- Freeradius-Users - lists.freeradius.org

Re: Fwd: Dynamic VLAN assignment for Active Directory Users on Freeradius
by Alan DeKok 02 Jul '14

02 Jul '14

Bomongo Esse wrote: > Thank you Alan, > > Just to tell you that the solution (freeradius) works well with Active > Directory. I can authenticate Active Directory users through Freeradius. > The main issue i encounter is to get the users assigned dynamically > VLAN. I saw in a forum that we need to setup the file > /etc/raddb/modules/ldap that what i did. > > The line 68 of the users file contains this : > > DEFAULT > Ldap-Group = "CN=group1,DC=rasad,DC=local", > Tunnel-Type = "VLAN", > Tunnel-Medium-Type = "IEEE-802", > Tunnel-Private-Group-ID = "1" Which isn't in the correct format. I told you what the correct format is. You need to use it. If you're not going to follow instructions, you need to stop asking questions on this list. > I would like to make sure that we can dynamically assign VLAN to Active > Directory users through Freeradius. You've said that. I understand. Do you understand my response? > The authentication without Dynamic VLAN works well. > What should i modify on the file /etc/raddb/modules/ldap ? Did I tell you to modify the contents of that file? > Below is the content of the file : Which you have already posted. > What should be modified again once Active Directory works well with > Freeradius without Dynamic VLAN? I'm sure I already answered that question. If you're going to ignore my responses, and keep posting the same question... you should realize that it's rude. All you're doing is being annoying. Alan DeKok.

1 0

Re: crash freeradius
by Mitch Yackobeck 02 Jul '14

02 Jul '14

5 6

crash freeradius
by Arnaud . 02 Jul '14

02 Jul '14

Hello there, I had a problem with my server that hosts a small radius server with a captive portal. I rebooted the freeradius service and it started to work again against by peeling logs I really do not see the cause! Here are freeradius logs: Thu Jun 26 21:56:19 2014 : Error: rlm_radutmp: Logout for NAS localhost port 17, but no Login record Thu Jun 26 21:59:54 2014 : Error: rlm_radutmp: Logout for NAS localhost port 31, but no Login record Thu Jun 26 22:08:07 2014 : Error: rlm_radutmp: Logout for NAS localhost port 3, but no Login record Thu Jun 26 22:08:34 2014 : Error: rlm_radutmp: Logout for NAS localhost port 30, but no Login record Thu Jun 26 22:15:51 2014 : Error: rlm_radutmp: Logout for NAS localhost port 27, but no Login record Thu Jun 26 22:21:58 2014 : Error: rlm_radutmp: Logout for NAS localhost port 22, but no Login record Fri Jun 27 09:11:43 2014 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Fri Jun 27 09:11:43 2014 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Fri Jun 27 09:11:43 2014 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Fri Jun 27 09:11:43 2014 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Fri Jun 27 09:11:43 2014 : Info: Ready to process requests. The service has planted resumed at 22:21 p.m. ET 9:11 when I rebooted freeradius. Do you have any idea what happened? I would also like to disable archiving in radwtmp because I ustilise sql how is it done?

2 9

Re: PAP Authentication Question
by Mitch Yackobeck 01 Jul '14

01 Jul '14

1 0

PAP Authentication Question
by Derek Bolichowski 01 Jul '14

01 Jul '14

Hi there, We are currently using FreeRadius to authenticate ADSL modems at customer locations to our ADSL service via PAP Auth. We have had this working for some time now. Recently, I have noticed a number of Auth Login Incorrect entries. It seems that whenever a modem tries to authenticate using username(a)realm.com<mailto:username@realm.com> / somepassword, we get a RADIUS auth request one second before with 'realm.com' / radius-secret. Example seen here: rad_recv: Access-Request packet from host 192.168.9.6 port 1645, id=37, length=214 User-Name = "ourrealm.com" User-Password = "secret" Calling-Station-Id = "GigabitEthernet 5/0/4.4210116:421-116#587310171#804 GE1 WNDSON1431W-WNDSON1434W##pppoe 00:24:c9:90:ca:72#" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 693 NAS-Port-Id = "Uniq-Sess-ID693" Service-Type = Dialout-Framed-User NAS-IP-Address = 192.168.9.6 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.9.6/auth-detail-20140630 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.9.6/auth-detail-20140630 [auth_log] expand: %t -> Mon Jun 30 19:44:09 2014 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ourrealm.com", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [ourrealm.com/secret] (from client cisco-router port 693 cli GigabitEthernet 5/0/4.4210116:421-116#587310171#804 GE1 WNDSON1431W-WNDSON1434W##pppoe 00:24:c9:90:ca:72#) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ourrealm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 37 to 192.168.9.6 port 1645 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.9.6 port 1645, id=38, length=226 Framed-Protocol = PPP User-Name = "validuser(a)ourrealm.com" User-Password = "validpassword" Calling-Station-Id = "GigabitEthernet 5/0/4.4210116:421-116#587310171#804 GE1 WNDSON1431W-WNDSON1434W##pppoe 00:24:c9:90:ca:72#" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 693 NAS-Port-Id = "Uniq-Sess-ID693" Service-Type = Framed-User NAS-IP-Address = 192.168.9.6 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.9.6/auth-detail-20140630 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.9.6/auth-detail-20140630 [auth_log] expand: %t -> Mon Jun 30 19:44:10 2014 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "ourrealm.com" for User-Name = "validuser(a)ourrealm.com" [suffix] No such realm "ourrealm.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry validuser(a)ourrealm.com at line 87 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "validpassword" [pap] Using clear text password "validpassword" [pap] User authenticated successfully ++[pap] returns ok Login OK: [validuser(a)ourrealm.com/validpassword] (from client cisco-router port 693 cli GigabitEthernet 5/0/4.4210116:421-116#587310171#804 GE1 WNDSON1431W-WNDSON1434W##pppoe 00:24:c9:90:ca:72#) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/192.168.9.6/reply-detail-20140630 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.9.6/reply-detail-20140630 [reply_log] expand: %t -> Mon Jun 30 19:44:10 2014 ++[reply_log] returns ok ++[exec] returns noop Sending Access-Accept of id 38 to 192.168.9.6 port 1645 Framed-IP-Address = 10.40.100.82 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 37 with timestamp +32 Cleaning up request 1 ID 38 with timestamp +33 Ready to process requests.

2 1

authentication eap-sim to AP is failed
by Muhammad Hasan 30 Jun '14

30 Jun '14

hi, I tried eap-sim authentication on freeradius-server 2.2.0, I followed the steps from https://code.google.com/p/seek-for-android/wiki/EapSimAka I've added lines on the clients.conf client 192.168.1.0/24 { secret = eap-sim shortname = eap-sim } In the config directory /etc/freeradius/modules create a file sim_files with following content: sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } and then I made the simtrilplets.dat with the same format In the config file default add sim_files directly before eap { ok = return } IP address for AP is 192.168.1.1/24 and I've set up the IP server radius on AP too but I always failed when I was tried to connect AP. This is the log from freeradius -X server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sim_files Module: Instantiating module "sim_files" from file /etc/freeradius/modules/sim_files sim_files { simtriplets = "/etc/freeradius/simtriplets.dat" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-Rand1" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-SRES1" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-KC1" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-Rand2" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-SRES2" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-KC2" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-Rand3" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-SRES3" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items [/etc/freeradius/users]:205 WARNING! Check item "EAP-Sim-KC3" found in reply item list for user " 1510101425520064(a)wlan.mnc010.mcc510.3gppnetwork.org". This attribute MUST go on the first line with the other check items reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 54196 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=132, length=171 User-Name = "eap-sim" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "742f68c46785" NAS-Identifier = "Realtek Access Point. 8186" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c016561702d73696d Message-Authenticator = 0x3fc1d6636e4f6270a431b3458ca06ff5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eap-sim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi eap-sim: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 132 to 192.168.1.1 port 2049 EAP-Message = 0x01010016041094f4cc2024e119239db0e6579b1f5000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x070274880703701220c8065c4d562119 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=133, length=177 User-Name = "eap-sim" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "742f68c46785" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0x070274880703701220c8065c4d562119 Message-Authenticator = 0x12c4442b5144c87463b38e4a0e7af81c # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eap-sim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi eap-sim: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 133 to 192.168.1.1 port 2049 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0702748806006d1220c8065c4d562119 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=134, length=276 User-Name = "eap-sim" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "742f68c46785" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0202006919800000005f160301005a01000056030153ae915307b8e4203173c673c2b25d2a4e6b9186ba795b25c232a4cb0b2d58f6000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 State = 0x0702748806006d1220c8065c4d562119 Message-Authenticator = 0xc9f772337a828d723bc827c712d5b361 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eap-sim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi eap-sim: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 2 length 105 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 95 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 005a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 01a7], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 134 to 192.168.1.1 port 2049 EAP-Message = 0x010301f1190016030100310200002d030153ae915b02a6f72ded54f9c6f1fd36d34278cc2efd025157791742c03da6416600002f000005ff0100010016030101a70b0001a30001a000019d3082019930820102020900d8625c5bc9f7dcdc300d06092a864886f70d01010505003011310f300d060355040313067562756e7475301e170d3134303631373231303330305a170d3234303631343231303330305a3011310f300d060355040313067562756e747530819f300d06092a864886f70d010101050003818d0030818902818100c374d82d8a75bcc5b948020edb08c1d5bb3c880070ff573d4523b4d27afccc380eef50e010727c0860217182c1 EAP-Message = 0xd1608f21ed0adeeb17c1d6a6946c4fdd99876fc1fba94da1bbe1816ff176f1d46caa3fc5fb936f37fae2104213f40a87605b7ce29826aaceab75b9e91aeafa898c51252971bd690f700e5e509bfc4f0cbc51390203010001300d06092a864886f70d0101050500038181003a6ef824822c58464dcccacd831ab2cbe98a01f15f28e0047fbdf16fcf265a40ba086ca72e426e13e28e1e3f7df57ad6b87895651f888580feef1a11f84a74b55578d7e014d31eaeaa75c8d38fa0bfd0f5be3f80b7dbd5c8f0c07111d3ed7790338674c3ef6490db3ac40f20ddf2e6e011c0c4a0520c6d39fec268f451c6555716030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0702748805016d1220c8065c4d562119 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2049, id=135, length=188 User-Name = "eap-sim" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 Called-Station-Id = "004f62248f98" Calling-Station-Id = "742f68c46785" NAS-Identifier = "Realtek Access Point. 8186" NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0203001119800000000715030100020230 State = 0x0702748805016d1220c8065c4d562119 Message-Authenticator = 0xe4144d90ba1800e0b07281e4745189d8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eap-sim", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi eap-sim: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 3 length 17 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 7 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> eap-sim attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 135 to 192.168.1.1 port 2049 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 132 with timestamp +8 Cleaning up request 1 ID 133 with timestamp +8 Cleaning up request 2 ID 134 with timestamp +8 Waking up in 1.0 seconds. Cleaning up request 3 ID 135 with timestamp +8 Ready to process requests. where is the problem? I really new on freeradius thank you -- Best Regards,

3 5

Re: authentication eap-sim to AP is failed
by Mitch Yackobeck 30 Jun '14

30 Jun '14

1 0

Proxy: No Outstanding Request
by rvw＠i2k.com 30 Jun '14

30 Jun '14

Running Radius 2.1.6. I am proxying to the server x.x.x.x shown below and I keep getting these messages in radius.log Mon Jun 30 14:02:08 2014 : Proxy: No outstanding request was found for reply from host x.x.x.x port 1648 - ID 51 Mon Jun 30 14:02:10 2014 : Proxy: No outstanding request was found for reply from host x.x.x.x port 1648 - ID 81 Mon Jun 30 14:02:17 2014 : Proxy: No outstanding request was found for reply from host x.x.x.x port 1648 - ID 128 What causes this? How is it fixed? Thanks, RonVW

2 1

users file syntax
by Krzysztof Grobelak 30 Jun '14

30 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello List, Recently i set up another freeRADIUS server with version 3.0.3. I configured FR to use Active Directory as backend and use ntlm_auth to authenticate users. Then, after successful authentication FR scans the users file to check for attributes for given user. Therefore the users file looked as follows: user1 Attr-One = "Bar", Attr-Two = "Foo", Attr-Three = "Baz" The Cleartext-Password is missing from the same line as username because it is not needed there since user was already authenticated against AD. This syntax does not work in the 3.0.3 version. Radiusd -X stops with folowing error: /usr/local/etc/raddb/users.login.network.devices[17]: Parse error (check) for entry user1: Invalid vendor name in attribute name "" Is this intended change and if yes what should be the proper syntax now. Regards, Krzysztof -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTsSoiAAoJEM/U1HoKR/xk1T8H/1ZdqFmkNmjhLG+8FwoZOb70 1h5ghhjfmAugbLcQX5gDrYcLloZ+TLA0twNjAVvrpVgKc0fVto1X/pnqkMGLgqza p0YUdNlGiQ1h1MO4gbIXZT0HTBMqvCkWli7pyY5otMnLQv0qlnKfZVOxW1p/rNPg emo/M+3fMroTLu0dIAe7WuCmcKPfT4nI7Lm3EZR8mDqjekiyi2RbkAZ3PIUQejBp CZeCO+/W0DGP777cyKKuG1eKkUGKBwAT/YGWFWqS+U5GmUss/tEmXxm1mw5s3aiV hL3qPLl7YdxXJuFQ1RrPWFLxh0SP1dDbpdlpf/m3fbbm5vugEdnRRcVgU62tQhA= =0/Yr -----END PGP SIGNATURE----- Airspeed Telecom

2 2

Google Authenticator with OpenVPN and FreeRadius
by Kevin MELKA 28 Jun '14

28 Jun '14

Hello everybody, Could you explain me how do i do to use Google Authenticator with OpenVPN and FreeRadius ? I find any things in Internet but nothing interesting. I use Ubuntu 12.04 and i use this packet : libpam-google-authenticator 20110413.68230188bdc7-1.1 Thanks you in advance. Have a nice day, greenkev

1 0