302010202 EAP-Message = 0x0101300d06092a864886f70d0101050500307d310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312b3029060355040b1322536563757265204469676974616c204365727469666963617465205369676e696e6731293027060355040313205374617274436f6d2043657274696669636174696f6e20417574686f72697479301e170d3036303931373139343633365a170d3336303931373139343633365a307d310b300906035504061302494c31163014060355040a130d5374617274436f6d204c74642e312b3029060355040b1322536563757265204469676974616c20436572746966696361746520 EAP-Message = 0x5369676e696e6731293027060355040313205374617274436f6d2043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a0282020100c188db09bc6c467c789f957bb53390f27262d6c1362022245ecee977f2430aa20664a4cc8e36f838e623f06e6db13cdd72a3851ca1d33db4332bd32faffeeab0415967b6c4067d0a9e7485d6794c80377adf39055259f7f41b4643a4d28585d2c371f3756234ba2c8a7f1e8feeed34d011c796cd523dba33d6dd4dde0b3b4a4b9fc2262ffab5161c723577ca3c5de6cae1268b1a36765c01db741425feedb5a0880fdd78ca2d1f079730 EAP-Message = 0x012d7279fa46d6132aa8b9a6ab83491de5f2efdde4018e180a8f6353168562a90e193accb566a6c26b7407e42be1763eb46dd8f644e173621f3bc4bea05356256c5109f7aaabcabf76fd6d9bf39ddbbf3d66bc0c56aaaf9848953a4bdfa75850d93875a95bea430c02ff99ebe86c4d705b29659cddaa5dccaf0131ec0cebd28de8ea9c7be66ef727660c1a48d76e42e33fde213e7be10d70fb63aaa86c1a54b45c257ac9a2c98b16a6bb2c7e175e054d586e121d01ee12100dc6327f18fffcf4facd6e91e83649be1a48698bc2964d1a12b26917c10a90d6fa792248bfba7b69f870c7fa7a37d8d80dd2764f57ff90b7e391d2ddefc260b7673addfeaa EAP-Message = 0x9cf0d48b7f7222ce Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053ee9201cd2358f2aa5aaaf3fc2 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 40019, id=197, length=231 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053ee9201cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020500061900 Message-Authenticator = 0x1c4af62fc26823cf08d71d58cd5e3b37 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 197 to 192.168.13.4 port 40019 EAP-Message = 0x010603fc1940c69f97b6f8af8aa010a8d9fb18c6b6b55c523c89b6192a73010a0f03b31260f27a2f81dba36eff263097f58bdd8957b6ad3db3af2bc5b77602f0a5d62b9a86142a72f6e3338c5d094b13dfbb8c7413524b0203010001a38202523082024e300c0603551d13040530030101ff300b0603551d0f0404030201ae301d0603551d0e041604144e0bef1aa4405ba517698730ca346843d041aef230640603551d1f045d305b302ca02aa0288626687474703a2f2f636572742e7374617274636f6d2e6f72672f73667363612d63726c2e63726c302ba029a0278625687474703a2f2f63726c2e7374617274636f6d2e6f72672f73667363612d EAP-Message = 0x63726c2e63726c3082015d0603551d2004820154308201503082014c060b2b0601040181b5370101013082013b302f06082b060105050702011623687474703a2f2f636572742e7374617274636f6d2e6f72672f706f6c6963792e706466303506082b060105050702011629687474703a2f2f636572742e7374617274636f6d2e6f72672f696e7465726d6564696174652e7064663081d006082b060105050702023081c330271620537461727420436f6d6d65726369616c20285374617274436f6d29204c74642e30030201011a81974c696d69746564204c696162696c6974792c2072656164207468652073656374696f6e202a4c6567616c204c EAP-Message = 0x696d69746174696f6e732a206f6620746865205374617274436f6d2043657274696669636174696f6e20417574686f7269747920506f6c69637920617661696c61626c6520617420687474703a2f2f636572742e7374617274636f6d2e6f72672f706f6c6963792e706466301106096086480186f8420101040403020007303806096086480186f842010d042b16295374617274436f6d20467265652053534c2043657274696669636174696f6e20417574686f72697479300d06092a864886f70d01010505000382020100166c99f4660c34f5d0855e7d0aecda104e381c5edfa625054b9132c1e83bf13ddd44095b07498a29cb6602b7b19af72598 EAP-Message = 0x093c8e1be1dd36872b4bbb68d339663da026c7f239911d51ab827b7ed5ce5ae4e2035770699708f95e58a60adf8c069a451616380a5e57f662c77a0205e6bc1eb5f29ef4a92983f8b214e36e288744c3901ade38a93cac434d6445cedd28a95cf2737b04f817e8abb1f32e5c646e73313a12b8bcb311e47d8f81519a3b8d89f44d93667b3c03edd39a1d9af36550f5a0d0759f2faff0ea824398f8699c8979c4438e4672e3643612aff7251e388990777ec36b6ab9c3cb444bac78908be7c72c1e4b1144c8345227cd0a5d9f85c189d51a78f295105332dd80846675d9b56828fb612ebe84a838c0991286a51e6764ad062e2fa97085c7960f7c8965f5 EAP-Message = 0x8e43540eabdda580 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053ee8231cd2358f2aa5aaaf3fc2 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 41337, id=198, length=231 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053ee8231cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020600061900 Message-Authenticator = 0xe253ac1dbf0e01f0521a1e3b4c1374c6 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 198 to 192.168.13.4 port 41337 EAP-Message = 0x010702291900399460c034c996702ca312f51f487bbd1c7e6bb79d90f4223baef8fc2acafa8252a0efaf4b5593ebc1b5f0228bac344e262204a1872c754ab7e57d13d7b80c64c036d2c92f86128c2309c11b823b7349a36a578794e5d678c5994363e34de0772de165997269041a4709e60f015624fb1fbf0e79a9582eb9c409017e95ba6d00063eb2ea4a1039d8d02bf5bfec75bf9702c5091b08dc5537e281fb3784436220cae7564b65eafe6cc1249324a134eb05ff9a22ae9b7d3ff165510aa6306ab3f4881c800dfc728ae8835e160301014b0c00014703001741047e3580856cd5edf4f4abefd63bc85b6423cda233a8c0e45c47488bbcaeb217 EAP-Message = 0x2762be19884aa51fca0b9def15c868fb9c545b3700c30cc336d2abcfde87c2dece01003b878453bd62f496364a78ae88dcc832848ec534d060e2343af9f1f5f688b2c0cea2f2655534e52313738765fa800db99a33d1a7e5f58a54370f08bf9cb77a29a6ff09ceb6ba694b8ab033c3ee7bb307d4fe058d8cc19fb9287c950782d6d9450b1e93e3a8f1e1f64c8b5ed98e86524362d0ab4ca3551bd32d606eee37e1d33a73916fbf3a87f1f2fa21175e351f8227a2253dbddbac3ac6d55b5a279ddef8d82f8e11e7e6975f71fed931032f566e47e2d62d3b2e1a83a8c0ec2ada6559f4f659b372c6a8e3ff80f072ea5a4af4fa612bd20857dbb419130348 EAP-Message = 0x063cd372cf67ce5d60124666927a47f1eabd6e2d4ddd73740223398bb4e53ffc949610d302d516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053eeb221cd2358f2aa5aaaf3fc2 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 52983, id=199, length=369 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053eeb221cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020700901980000000861603010046100000424104058b9c5c1242b8575b45d5e832a09f6407a3b4b53375341b836b71ae6c439188dacd300428bfe2b83d3ae800551117332848d6a2bf086a011017ba361695109614030100010116030100306187693e81ba7869921c7b270631a94f20814177db82f30fc1546cf26b8d2f96140309976b5a0c5f023bcbc131e10994 Message-Authenticator = 0x83f38d62342a7f24718fbcab145767dc NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 7 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 134 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 199 to 192.168.13.4 port 52983 EAP-Message = 0x01080041190014030100010116030100308cc8c199f323cc041f68e63f8a2f12b585c01804d096eee279062366279d8feee13fd3dfdb508487fbd475dbed8236dc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053eea2d1cd2358f2aa5aaaf3fc2 Finished request 7. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 60602, id=200, length=231 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053eea2d1cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020800061900 Message-Authenticator = 0x475e745cc00cf27b19b89a29ca12c17b NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 8 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 200 to 192.168.13.4 port 60602 EAP-Message = 0x0109002b19001703010020374e020851e52025f5d84f795b804a0a630e889fb780a25f3d880e1dde84c467 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053ee52c1cd2358f2aa5aaaf3fc2 Finished request 8. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 54334, id=201, length=305 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053ee52c1cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x0209005019001703010020544f2f672ecbb7e80643c59adcf0eae044e137cbc08440550e933464a65dacf517030100204a4b03253c233a652a1f6319ab1f1efe70dfd3004b9b3167212592ee5e5a5111 Message-Authenticator = 0x4eeadf3eeacefc6d290fe9e6949a9434 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - cleaver [peap] Got inner identity 'cleaver' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0209000c01636c6561766572 server { [peap] Setting User-Name to cleaver Sending tunneled request EAP-Message = 0x0209000c01636c6561766572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "cleaver" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} [eap] EAP packet type response id 9 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 175 ++[files] returns ok [sql] expand: %{User-Name} -> cleaver [sql] sql_set_user escaped user --> 'cleaver' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'cleaver' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'cleaver' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='cleaver' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Session-Timeout := 1800 EAP-Message = 0x010a00211a010a001c106f35422b2de0227f2c2b8d732d233bf0636c6561766572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c05f3034c0fe9a96e66b7b13f9be167 [peap] Got tunneled reply RADIUS code 11 Session-Timeout := 1800 EAP-Message = 0x010a00211a010a001c106f35422b2de0227f2c2b8d732d233bf0636c6561766572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c05f3034c0fe9a96e66b7b13f9be167 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 201 to 192.168.13.4 port 54334 EAP-Message = 0x010a004b19001703010040dc69c9263fc56ccb7d790c344b9076897269cf3715611e19ac8d357005f9bfa3cf33e84873ed6d12b96614786b43c80aab41e1a64f43db1bc9076c6d597ca674 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053ee42f1cd2358f2aa5aaaf3fc2 Finished request 9. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 46152, id=202, length=369 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053ee42f1cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020a0090190017030100202617cdd5e2cad6ab75d32a3c9c05c2d6d47e25af08b8d5abed9d06dd2a9649271703010060722908436bf9adae2c84e374bda4f228074e64be92d97421d081fd02c6c219bac6c1372d4579b41b5c85e1b68e9d51b2aa5dbdce53c8ec7af5aeccffa7aa9efeea3e094ff87d46dc35e63f1748b9fc495d89a59cc80b8984a004bc91ab59dcc0 Message-Authenticator = 0x24d078ce9aecea7e3ba0be5332d544c2 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 10 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00421a020a003d31610c5fb65f12ca5f9b3e38a96d0a16220000000000000000529d636d7c546dd5de8e76b5751ee13015ea1bfdcfa0ca5800636c6561766572 server { [peap] Setting User-Name to cleaver Sending tunneled request EAP-Message = 0x020a00421a020a003d31610c5fb65f12ca5f9b3e38a96d0a16220000000000000000529d636d7c546dd5de8e76b5751ee13015ea1bfdcfa0ca5800636c6561766572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "cleaver" State = 0x4c05f3034c0fe9a96e66b7b13f9be167 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} [eap] EAP packet type response id 10 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 175 ++[files] returns ok [sql] expand: %{User-Name} -> cleaver [sql] sql_set_user escaped user --> 'cleaver' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'cleaver' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'cleaver' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='cleaver' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: cleaver [mschap] Told to do MS-CHAPv2 for cleaver with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Session-Timeout := 1800 EAP-Message = 0x010b00331a030a002e533d36443735454438363231314442423730393235354437383530383330323446443046324236324139 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c05f3034d0ee9a96e66b7b13f9be167 [peap] Got tunneled reply RADIUS code 11 Session-Timeout := 1800 EAP-Message = 0x010b00331a030a002e533d36443735454438363231314442423730393235354437383530383330323446443046324236324139 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c05f3034d0ee9a96e66b7b13f9be167 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 202 to 192.168.13.4 port 46152 EAP-Message = 0x010b005b19001703010050cbb8af5543fab16b513a6374c93cc275f0680f64d183e2ec1bb7c71d3393b9c1331f0e67f02ee0b799d80940dc6a3d6f39c3bc96162323292ff0357a009f3acb32dbbb79735543a2f6897c0a2cd6c948 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053ee72e1cd2358f2aa5aaaf3fc2 Finished request 10. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 55110, id=203, length=305 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053ee72e1cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020b005019001703010020466fc6985c0987334d5c1acb554064d654956705af40cfc23f3587ecb3eb86941703010020de6fc4407f156d1dc4e9454d3d1da0627b69bb4748693f5caffb2a8caea79433 Message-Authenticator = 0x6aecd12ca46c2ed0f2136abb95e278e1 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 11 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020b00061a03 server { [peap] Setting User-Name to cleaver Sending tunneled request EAP-Message = 0x020b00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "cleaver" State = 0x4c05f3034d0ee9a96e66b7b13f9be167 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} [eap] EAP packet type response id 11 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 175 ++[files] returns ok [sql] expand: %{User-Name} -> cleaver [sql] sql_set_user escaped user --> 'cleaver' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'cleaver' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 2 , fields = 5 [sql] User found in radcheck table [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'cleaver' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [sql] expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='cleaver' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok # Executing section session from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group session {...} [sql] expand: %{User-Name} -> cleaver [sql] sql_set_user escaped user --> 'cleaver' [sql] expand: SELECT COUNT(*) FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime IS NULL -> SELECT COUNT(*) FROM radacct WHERE UserName='cleaver' AND AcctStopTime IS NULL rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok Login OK: [cleaver] (from client mikrotik03 port 0 cli CC-FA-00-C6-4A-A6 via TLS tunnel) WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel } # server inner-tunnel [peap] Got tunneled reply code 2 Session-Timeout := 1800 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xe21015a00b64a87e6e02fc7698500f91 MS-MPPE-Recv-Key = 0xe1a2a8b724972b4ba2b9f8e7f3790e3b EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "cleaver" [peap] Got tunneled reply RADIUS code 2 Session-Timeout := 1800 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xe21015a00b64a87e6e02fc7698500f91 MS-MPPE-Recv-Key = 0xe1a2a8b724972b4ba2b9f8e7f3790e3b EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "cleaver" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later ++[eap] returns handled Sending Access-Challenge of id 203 to 192.168.13.4 port 55110 EAP-Message = 0x010c002b190017030100204851eb10a5682951f8da0bb7072b7681914648dc4746b0eff3b6139ed68f542e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25053ee6291cd2358f2aa5aaaf3fc2 Finished request 11. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.13.4 port 57335, id=204, length=305 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "cleaver" State = 0xed25053ee6291cd2358f2aa5aaaf3fc2 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Calling-Station-Id = "CC-FA-00-C6-4A-A6" Called-Station-Id = "D4-CA-6D-F6-55-C1:datamax" EAP-Message = 0x020c005019001703010020bc9a7815ca619d39bb6d1a7f30cfa319318f6da9a6996c50ecb209f5370b8e8717030100201fe12a0976816a84d7eff293d9ddd18b4a74843b7044fe0c52fe2dd5a74dc98e Message-Authenticator = 0x7841be02d6f1e4c97d52e2e9ce37412f NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.13.4 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop [eap] EAP packet type response id 12 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept Session-Timeout := 1800 User-Name = "cleaver" [eap] Freeing handler ++[eap] returns ok Login OK: [cleaver] (from client mikrotik03 port 0 cli CC-FA-00-C6-4A-A6) WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /etc/freeradius/sites-enabled/default Sending Access-Accept of id 204 to 192.168.13.4 port 57335 Session-Timeout := 1800 User-Name = "cleaver" MS-MPPE-Recv-Key = 0x752ff9b12af057a8ec7c4ec3ced5ab073e0f17efc28a92402da2e08eeb2f1751 MS-MPPE-Send-Key = 0x20f0a96db29944a3869a77df7fd6f6eeb84d2a7a62dbcd31fa441e93dcbc237d EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 12. Going to the next request Waking up in 4.7 seconds. rad_recv: Accounting-Request packet from host 192.168.13.4 port 51157, id=205, length=153 Service-Type = Framed-User NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 User-Name = "cleaver" Acct-Session-Id = "82000027" Acct-Multi-Session-Id = "D4-CA-6D-F6-55-C1-CC-FA-00-C6-4A-A6-82-00-00-00-00-00-00-1F" Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Identifier = "MikroTik" Acct-Delay-Time = 0 NAS-IP-Address = 192.168.13.4 # Executing section preacct from file /etc/freeradius/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port-Id = "wlan1",Client-IP-Address = 192.168.13.4,NAS-IP-Address = 192.168.13.4,Acct-Session-Id = "82000027",User-Name = "cleaver"' [acct_unique] Acct-Unique-Session-ID = "e27c8233063681bb". ++[acct_unique] returns ok ++[files] returns noop # Executing section accounting from file /etc/freeradius/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> 192.168.13.4 [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.13.4/detail-20140725 [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.13.4/detail-20140725 [detail] expand: %t -> Fri Jul 25 10:05:00 2014 ++[detail] returns ok [sql] expand: %{User-Name} -> cleaver [sql] sql_set_user escaped user --> 'cleaver' [sql] expand: %{NAS-Port} -> [sql] ... expanding second conditional [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> cleaver attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 205 to 192.168.13.4 port 51157 Finished request 13. Cleaning up request 13 ID 205 with timestamp +10 Going to the next request Waking up in 4.6 seconds. -- DEBUG -- I need the Calling-Station-Id in radacct for stale records cleaning and it's important for me that this value is inserted correctly. As you can see, the Calling-Station-Id = "CC-FA-00-C6-4A-A6" is passed to the RADIUS server in Access-Request and INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, seems correct except that it seems truncated. I guess my problem is due to a configuration mistake, but I have not been able to locate it so far. Any suggestions? Thanks, Stoycho

2 2

RE: Capturing a failure from EAP
by Franks Andy (RLZ) IT Systems Engineer 25 Jul '14

25 Jul '14

>> No. You *can* override EAP. See the debug output. Hi Log says : .. (8) ERROR: eap : Failed continuing EAP TLS (13) session. EAP sub-module failed (8) eap : Failed in EAP select (8) [eap] = invalid (8) if (!ok) (8) if (!ok) -> TRUE (8) if (!ok) { (8) update control { (8) EXPAND %{Module-Failure-Message} (8) --> eap_tls: SSL says error 10 : certificate has expired (8) Debug-RejectInformation := "eap_tls: SSL says error 10 : certificate has expired" (8) } # update control = noop (8) [ok] = ok (8) } # if (!ok) = ok (8) if (reject) (8) if (reject) -> FALSE (8) if (invalid) (8) if (invalid) -> FALSE (8) } # if (control:ClientReject == 0 ) = ok (8) } # Auth-Type eap = ok (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) Post-Auth-Type REJECT { .. It's interesting that my if (invalid) doesn't work, but that's probably not the issue. I'm doing if (!ok) { update control { Debug-RejectInformation := "%{Module-Failure-Message}" } ok } The ok in another module doesn't seem to stop the auth taking the "ok" we've pushed, for example here it's failed ntlm auth: [ntlm_auth] = reject (0) if (reject) (0) if (reject) -> TRUE (0) if (reject) { (0) update control { (0) ClientReject := 1 (0) } # update control = noop (0) [ok] = ok (0) } # if (reject) = ok (0) } # Auth-Type ntlm_auth = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { Here I just do this : if (reject) { update control { ClientReject := 1 } ok } .. and the auth complete with success. Guess I'm missing something! Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 25 July 2014 13:13 To: FreeRadius users mailing list Subject: Re: Capturing a failure from EAP Franks Andy (RLZ) IT Systems Engineer wrote: > Can someone just confirm whether I can override the module codes in > the eap auth module? Yes. EAP is a module just like anything else. > I’m trying And... what does the debug log show? > I know it looks odd, but I’m trying to override the reject packet with > an accept but with attributes that force the client into a specific > remuneration vlan / policy on the wireless controller. That's impossible. The design of WiFi and how it works with EAP makes that impossible. > Maybe this is by design. I can override all the other modules ok just > not eap. No. You *can* override EAP. See the debug output. The supplicant and wireless controller will refuse to communicate when you override EAP. But that has nothing to do with FreeRADIUS. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0