- Freeradius-Users - lists.freeradius.org

syslog detail accounting
by Munroe Sollog 12 Jun '14

12 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I currently have freeradius 2.1.12 on a cent6 system. It is only being used to collect accounting data for a VPN. The RADIUS auth is happening somewhere else. The detail logs are currently being stored in /var/log/radius/radacct/<client IP>/detail-<daily-file>. However, while radius itself is logging to syslog, this detail file is not using syslog. My ultimate goal is to be able to forward all of these detail accounting logs to a central syslog server for analysis. My current solution is I have a daemon that watches all of the files, slurps it up and re-emits it as syslog data to an rsyslog server. I am hoping there is a way to configure freeradius to do this so I can dismantle my hack. - - Munroe -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Icedove - http://www.enigmail.net/ iQEcBAEBAgAGBQJTmdlmAAoJEPbbZiWCKDVCT88IAOzyHdS4wh1I4dsTAhCA+2e6 +Uty2U67YK3qRB3ZZ5MyZsmh1btIdwY9FqrbvHZJJrurMaekgI9sLaCwulbpfQC9 /TcJx7UqfWOSs+bJwk45sKOtB/DW9oC6KiBdaNXJzRPxg1KycptfEk25l+Qku84e sPEkH7lc4Agop7xdhEfftzPDnuDAulwIPCJcDKHl9jrKA76wgd+JTkH5CIZxLYH0 ow4teLwqozIRbD/BD3bFgrbK5y2w1jGMkBxKs1uf9M1p1gKbaYEL71ZUSBWF/2nx FmF6c2IMh2THYvKy4jK2BMWAp8e/r2Xc6KtmSAevQdSAMDNkH2CDIa5WsWbiuhs= =py0p -----END PGP SIGNATURE-----

5 8

RE: MSCHAPV2 authenticate including the suffix
by Dean Goldhill 12 Jun '14

12 Jun '14

Hello, Thanks for looking at this. I have attached 2 debug outputs, 1- using domain@user with TTLS & MSCHAPV2 (not EAP-MSCHAPV2) - does not work 2- using domain@user with TTLS & EAP-MSCHAPV2 - does work SO the issues is that when the username contains a suffix, using MSCHAPV2 (as opposed to EAP-MSCHAPV2) I get rejected. If using EAP-MSCHAPV2, it works fine. When using EAP-MSCHAPV2 the CHAP challenge and response messages are inside the EAP message, when using MSCHAPV2, the Chap messages are separate attributes within the inner tunnel. I.E: [ttls] Got tunneled request User-Name = "josef(a)testdomain.com" MS-CHAP-Challenge = 0x1bd3c8b9d05f712d166a28dc85032e3d MS-CHAP2-Response = 0xeb00e4aa1d015b333de96b68fa7258f868270000000000000000777975f5b969b39b08978f3ec81d1dd949960dde0f65af72 So this is 1- using domain@user with TTLS & MSCHAPV2 (not EAP-MSCHAPV2) - does not work: radiusd: FreeRADIUS Version 2.2.5, for host x86_64-redhat-linux-gnu, built on Apr 29 2014 at 09:18:14 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 192.168.42.114 { require_message_authenticator = no secret = "radius" shortname = "test" } client 192.168.42.16 { require_message_authenticator = no secret = "radius" shortname = "test2" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "192.168.152.3" port = "" login = "freeradius" password = "freeradius" radius_db = "ManagedRADIUSWiFi" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':='" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to freeradius@192.168.152.3:/ManagedRADIUSWiFi rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 36002 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=70, length=151 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User EAP-Message = 0x0201000e01616e6f6e796d6f7573 User-Name = "anonymous" NAS-Port = 44309 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x5753364a5128f3c9e44d876ffa66a057 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> anonymous [sql] sql_set_user escaped user --> 'anonymous' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':=' -> SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' rlm_sql_mysql: query: SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 70 to 192.168.42.16 port 20008 EAP-Message = 0x010200160410274708d3fbb2f2884ede6102efa8fac5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13befe1b51ad39d66d296a9ad51 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=71, length=161 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13befe1b51ad39d66d296a9ad51 EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0xf289380646fc6271b4810647cfe84f1c # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> anonymous [sql] sql_set_user escaped user --> 'anonymous' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':=' -> SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' rlm_sql_mysql: query: SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 71 to 192.168.42.16 port 20008 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13beee0a41ad39d66d296a9ad51 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=72, length=260 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13beee0a41ad39d66d296a9ad51 EAP-Message = 0x0203006915800000005f160301005a010000560301539878d34807df7593edd62e18def29542ada6f478c3f8ecdd45e04bef429d510000280039003800330032001600130035002f00150012000a0005000400090014001100030006000800ff01000005000f000101 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0xb15bf35f503ae46a166e90aa2cb51c83 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 105 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 95 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 005a], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 0036], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 08d0], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 72 to 192.168.42.16 port 20008 EAP-Message = 0x0104040015c000000b2b1603010036020000320301539877b727a2bb42e83ab4c8c3dfd371eda380e6cc19300db412e1a20a13701400003900000aff01000100000f00010116030108d00b0008cc0008c90003de308203da308202c2a003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361 EAP-Message = 0x746520417574686f72697479301e170d3134303631313135323730345a170d3135303631313135323730345a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d0a67f56d1218a0a58127603fe396e0160e12705798fdcffe06102c318b7ef9b2176b32f852224eeed482d2ae89f2a0e3b8b EAP-Message = 0xa64fa02f2fbaa1a39b287cd33eafabd326c98dba127ce8b0e44f48db533593598d5391fd079b633cbf92ab99027756e45356ec2ae2f0f32f28bceb364e0d2f123e6276560ef03a8a6fb1ebf4fd63b82006ddca60484df672e0ad74ea2188b295fbe028275a61cad572f73ab977ea9eba084c60677aef2bcc7762832524d649c1e832bd576f8b832583af68d50d6c8e8fa2bc68f417ad3e048042515ead2c650199bcf74b3459641692df0ba363a6c65e7d756e50ff80fc6dd178276bf719b41c1d9fc1338b9a7789a110287c1c4b0203010001a34f304d30130603551d25040c300a06082b0601050507030130360603551d1f042f302d302ba029a027 EAP-Message = 0x8625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d010105050003820101009d6e0fa587fab9dc4a9b4905c18f17669d904c6b5c3b1440304d5ce4625915e54cbbd7dfcce48441a51ed45798252e59ceede8362eb553b09e2c8d6be51940a1bb96ac0bcf06b7cdef5175605a7984c67b9058ac8a21f4b7397d3ac4f4e6677cd3302a78d865b433d2514255f6ae1b784f88ab2f01ec6ebd928591eeebd0dff400393bae2aa4acb14be31f56e824b9386f40ca8ed2e3026a17b27585d8079e7e86eb3a91c5dd07e552c31df48d67c4f8982e7aeb15358c5501bb7b5906f7935b06cb EAP-Message = 0x71200169cea51e7af1c334c0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13bede7a41ad39d66d296a9ad51 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=73, length=161 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13bede7a41ad39d66d296a9ad51 EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x9919f28a6ccf424901a11bc90785e61a # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 73 to 192.168.42.16 port 20008 EAP-Message = 0x0105040015c000000b2b1e7a5bff52453e4c9694a7407bf3e1e883321da050c6fa53e4a05a83d8c7077349330a2c1ac202be61c5c75833905c13f4ec0004e5308204e1308203c9a003020102020900dfa3486c6cb1f96e300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930 EAP-Message = 0x1e170d3134303631313135323730345a170d3135303631313135323730345a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c8fcd609bf8dd3edc91006985ff77c8643e8479cc90a5e4d5894e363b614dd90bf73272be715f9 EAP-Message = 0xe41b51c815ad8ce1cb9bfc5084ad728e75005644152bdd82e97809b77d2baa16e22fe4638a8516a11e9df56b7f6ea31e61f857caa5256a32d28a1d0f6e384f2ff4ee93e351069faf4ca06e682c7772ff53415e29f9bf076afe00f042d6c57063e558670fa4b5f4ad4a5ca28277fb789ca3e943f0f0b828831ae871a61aae88b3db06daae7df9356e4ab6afb2e6d148d9c2c9866e82ff857c9465ae636b517037f6bd8c8c9fbdafd5c5cd5305f015d4988f4cd34e38aaee5380a0f942f1c4c4b055a15c86b5f0aede98b5dc3b82d22cae163a484927fcf868bb0203010001a382013430820130301d0603551d0e041604140d99bc282493fbc134a9dec9 EAP-Message = 0xc277c212c932dd1d3081c80603551d230481c03081bd80140d99bc282493fbc134a9dec9c277c212c932dd1da18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900dfa3486c6cb1f96e300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777 EAP-Message = 0x772e6578616d706c652e636f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13bece6a41ad39d66d296a9ad51 Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=74, length=161 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13bece6a41ad39d66d296a9ad51 EAP-Message = 0x020500061500 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x42ccd33da273d165fe94cb08485725f3 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 74 to 192.168.42.16 port 20008 EAP-Message = 0x01060349158000000b2b6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010095c6536dc2a04e2b2508da21065191ea4ac1db7167daca4192246690a1087cf7b070972df9b8a62dd10be43c06f198c9d93f202ddf39691311bb27695fc8cb744f2218ffcdd6514f03078e595fc01ec9141342a81ac921a7396227603d7b4048222a29f38340ba361aacac3328e77cfcd520580aca674883469e5864b345e32a1c98bd9e74ce6e87ff7ff9b7f48608950bc56fb7ccae1aacea92edf7227813fc87390cce2bd04eb09881045a687723577faf1ba909af2beccfb646d835549e3d91dfe871212054884517001aa21426 EAP-Message = 0x97169fd53671f7a1944d9e1b03930cd247c33f567e49e8863f67e7625498cd069c8ee8ccdca8afab008e5160bfee716745160301020d0c0002090080ef8cb67830bf429c4b9ad4714e77aaa750c3db460d39315a8c6fcdfa5c4d9f2d1759901723a901aecd8a5488b65b6dea6dc9385ff769702783b1111064e222d4c4f9e1220b2b1863ca2764bed79f4de5cc029915f46e71b2e247f3efbea696b49dfaa6e54ed45fc427fdf0f3bfbf2e234172f350331fd40471e5a02d72504cf3000102008087eb3efa9305dc25e738b3c809d212dab5f3c46db43e605ec4567303aa8093ccfeea15eda7cfc4712b1c68c7d3ec96888cbf4a4c03d281c79aa0936f EAP-Message = 0xb282b38f87453a8f1f69ac5d9a930f1eeda767e6ddad449c6861cbe35c298b50c7d441b61c3e2ee9c76bccfbd99dd2476f5b340d95d06bfcfd49fa202130ea4aa8a6b23801003ff1e095cfb2fa5e706f707cc797f7379f7ee8d100ec4982a7d6eab8aa54f310a400189223023d0256c3fdc439f337b0448c61395d36988f388ccf4412dcfa41a0d3a0231ab9a5a05a6cd69ff658a95f12fad83dfb574ee0e7ae96327a7016af2eb3ff58977c7b14eb69c54e6dd9dee36c68cbe46999d5a774145d7816779d57cc5e90a9511522cc12ad85c7121daf5ae18fa867a84ddec3073073df68f410f14ad281c8b205e61c8bb568c3888af010738fed1cc7a204 EAP-Message = 0xdfd2cfdc7e48153e9f26e843b4c240024c7ad447963ae8b06ac5168336be99df211d9e31230cd0e5a9f600e84f9925461873a7dfe4d317e1555cb2fed7cda3ba3e01ee384b163bcfde16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13bebe5a41ad39d66d296a9ad51 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=75, length=363 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13bebe5a41ad39d66d296a9ad51 EAP-Message = 0x020600d01580000000c616030100861000008200809912a4353193f80d27e13256d7d9599ccf053866a1045ddb003667bf8c59aee651274ca600ec4f67a6e313a4b6acf4569185891b4241389077605ea710a5778ea9ed92a2f57eb700ccf60893eac836e9e5325d13b301a372a48c1a1c4be8eb4ac65693e704dac202aba70652931e3861506c6e57d9906ee323b338389fc79bea14030100010116030100308441ff34f8ba50ea7526ab96a8fdb322634eca5488c3d17293ef299b6df1f08513f772136509bd5a84587c797a20bb04 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x2c4cc7284a3bb559e0a44801d10521d0 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 208 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 198 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 75 to 192.168.42.16 port 20008 EAP-Message = 0x0107004515800000003b14030100010116030100304da578a541d3aeeb31afc9111c8ebb1e9ed16c02a7abf8b1549bfef95e0318ce49e87f19939786fa9f1526990c3f4bb1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13beae4a41ad39d66d296a9ad51 Finished request 5. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=76, length=314 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13beae4a41ad39d66d296a9ad51 EAP-Message = 0x0207009f1580000000951703010090572132c3bb100f7e832eb74bf857e6384aeb34021c9b0745c39f235bde009d1b409dad39bafeff6260237341e10c9fd063090c63503c2dbc3b1553de553c1873d88539fabe38c250f1dd1c9d2df2e9b2806190c098f4ebfd4a769c7f65154a1e02a708e129096b8d3e8fb0c6e8fe9bab2b43d71fcf6ad14e4fd8e676cb351b0e233467b65cccdbc25281355b3bdc0b40 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x16f5285e0cd4416af24a8e8fd9ba000c # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 7 length 159 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 149 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "josef(a)testdomain.com" MS-CHAP-Challenge = 0x1bd3c8b9d05f712d166a28dc85032e3d MS-CHAP2-Response = 0xeb00e4aa1d015b333de96b68fa7258f868270000000000000000777975f5b969b39b08978f3ec81d1dd949960dde0f65af72 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "josef(a)testdomain.com" MS-CHAP-Challenge = 0x1bd3c8b9d05f712d166a28dc85032e3d MS-CHAP2-Response = 0xeb00e4aa1d015b333de96b68fa7258f868270000000000000000777975f5b969b39b08978f3ec81d1dd949960dde0f65af72 FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] = ok [suffix] Looking up realm "testdomain.com" for User-Name = "josef(a)testdomain.com" [suffix] No such realm "testdomain.com" ++[suffix] = noop ++update control { ++} # update control = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop [sql] expand: %{User-Name} -> josef(a)testdomain.com [sql] sql_set_user escaped user --> 'josef(a)testdomain.com' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':=' -> SELECT '111', 'josef(a)testdomain.com', 'Cleartext-Password', (select GuestAuthRADIUS ('josef(a)testdomain.com', '' ,'192.168.42.16')), ':=' rlm_sql_mysql: query: SELECT '111', 'josef(a)testdomain.com', 'Cleartext-Password', (select GuestAuthRADIUS ('josef(a)testdomain.com', '' ,'192.168.42.16')), ':=' [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'josef(a)testdomain.com' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'josef(a)testdomain.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'josef(a)testdomain.com' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'josef(a)testdomain.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = ok Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group MS-CHAP { [mschap] Creating challenge hash with username: josef(a)testdomain.com [mschap] Client is using MS-CHAPv2 for josef(a)testdomain.com, we need NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject +} # group MS-CHAP = reject Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> josef(a)testdomain.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated } # server inner-tunnel [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\353E=691 R=1" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 76 to 192.168.42.16 port 20008 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds.

2 1

just two questions
by Chris Knipe 12 Jun '14

12 Jun '14

Hi All, >From the radmin command, I can see the following radmin> stats socket 10.255.251.2 1812 requests 645589 responses 641483 accepts 359013 rejects 282470 challenges 0 dup 0 invalid 0 malformed 0 bad_authenticator 0 dropped 3110 unknown_types 0 last_packet 1402555332 elapsed.1us 0 elapsed.10us 0 elapsed.100us 0 elapsed.1ms 0 elapsed.10ms 229378 elapsed.100ms 384248 elapsed.1s 27768 elapsed.10s 86 Now given my specific application that I use Radius for, the elapsed times are OK for the majority of requests (the sub 100ms range is fine). I just have a quick question and a thought perhaps. Under what circumstances will FR "drop" a request (i.e. dropped 3110). Also, would it be possible to be able to get stats for the thread pool through radmin as well? I've been experiencing very weird, intermittent and seemingly random timeouts from FR, and after increasing (doubling) the size of my thread pool, most of my issues seemed to have gone away. Surely, those kind of stats in terms of the thread pool will not only be very helpful, but it will be absolutely beneficial in terms of debugging performance issues? Also as a last note, maybe something like a "slow query" log option can be added as well, where we can log auth/acct requests to a while in instances where FR takes longer than a specific amount of time to process? Say, if it takes longer than 100ms to process a request, log the request to a specific file? Not only will it again help to troubleshoot and isolate performance issues, but it could possibly also mean that the entire server does not need to be run in debug mode to identify requests which takes long to process. Just a thought, and just my 2c :-) Thanks, Chris.

3 3

Accented words
by Javier Granda 12 Jun '14

12 Jun '14

I'm running a radius server with multiple eap modules, depending on the CommonName will be redirected to one or another module, the CommonName is like this: "<APELLIDO>, <NOMBRE> (AUTENTICACIÓN)," the problem is that it seems that FR does not recognize the accented literal "AUTENTICACIÓN". The log says "Evaluating (User-Name == "<APELLIDO>, <NOMBRE> (AUTENTICACI") -> FALSE". Any idea how to fix it?

2 1

MSCHAPV2 authenticate including the suffix
by Dean Goldhill 12 Jun '14

12 Jun '14

Hello, I am using an SQL backend. The usernames are stored with the full username including a suffix 'user(a)domain.com I am trying to use TTLS/PEAP with MSCHAPV2 So I want freeradius to authenticate the full username, not the stripped username. I want it to match 'user(a)domain.com<mailto:user@domain.com>' not 'user' When trying to authenticate, it says: [mschap] ERROR: User-Name (user(a)domain.com<mailto:user@domain.com>) is not the same as MS-CHAP Name (user) from EAP-MSCHAPv2. If I set the username in the database to just 'user' and send that through in the supplicant, it works. But I want it to work with the full username including the suffix in the database. Is this possible? Thanks for your help Dean.

3 6

Radcheck gives Accept but still moves onto Radgroupcheck
by Brent Wilkinson 12 Jun '14

12 Jun '14

I am setting up a new Radius server or a mikrotik hotspot system. I am getting a wierd issue that I have not been able to solve or find hints to what to do to fix it. I have setup the system with mysql. I see the radcheck happen and show it retrieved a record. ( I have verified the sql statments do actually pull something). I am not sending any reply so nothing is found in that table. At this point from what I understand in reading how the sql module works at this point it should send back a Access-Accept. Unfortunatly it does not and continues to do group checks and I end up with a reject. Hoping someone can give me a idea of what I need to look at or what I can read up more on to track the issue I am having down. Here is the debug: rad_recv: Access-Request packet from host 76.8.212.170 port 36910, id=78, length=189 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C:4B:D6:A5:CD:BF" Called-Station-Id = "10631" NAS-Port-Id = "ether2" User-Name = "1" NAS-Port = 2152726611 Acct-Session-Id = "80500053" Framed-IP-Address = 10.69.103.254 Mikrotik-Host-IP = 10.69.103.254 CHAP-Challenge = 0x95b4afa9e0e37e62da70a83197931d11 CHAP-Password = 0x21b4c5ed3e3175b1b7672103936286b74e Service-Type = Login-User WISPr-Logoff-URL = "http://10.69.100.1/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.99.163 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "1" with CHAP password [chap] Using clear text password "1" for user 1 authentication. [chap] chap user 1 authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> 1 [sql_log] expand: %{%{User-Name}:-DEFAULT} -> 1 [sql_log] sql_set_user escaped user --> '1' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('1', 'Chap-Password', 'Access-Accept', '2014-06-11 18:42:31'); [sql_log] expand: /var/log/freeradius/radacct/sql-relay -> /var/log/freeradius/radacct/sql-relay [sql_log] Couldn't open file /var/log/freeradius/radacct/sql-relay: No such file or directory ++[sql_log] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> 1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 78 to 76.8.212.170 port 36910 Waking up in 4.9 seconds. Cleaning up request 0 ID 78 with timestamp +6 Ready to process requests. Thanks Brent

3 2

Segmentation fault (core dumped), 3.0.3
by Miha 11 Jun '14

11 Jun '14

Hi, I have installed the newest freeradius server (3.0.3) on centos 6.4. I am trying to start it but getting: name = "radiusd" Segmentation fault (core dumped) Jun 11 09:42:42 localhost kernel: radiusd[6162]: segfault at 19b ip 00000034d6802a3e sp 00007fffedf28180 error 4 in libtalloc.so.2.0.7[34d6800000+a000] Jun 11 09:42:42 localhost abrtd: Directory 'ccpp-2014-06-11-09:42:42-6162' creation detected Jun 11 09:42:42 localhost abrt[6163]: Saved core dump of pid 6162 (/usr/local/sbin/radiusd) to /var/spool/abrt/ccpp-2014-06-11-09:42:42-6162 (2945024 bytes) Jun 11 09:42:42 localhost abrtd: Executable '/usr/local/sbin/radiusd' doesn't belong to any package and ProcessUnpackaged is set to 'no' Jun 11 09:42:42 localhost abrtd: 'post-create' on '/var/spool/abrt/ccpp-2014-06-11-09:42:42-6162' exited with 1 Jun 11 09:42:42 localhost abrtd: Deleting problem directory '/var/spool/abrt/ccpp-2014-06-11-09:42:42-6162' Could some just point me to right direction what is wrong? tnx miha

2 2

use_tunneled_reply in PEAP or TTLS tunnels
by Herwin Weststrate 11 Jun '14

11 Jun '14

Hi all, I was playing around a bit with the option use_tunneled_reply today. The description given in the config is as follows: > The reply attributes sent to the NAS are usually > based on the name of the user 'outside' of the > tunnel (usually 'anonymous'). If you want to send > the reply attributes based on the user name inside > of the tunnel, then set this configuration entry to > 'yes', and the reply to the NAS will be taken from > the reply to the tunneled request. The last part (and the reply to the NAS will be taken from the reply to the tunneled request) makes me expect that all attributes from the reply of the home server are copied to the outer reply. In this case it would be the various attributes to change a VLAN (Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-Id). Looking at the reply, I only see the User-Name attribute updated to my inner user. The relevant code uses the method pairfilter, which is described as "Move pairs of a matching attribute number, vendor number and tag from the the input list to the output list." Basicly, this means that only values that are already present are overwritten. Not exactly what I was expecting. Is this a bug in the code, or is the problem just that the documentation could use a little clarification? -- Herwin Weststrate www.quarantainenet.nl

3 3

dynamic-clients with TLS
by Stefanos Boglou 11 Jun '14

11 Jun '14

Is it possible to use dynamic-clients with TLS? It does not seem to work. Dynamic-clients without TLS works and TLS itself seems to work. My NAS devices are over the internet and they get dynamic IPs from the ISPs but i use TLS for that added piece of security. Thanks, Stefanos

3 5

post-auth section in FR v2.1.12 - Re: Freeradius-Users Digest, Vol 110, Issue 39
by Rui Ribeiro 10 Jun '14

10 Jun '14

Hi Grabriel, You are missing in your update reply Service-Type := "Framed-User" Are you following v1.x recipes? BTW, upgrade to 2.2.4 at least, 2.1.12 is very old, and full of bugs specially when using mschap. Regards > > Message: 4 > Date: Tue, 10 Jun 2014 17:50:17 +0200 > From: gabriel_skupien <gabriel_skupien(a)o2.pl> > To: freeradius-users(a)lists.freeradius.org > Subject: post-auth section in FR v2.1.12 > Message-ID: <5c9f5cb4.6195ba31.53972939.95a05(a)o2.pl> > Content-Type: text/plain; charset="UTF-8" > > I am using EAP-TLS and I am trying to use post-auth section to dynamically > assign (based on the ldap group membership) vlan ID to the user. Leaving > the LDAP part away for testing purposes and concentrating just on the > post-auth section - I cannot make FR to override VLAN ID in post-auth > section. Here is the config: > > post-auth { > update reply { > Tunnel-Type := VLAN > Tunnel-Medium-Type := IEEE-802 > Tunnel-Private-Group-Id := "36" > } > exec > Post-Auth-Type REJECT { > attr_filter.access_reject > } > } > > And nothing happens here: > > .... > # Executing section post-auth from file > /etc/freeradius/sites-enabled/default > +- entering group post-auth {...} > ++[reply] returns noop > ++[exec] returns noop > Sending Access-Challenge of id 127 to X.X.X.X port 32769 > Tunnel-Private-Group-Id:0 = "36" > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Type:0 = VLAN > EAP-Message = 0x03040004 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xd55884fdd75c9555353e80afe21cb577 > Finished request 6. > .... > But it finally ends with this: > ..... > Sending Access-Accept of id 128 to X.X.X.X port 32769 > Tunnel-Private-Group-Id:0 = "84" > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Type:0 = VLAN > Cisco-AVPair += "XXX" > EAP-Message = 0xXXXX > Message-Authenticator = 0x00000000000000000000000000000000 > User-Name = "XXXX" > Finished request 7. > > Hence, 3 questions: > 1) Does FR v2.1.12 support post-auth section? > 2) Can you explain the aim of "Sending Access-Challenge" ? > 2) Where is the best place to authorize users in LDAP while using EAP-TLS? > Is it post-auth? > > ps. it works fine while authorizing users based on LDAP in the authorize > section but we prefer to postpone this task to post-auth. In that way we > can achieve to goals: > -use ldap group membership for vlan assignments and > -significantly reduce LDAP load > > jinx > > H

1 0