- Freeradius-Users - lists.freeradius.org

freeradius installation question
by Bryan Totten 16 Jun '14

16 Jun '14

Installed freeradius on ubuntu 12.04. I was able to start in debug mode the first time however now i am getting error message stating: /var/run/freeradius/freeradius.pid not found... any help would be greatly appreciated! tottenavl

2 1

Winbind issues in Ubuntu 14.04
by Arran Cudbard-Bell 15 Jun '14

15 Jun '14

So no one else wastes a couple of hours of their lives wondering why ntlm_auth is failing due to what appear to be permissions issue. In the version of samba4 installed with Ubuntu 14.04 (4.1.6) the default location of the winbinddd_privileged directory appears to be /var/lib/samba. The upstart script however, still has it in /var/run/samba/ (it may have changed), and does a lovely job of masking the problem by creating the winbindd_privileged directory there on start: pre-start script test -x /usr/sbin/winbindd || exit 0 mkdir -p /var/run/samba/winbindd_privileged chgrp winbindd_priv /var/run/samba/winbindd_privileged chmod 0750 /var/run/samba/winbindd_privileged end script Special shout outs go to the samba project for writing a utility with the most useless debugging output ever: Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)' (57) mschap : External script failed (57) ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001) (57) ERROR: mschap : MS-CHAP2-Response is incorrect and whoever decided to disable the init.d script on upstart enabled systems by adding: case "$1" in start) if init_is_upstart; then exit 1 fi Lovely. Bug reported here for winbindd_privileged: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1330220 Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2

Client is using MSCHAPv2 for %s, we need NT-Password
by Matthew Berry 14 Jun '14

14 Jun '14

Is this message merely informative, or does it indicate a problem? I'm attempting to debug my issue with something else and this is the only line I see that sounds like a warning/error prior to the rejection happening. From what I see in rlm_mschap.c, I would have seen a different message if the code could not either find a valid NT-Password attribute[1] or could not create one from a Cleartext-Password attribute[2]. Based on the comment left above the message > The old "mschapv2" function has been moved to > here It leads me to believe this line is informative only. (i.e., we need this attribute to be present, and unless you've seen otherwise it is). -Matt [1] https://github.com/FreeRADIUS/freeradius-server/blob/ec8c055b4c8e9358a08d51… [2] https://github.com/FreeRADIUS/freeradius-server/blob/ec8c055b4c8e9358a08d51…

2 4

Issues with building Freeradius on CentOS 6.5: need rlm_cache
by Brandon Jozsa 14 Jun '14

14 Jun '14

Hello, I've been trying to work through the issues and by searching high and low for solutions before turning to this users list. I'm sorry if this is a stupid question (I've seen worse though, so maybe I shouldn't feel bad). I have a very high need to use the rlm_cache module with Freeradius on CentOS 6.5. I'm trying to first us the statement: ----- snipped ----- authorize { if (!notfound) { update control { Proxy-To-Realm := "SOME_REALM" } } ----- snipped ----- which works GREAT alone...but I also want to use the cache function like so: ----- snipped ----- update control { Cache-Status-Only = 'yes' } cache if (notfound) { sql } update control { Cache-Status-Only := 'no' } cache ----- snipped ----- which doesn't work (obviously) because rlm_cache isn't included with 2.1.12, or so it seems anyway. My hope is (it is a hope anyway) that I can collect authN/authZ replies from an upstream radius server and cache them locally; thus building a mysql database of users access/privileges and let this run on an environment before cutting completely over to our new Freeradius setup. Again, I'm hoping it can work like this...getting rid of RSA and using LinOTP or MOTP would be so nice; it would be more flexible and user friendly, but I really need to collect authN and authZ in order to rebuild our massive user-base. My issue...CentOS, which is our "approved platform" (I'm rolling my eyes and giving air quotes), doesn't have a newer version of Freeradius other than 2.1.12. I think the rlm_cache modules are only included in 3.0.0 and higher, is that right? So, I started looking on how to build from source...and I found one; great news I thought!! Enter: http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources…. I thought this would save the day, but there are broken links for 3.0.0 and I am running into major issues; it just doesn't seem to work at all. I also tried to build it out, take the rlm_cache.so lib over to my 2.1.12 installation, but Freeradius barfed all over that little trick. What are my options here? I could really use some help. Any ideas?

7 15

Subject: Radcheck gives Accept but still moves onto Radgroupcheck
by Mike Poole 13 Jun '14

13 Jun '14

file /var/log/freeradius/radacct/sql-relay: No such file or directory Brent - The reject isn't coming from group check, it fails out when it tries to write to the sql-relay file that doesn't exist. You should turn off sql-relay or configure it. If part of the sql process fails (as I've been painfully doing here with my MT the last two days) the whole process will result in an Access Reject. Notice the reject comes directly after the statement above. Also, any time a "user found in radcheck" is sent, the next query will be processed. Mike Message: 4 Date: Wed, 11 Jun 2014 17:04:30 -0600 From: "Brent Wilkinson" <brent(a)air2data.com> To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Subject: Radcheck gives Accept but still moves onto Radgroupcheck Message-ID: <000601cf85c9$8104cd50$830e67f0$@com> Content-Type: text/plain; charset="us-ascii" I am setting up a new Radius server or a mikrotik hotspot system. I am getting a wierd issue that I have not been able to solve or find hints to what to do to fix it. I have setup the system with mysql. I see the radcheck happen and show it retrieved a record. ( I have verified the sql statments do actually pull something). I am not sending any reply so nothing is found in that table. At this point from what I understand in reading how the sql module works at this point it should send back a Access-Accept. Unfortunatly it does not and continues to do group checks and I end up with a reject. Hoping someone can give me a idea of what I need to look at or what I can read up more on to track the issue I am having down. Here is the debug: rad_recv: Access-Request packet from host 76.8.212.170 port 36910, id=78, length=189 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C:4B:D6:A5:CD:BF" Called-Station-Id = "10631" NAS-Port-Id = "ether2" User-Name = "1" NAS-Port = 2152726611 Acct-Session-Id = "80500053" Framed-IP-Address = 10.69.103.254 Mikrotik-Host-IP = 10.69.103.254 CHAP-Challenge = 0x95b4afa9e0e37e62da70a83197931d11 CHAP-Password = 0x21b4c5ed3e3175b1b7672103936286b74e Service-Type = Login-User WISPr-Logoff-URL = "http://10.69.100.1/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.99.163 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "1" with CHAP password [chap] Using clear text password "1" for user 1 authentication. [chap] chap user 1 authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> 1 [sql_log] expand: %{%{User-Name}:-DEFAULT} -> 1 [sql_log] sql_set_user escaped user --> '1' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('1', 'Chap-Password', 'Access-Accept', '2014-06-11 18:42:31'); [sql_log] expand: /var/log/freeradius/radacct/sql-relay -> /var/log/freeradius/radacct/sql-relay [sql_log] Couldn't open file /var/log/freeradius/radacct/sql-relay: No such file or directory ++[sql_log] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> 1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 78 to 76.8.212.170 port 36910 Waking up in 4.9 seconds. Cleaning up request 0 ID 78 with timestamp +6 Ready to process requests. Thanks Brent

1 0

too many "No EAP session matching state 0x…" with FR 3.0.x
by Michael Simon 13 Jun '14

13 Jun '14

Hi! After running FR 3.0.3 from GIT (FR 3.0.2 as well) for a while (a few hours) lots of “Error: rlm_eap (EAP): No EAP session matching state 0x…” appear in the log file. A restart of FR and the error messages are gone for the present. These requests come from RADIUS over TLS (radsec) clients explained in /etc/freeradius/sites-available/tls Is this a bug or a misconfiguration? Best wishes Michael Fri Jun 13 09:30:53 2014 : Auth: (10040) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:30:53 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x7c19d06a7714c91d Fri Jun 13 09:30:59 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x7c19d06a7714c91d Fri Jun 13 09:30:59 2014 : Auth: (10041) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:30:59 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x7c19d06a7714c91d Fri Jun 13 09:31:20 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:20 2014 : Auth: (10045) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:31:20 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:27 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:27 2014 : Auth: (10047) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:31:27 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:37 2014 : Auth: (10098) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 09:31:37 2014 : Auth: (10099) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67 via TLS tunnel) Fri Jun 13 09:31:37 2014 : Auth: (10100) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:31:38 2014 : Auth: (10101) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:32:18 2014 : Auth: (10152) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67 via TLS tunnel) Fri Jun 13 09:32:18 2014 : Auth: (10154) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:32:28 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x31cdab6e35cbb2ff Fri Jun 13 09:32:28 2014 : Auth: (10170) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:28 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x31cdab6e35cbb2ff Fri Jun 13 09:32:40 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:40 2014 : Auth: (10203) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:40 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:50 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:50 2014 : Auth: (10207) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:50 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:53 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:53 2014 : Auth: (10208) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:53 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:36:25 2014 : Auth: (10471) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 132 cli 68-A8-6D-0E-E4-CE via TLS tunnel) Fri Jun 13 09:36:25 2014 : Auth: (10472) Login OK: [user128(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 14088 cli 84-7A-88-75-92-4E via TLS tunnel) Fri Jun 13 09:36:25 2014 : Auth: (10473) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 132 cli 68-A8-6D-0E-E4-CE) Fri Jun 13 09:36:27 2014 : Auth: (10474) Login OK: [user128(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 14088 cli 84-7A-88-75-92-4E) Fri Jun 13 09:40:45 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x2acecbf92accd2dc Fri Jun 13 09:40:45 2014 : Auth: (10853) Login incorrect: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:40:45 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x2acecbf92accd2dc Fri Jun 13 09:40:48 2014 : Auth: (10876) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab via TLS tunnel) Fri Jun 13 09:40:48 2014 : Auth: (10877) Login OK: [user810(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:40:48 2014 : Auth: (10878) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:41:08 2014 : Auth: (10913) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:41:08 2014 : Auth: (10914) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0) Fri Jun 13 09:41:14 2014 : Auth: (10927) Login OK: [user810(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 0) Fri Jun 13 09:43:05 2014 : Auth: (11158) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:43:05 2014 : Auth: (11159) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0) Fri Jun 13 09:43:25 2014 : Auth: (11213) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:43:25 2014 : Auth: (11214) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0) Fri Jun 13 09:44:41 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xc147e16bc145f804 Fri Jun 13 09:44:41 2014 : Auth: (11385) Login incorrect: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:44:41 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xc147e16bc145f804 Fri Jun 13 09:44:46 2014 : Auth: (11422) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab via TLS tunnel) Fri Jun 13 09:44:46 2014 : Auth: (11423) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 09:44:46 2014 : Auth: (11424) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:44:56 2014 : Auth: (11445) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:17 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x77b7713e7ca66843 Fri Jun 13 09:45:17 2014 : Auth: (11503) Login incorrect: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:17 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x77b7713e7ca66843 Fri Jun 13 09:45:21 2014 : Auth: (11537) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab via TLS tunnel) Fri Jun 13 09:45:21 2014 : Auth: (11538) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 09:45:21 2014 : Auth: (11539) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:45:31 2014 : Auth: (11570) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:49 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x58b807b453a81e77 Fri Jun 13 09:45:49 2014 : Auth: (11605) Login incorrect: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:49 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x58b807b453a81e77 [RESTART FR] Fri Jun 13 09:53:23 2014 : Info: Signalled to terminate Fri Jun 13 09:53:23 2014 : Info: Exiting normally Fri Jun 13 09:53:23 2014 : Info: rlm_ldap (ldap): Closing connection (0) Fri Jun 13 09:53:24 2014 : Info: rlm_ldap (ldap): Opening additional connection (0) Fri Jun 13 09:53:24 2014 : Info: Loaded virtual server <default> Fri Jun 13 09:53:24 2014 : Info: Loaded virtual server default Fri Jun 13 09:53:24 2014 : Info: Loaded virtual server inner-tunnel Fri Jun 13 09:53:24 2014 : Info: Ready to process requests Fri Jun 13 09:53:25 2014 : Info: ... adding new socket auth+acct from client (192.168.71.138, 45129) -> (*, 2083, virtual-server=default) Fri Jun 13 09:53:26 2014 : Info: ... adding new socket auth+acct from client (192.168.71.134, 53659) -> (*, 2083, virtual-server=default) Fri Jun 13 09:53:46 2014 : Auth: (89) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 331 cli CC-3A-61-6C-9E-60 via TLS tunnel) Fri Jun 13 09:53:46 2014 : Auth: (90) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 331 cli CC-3A-61-6C-9E-60) Fri Jun 13 09:54:27 2014 : Auth: (159) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 142 cli 68-A8-6D-0E-E4-CE via TLS tunnel) Fri Jun 13 09:54:27 2014 : Auth: (160) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 142 cli 68-A8-6D-0E-E4-CE) Fri Jun 13 09:54:39 2014 : Auth: (183) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13302 cli CC-3A-61-6C-9E-60 via TLS tunnel) Fri Jun 13 09:54:39 2014 : Auth: (184) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13302 cli CC-3A-61-6C-9E-60) Fri Jun 13 09:55:34 2014 : Auth: (235) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 48802 cli cc3a.616c.9e60 via TLS tunnel) Fri Jun 13 09:55:34 2014 : Auth: (237) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 48802 cli cc3a.616c.9e60) Fri Jun 13 09:55:40 2014 : Info: ... adding new socket proxy (132.195.90.135, 40115) -> home_server (192.168.71.134, 2083) Fri Jun 13 09:56:33 2014 : Auth: (363) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 34070 cli cc3a.616c.9e60 via TLS tunnel) Fri Jun 13 09:56:33 2014 : Auth: (364) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 34070 cli cc3a.616c.9e60) Fri Jun 13 09:59:03 2014 : Auth: (590) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 61201 cli cc3a.616c.9e60 via TLS tunnel) Fri Jun 13 09:59:03 2014 : Auth: (591) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 61201 cli cc3a.616c.9e60) Fri Jun 13 09:59:06 2014 : Info: rlm_ldap (ldap): Opening additional connection (1) Fri Jun 13 09:59:06 2014 : Auth: (615) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 09:59:06 2014 : Auth: (617) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:59:07 2014 : Auth: (630) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 21912 cli CC-3A-61-6C-9E-60 via TLS tunnel) Fri Jun 13 09:59:07 2014 : Auth: (631) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 21912 cli CC-3A-61-6C-9E-60) Fri Jun 13 09:59:37 2014 : Info: rlm_ldap (ldap): Closing connection (0), from 1 unused connections Fri Jun 13 10:02:23 2014 : Auth: (1074) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:02:23 2014 : Auth: (1075) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:02:26 2014 : Auth: (1087) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:02:26 2014 : Auth: (1088) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:02:28 2014 : Auth: (1102) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:02:28 2014 : Auth: (1103) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:03:12 2014 : Auth: (1187) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12519 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:03:12 2014 : Auth: (1188) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12519 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:03:13 2014 : Auth: (1200) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 10:03:13 2014 : Auth: (1201) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 10:03:29 2014 : Auth: (1258) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:03:29 2014 : Auth: (1259) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:03:30 2014 : Auth: (1272) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:03:30 2014 : Auth: (1273) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:03:31 2014 : Auth: (1286) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:03:31 2014 : Auth: (1287) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:04:27 2014 : Auth: (1361) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12754 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:04:27 2014 : Auth: (1362) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12754 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:05:20 2014 : Auth: (1489) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12964 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:05:20 2014 : Auth: (1490) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12964 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:05:50 2014 : Auth: (1543) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli f0-b4-79-14-a0-7d via TLS tunnel) Fri Jun 13 10:05:50 2014 : Auth: (1544) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli f0-b4-79-14-a0-7d) Fri Jun 13 10:06:16 2014 : Auth: (1563) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13158 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:06:17 2014 : Auth: (1564) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13158 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:06:21 2014 : Auth: (1579) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13175 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:06:21 2014 : Auth: (1580) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13175 cli FC-25-3F-DC-34-4D) -- --- Dipl.-Ing. Michael Simon ---- Bergische Universität Wuppertal - ZIM ------ Netzwerk- und Systemplanung -------- simon(a)uni-wuppertal.de --------- Tel. +49 202 439-2235 ---------- Fax. +49 202 439-2910

3 4

MSCHAP authentication against Active directory OR MySQL
by Krzysztof Grobelak 13 Jun '14

13 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello All, On my freeRADIUS instance i am able to authenticate MSCHAP requests against Active Directory using the ntlm_auth module and Samba aditionally i can authenticate another group of WiMAX devices with MACHAP against MySQL database. But if I enable the config for WiMAX devices the are being authenticated aginst Active Directory and not the MySQL db. Now I would like to be able to configure the server so that both groups can be authenticated local users against Active Directory and the WiMAX devices against database. Can you guys advice how i can make it happen? I suspect unlang will be needed to do this but if you could specify how exactly it would be awesome. would it be something along those lines?? authorise{ mschap{ if("%{NAS-IP-Address}" == "1.1.1.1"){ sql } else{ ntlm_auth } } } I hope I did not mixed up terminology too much ;) Regards, Krzysztof -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTma/YAAoJEM/U1HoKR/xkaq0IAJOcPRpsH61wh8sVHrafl0da mCVYN/T94FRSVsOgRtpCpz3zKtfiorla2bL06RN+EQhPxtyist8dX1xNyUnzETaR QcY+/OCDHtVtWX4GGiOMP75DaUNDOj76NtAGLZOe+48Jtjvv3aoSCO4MZgUhbIbN wY4vKxeuA5PJ0SVQD1D8rWIKxxZNwLj24gCowpAA9TJsS1qpqZfLMwYd+uu/vo1O 1ztX7rhkzFdNAn8fJkIpHQLPad0PcAohHevbwIzgivHBtM2euYHvgjFY7yQurSXh G0WuoeWSri3oc3QriTiMc+wIQb1QTSvyTzZwjXhcdB3D0NGJKe3MIPJfCQDIk80= =Fhp6 -----END PGP SIGNATURE----- Airspeed Telecom

2 2

question about 802.1x
by Daniel Soto 13 Jun '14

13 Jun '14

I have been trying without success to authenticate users in the 802.1x user file, is there a way to do it. ? I would create a default rule in the "users " file for all users starting at the domain " WINDOWS \ * " authenticate locally with the Auth -Type = Access My freeradius version is 2.1.12 thank you very much -- hi every body.

3 4

Unable to disconnect user after Max-Daily-Session
by Alexandre Rubert 13 Jun '14

13 Jun '14

Hello, I use Freeradius 2.1.10 for three years and my clients use coova to connect to my radius. In my MySQL database I set : radcheck : myusername --- Cleartext-Password --- := --- pass myusername --- Max-User-Machine --- := --- 1 myusername --- Max-All-Session --- := --- 300 myusername --- Max-Daily-Session --- := --- 170 radgroupreply: mygroup --- Acct-Interim-Interval --- := --- 90 radusergroup myusername --- mygroup --- 1 When I connect to my hotspot through coovachilli, I'm not disconnected after Max-Daily-Session (170seconds) but after Max-All-Session (300seconds) there is a Session-Timeout and I am disconnected. When I retry to connect Radius reply I've used all the time (300seconds) Now When I stay connected 200 seconds and disconnect mannualy. I can't reconnect due to the Max-Daily-Session. I think everything work but I'd like to be disconnected when I reach the Max-Daily-Session like when I reach the Max-All-Session. PS : Freeradius and Coova are not on the same machine, I don't know if it's a problem. Thanks

2 3

post-auth section in FR v2.1.12
by gabriel_skupien 13 Jun '14

13 Jun '14

I am using EAP-TLS and I am trying to use post-auth section to dynamically assign (based on the ldap group membership) vlan ID to the user. Leaving the LDAP part away for testing purposes and concentrating just on the post-auth section - I cannot make FR to override VLAN ID in post-auth section. Here is the config: post-auth { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "36" } exec Post-Auth-Type REJECT { attr_filter.access_reject } } And nothing happens here: .... # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[reply] returns noop ++[exec] returns noop Sending Access-Challenge of id 127 to X.X.X.X port 32769 Tunnel-Private-Group-Id:0 = "36" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd55884fdd75c9555353e80afe21cb577 Finished request 6. .... But it finally ends with this: ..... Sending Access-Accept of id 128 to X.X.X.X port 32769 Tunnel-Private-Group-Id:0 = "84" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Cisco-AVPair += "XXX" EAP-Message = 0xXXXX Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "XXXX" Finished request 7. Hence, 3 questions: 1) Does FR v2.1.12 support post-auth section? 2) Can you explain the aim of "Sending Access-Challenge" ? 2) Where is the best place to authorize users in LDAP while using EAP-TLS? Is it post-auth? ps. it works fine while authorizing users based on LDAP in the authorize section but we prefer to postpone this task to post-auth. In that way we can achieve to goals: -use ldap group membership for vlan assignments and -significantly reduce LDAP load jinx

4 8