- Freeradius-Users - lists.freeradius.org

Client is using MSCHAPv2 for %s, we need NT-Password
by Matthew Berry 14 Jun '14

14 Jun '14

Is this message merely informative, or does it indicate a problem? I'm attempting to debug my issue with something else and this is the only line I see that sounds like a warning/error prior to the rejection happening. From what I see in rlm_mschap.c, I would have seen a different message if the code could not either find a valid NT-Password attribute[1] or could not create one from a Cleartext-Password attribute[2]. Based on the comment left above the message > The old "mschapv2" function has been moved to > here It leads me to believe this line is informative only. (i.e., we need this attribute to be present, and unless you've seen otherwise it is). -Matt [1] https://github.com/FreeRADIUS/freeradius-server/blob/ec8c055b4c8e9358a08d51… [2] https://github.com/FreeRADIUS/freeradius-server/blob/ec8c055b4c8e9358a08d51…

2 4

Issues with building Freeradius on CentOS 6.5: need rlm_cache
by Brandon Jozsa 14 Jun '14

14 Jun '14

Hello, I've been trying to work through the issues and by searching high and low for solutions before turning to this users list. I'm sorry if this is a stupid question (I've seen worse though, so maybe I shouldn't feel bad). I have a very high need to use the rlm_cache module with Freeradius on CentOS 6.5. I'm trying to first us the statement: ----- snipped ----- authorize { if (!notfound) { update control { Proxy-To-Realm := "SOME_REALM" } } ----- snipped ----- which works GREAT alone...but I also want to use the cache function like so: ----- snipped ----- update control { Cache-Status-Only = 'yes' } cache if (notfound) { sql } update control { Cache-Status-Only := 'no' } cache ----- snipped ----- which doesn't work (obviously) because rlm_cache isn't included with 2.1.12, or so it seems anyway. My hope is (it is a hope anyway) that I can collect authN/authZ replies from an upstream radius server and cache them locally; thus building a mysql database of users access/privileges and let this run on an environment before cutting completely over to our new Freeradius setup. Again, I'm hoping it can work like this...getting rid of RSA and using LinOTP or MOTP would be so nice; it would be more flexible and user friendly, but I really need to collect authN and authZ in order to rebuild our massive user-base. My issue...CentOS, which is our "approved platform" (I'm rolling my eyes and giving air quotes), doesn't have a newer version of Freeradius other than 2.1.12. I think the rlm_cache modules are only included in 3.0.0 and higher, is that right? So, I started looking on how to build from source...and I found one; great news I thought!! Enter: http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources…. I thought this would save the day, but there are broken links for 3.0.0 and I am running into major issues; it just doesn't seem to work at all. I also tried to build it out, take the rlm_cache.so lib over to my 2.1.12 installation, but Freeradius barfed all over that little trick. What are my options here? I could really use some help. Any ideas?

7 15

Subject: Radcheck gives Accept but still moves onto Radgroupcheck
by Mike Poole 13 Jun '14

13 Jun '14

file /var/log/freeradius/radacct/sql-relay: No such file or directory Brent - The reject isn't coming from group check, it fails out when it tries to write to the sql-relay file that doesn't exist. You should turn off sql-relay or configure it. If part of the sql process fails (as I've been painfully doing here with my MT the last two days) the whole process will result in an Access Reject. Notice the reject comes directly after the statement above. Also, any time a "user found in radcheck" is sent, the next query will be processed. Mike Message: 4 Date: Wed, 11 Jun 2014 17:04:30 -0600 From: "Brent Wilkinson" <brent(a)air2data.com> To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Subject: Radcheck gives Accept but still moves onto Radgroupcheck Message-ID: <000601cf85c9$8104cd50$830e67f0$@com> Content-Type: text/plain; charset="us-ascii" I am setting up a new Radius server or a mikrotik hotspot system. I am getting a wierd issue that I have not been able to solve or find hints to what to do to fix it. I have setup the system with mysql. I see the radcheck happen and show it retrieved a record. ( I have verified the sql statments do actually pull something). I am not sending any reply so nothing is found in that table. At this point from what I understand in reading how the sql module works at this point it should send back a Access-Accept. Unfortunatly it does not and continues to do group checks and I end up with a reject. Hoping someone can give me a idea of what I need to look at or what I can read up more on to track the issue I am having down. Here is the debug: rad_recv: Access-Request packet from host 76.8.212.170 port 36910, id=78, length=189 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C:4B:D6:A5:CD:BF" Called-Station-Id = "10631" NAS-Port-Id = "ether2" User-Name = "1" NAS-Port = 2152726611 Acct-Session-Id = "80500053" Framed-IP-Address = 10.69.103.254 Mikrotik-Host-IP = 10.69.103.254 CHAP-Challenge = 0x95b4afa9e0e37e62da70a83197931d11 CHAP-Password = 0x21b4c5ed3e3175b1b7672103936286b74e Service-Type = Login-User WISPr-Logoff-URL = "http://10.69.100.1/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.99.163 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1' and PID='10631' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' and PID='%{Called-Station-Id}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1' and PID='10631' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '1' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "1" with CHAP password [chap] Using clear text password "1" for user 1 authentication. [chap] chap user 1 authenticated succesfully ++[chap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Accept', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> 1 [sql_log] expand: %{%{User-Name}:-DEFAULT} -> 1 [sql_log] sql_set_user escaped user --> '1' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('1', 'Chap-Password', 'Access-Accept', '2014-06-11 18:42:31'); [sql_log] expand: /var/log/freeradius/radacct/sql-relay -> /var/log/freeradius/radacct/sql-relay [sql_log] Couldn't open file /var/log/freeradius/radacct/sql-relay: No such file or directory ++[sql_log] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> 1 [sql] sql_set_user escaped user --> '1' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x21b4c5ed3e3175b1b7672103936286b74e [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '1', '0x21b4c5ed3e3175b1b7672103936286b74e', 'Access-Reject', '2014-06-11 18:42:31') rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> 1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 78 to 76.8.212.170 port 36910 Waking up in 4.9 seconds. Cleaning up request 0 ID 78 with timestamp +6 Ready to process requests. Thanks Brent

1 0

too many "No EAP session matching state 0x…" with FR 3.0.x
by Michael Simon 13 Jun '14

13 Jun '14

Hi! After running FR 3.0.3 from GIT (FR 3.0.2 as well) for a while (a few hours) lots of “Error: rlm_eap (EAP): No EAP session matching state 0x…” appear in the log file. A restart of FR and the error messages are gone for the present. These requests come from RADIUS over TLS (radsec) clients explained in /etc/freeradius/sites-available/tls Is this a bug or a misconfiguration? Best wishes Michael Fri Jun 13 09:30:53 2014 : Auth: (10040) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:30:53 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x7c19d06a7714c91d Fri Jun 13 09:30:59 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x7c19d06a7714c91d Fri Jun 13 09:30:59 2014 : Auth: (10041) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:30:59 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x7c19d06a7714c91d Fri Jun 13 09:31:20 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:20 2014 : Auth: (10045) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:31:20 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:27 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:27 2014 : Auth: (10047) Login incorrect: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:31:27 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x6d7d7a2a6d6d63c6 Fri Jun 13 09:31:37 2014 : Auth: (10098) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 09:31:37 2014 : Auth: (10099) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67 via TLS tunnel) Fri Jun 13 09:31:37 2014 : Auth: (10100) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:31:38 2014 : Auth: (10101) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:32:18 2014 : Auth: (10152) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67 via TLS tunnel) Fri Jun 13 09:32:18 2014 : Auth: (10154) Login OK: [userxy(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 58-55-ca-f8-50-67) Fri Jun 13 09:32:28 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x31cdab6e35cbb2ff Fri Jun 13 09:32:28 2014 : Auth: (10170) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:28 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x31cdab6e35cbb2ff Fri Jun 13 09:32:40 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:40 2014 : Auth: (10203) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:40 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:50 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:50 2014 : Auth: (10207) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:50 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:53 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:32:53 2014 : Auth: (10208) Login incorrect: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 09:32:53 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xead9ddeceadbc462 Fri Jun 13 09:36:25 2014 : Auth: (10471) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 132 cli 68-A8-6D-0E-E4-CE via TLS tunnel) Fri Jun 13 09:36:25 2014 : Auth: (10472) Login OK: [user128(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 14088 cli 84-7A-88-75-92-4E via TLS tunnel) Fri Jun 13 09:36:25 2014 : Auth: (10473) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 132 cli 68-A8-6D-0E-E4-CE) Fri Jun 13 09:36:27 2014 : Auth: (10474) Login OK: [user128(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 14088 cli 84-7A-88-75-92-4E) Fri Jun 13 09:40:45 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x2acecbf92accd2dc Fri Jun 13 09:40:45 2014 : Auth: (10853) Login incorrect: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:40:45 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x2acecbf92accd2dc Fri Jun 13 09:40:48 2014 : Auth: (10876) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab via TLS tunnel) Fri Jun 13 09:40:48 2014 : Auth: (10877) Login OK: [user810(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:40:48 2014 : Auth: (10878) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:41:08 2014 : Auth: (10913) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:41:08 2014 : Auth: (10914) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0) Fri Jun 13 09:41:14 2014 : Auth: (10927) Login OK: [user810(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 0) Fri Jun 13 09:43:05 2014 : Auth: (11158) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:43:05 2014 : Auth: (11159) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0) Fri Jun 13 09:43:25 2014 : Auth: (11213) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0 via TLS tunnel) Fri Jun 13 09:43:25 2014 : Auth: (11214) Login OK: [user810(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 0) Fri Jun 13 09:44:41 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xc147e16bc145f804 Fri Jun 13 09:44:41 2014 : Auth: (11385) Login incorrect: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:44:41 2014 : Error: rlm_eap (EAP): No EAP session matching state 0xc147e16bc145f804 Fri Jun 13 09:44:46 2014 : Auth: (11422) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab via TLS tunnel) Fri Jun 13 09:44:46 2014 : Auth: (11423) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 09:44:46 2014 : Auth: (11424) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:44:56 2014 : Auth: (11445) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:17 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x77b7713e7ca66843 Fri Jun 13 09:45:17 2014 : Auth: (11503) Login incorrect: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:17 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x77b7713e7ca66843 Fri Jun 13 09:45:21 2014 : Auth: (11537) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab via TLS tunnel) Fri Jun 13 09:45:21 2014 : Auth: (11538) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 09:45:21 2014 : Auth: (11539) Login OK: [user207(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13 cli 84-fc-fe-c5-17-ab) Fri Jun 13 09:45:31 2014 : Auth: (11570) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:49 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x58b807b453a81e77 Fri Jun 13 09:45:49 2014 : Auth: (11605) Login incorrect: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:45:49 2014 : Error: rlm_eap (EAP): No EAP session matching state 0x58b807b453a81e77 [RESTART FR] Fri Jun 13 09:53:23 2014 : Info: Signalled to terminate Fri Jun 13 09:53:23 2014 : Info: Exiting normally Fri Jun 13 09:53:23 2014 : Info: rlm_ldap (ldap): Closing connection (0) Fri Jun 13 09:53:24 2014 : Info: rlm_ldap (ldap): Opening additional connection (0) Fri Jun 13 09:53:24 2014 : Info: Loaded virtual server <default> Fri Jun 13 09:53:24 2014 : Info: Loaded virtual server default Fri Jun 13 09:53:24 2014 : Info: Loaded virtual server inner-tunnel Fri Jun 13 09:53:24 2014 : Info: Ready to process requests Fri Jun 13 09:53:25 2014 : Info: ... adding new socket auth+acct from client (192.168.71.138, 45129) -> (*, 2083, virtual-server=default) Fri Jun 13 09:53:26 2014 : Info: ... adding new socket auth+acct from client (192.168.71.134, 53659) -> (*, 2083, virtual-server=default) Fri Jun 13 09:53:46 2014 : Auth: (89) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 331 cli CC-3A-61-6C-9E-60 via TLS tunnel) Fri Jun 13 09:53:46 2014 : Auth: (90) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 331 cli CC-3A-61-6C-9E-60) Fri Jun 13 09:54:27 2014 : Auth: (159) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 142 cli 68-A8-6D-0E-E4-CE via TLS tunnel) Fri Jun 13 09:54:27 2014 : Auth: (160) Login OK: [userxz(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 142 cli 68-A8-6D-0E-E4-CE) Fri Jun 13 09:54:39 2014 : Auth: (183) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13302 cli CC-3A-61-6C-9E-60 via TLS tunnel) Fri Jun 13 09:54:39 2014 : Auth: (184) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 13302 cli CC-3A-61-6C-9E-60) Fri Jun 13 09:55:34 2014 : Auth: (235) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 48802 cli cc3a.616c.9e60 via TLS tunnel) Fri Jun 13 09:55:34 2014 : Auth: (237) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 48802 cli cc3a.616c.9e60) Fri Jun 13 09:55:40 2014 : Info: ... adding new socket proxy (132.195.90.135, 40115) -> home_server (192.168.71.134, 2083) Fri Jun 13 09:56:33 2014 : Auth: (363) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 34070 cli cc3a.616c.9e60 via TLS tunnel) Fri Jun 13 09:56:33 2014 : Auth: (364) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 34070 cli cc3a.616c.9e60) Fri Jun 13 09:59:03 2014 : Auth: (590) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 61201 cli cc3a.616c.9e60 via TLS tunnel) Fri Jun 13 09:59:03 2014 : Auth: (591) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 61201 cli cc3a.616c.9e60) Fri Jun 13 09:59:06 2014 : Info: rlm_ldap (ldap): Opening additional connection (1) Fri Jun 13 09:59:06 2014 : Auth: (615) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 09:59:06 2014 : Auth: (617) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 09:59:07 2014 : Auth: (630) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 21912 cli CC-3A-61-6C-9E-60 via TLS tunnel) Fri Jun 13 09:59:07 2014 : Auth: (631) Login OK: [user152(a)uni-wuppertal.de] (from client radius2.eduroamclient.xy port 21912 cli CC-3A-61-6C-9E-60) Fri Jun 13 09:59:37 2014 : Info: rlm_ldap (ldap): Closing connection (0), from 1 unused connections Fri Jun 13 10:02:23 2014 : Auth: (1074) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:02:23 2014 : Auth: (1075) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:02:26 2014 : Auth: (1087) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:02:26 2014 : Auth: (1088) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:02:28 2014 : Auth: (1102) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:02:28 2014 : Auth: (1103) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12433 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:03:12 2014 : Auth: (1187) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12519 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:03:12 2014 : Auth: (1188) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12519 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:03:13 2014 : Auth: (1200) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c via TLS tunnel) Fri Jun 13 10:03:13 2014 : Auth: (1201) Login OK: [user729(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 1c-4b-d6-f7-b8-0c) Fri Jun 13 10:03:29 2014 : Auth: (1258) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:03:29 2014 : Auth: (1259) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:03:30 2014 : Auth: (1272) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:03:30 2014 : Auth: (1273) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:03:31 2014 : Auth: (1286) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc via TLS tunnel) Fri Jun 13 10:03:31 2014 : Auth: (1287) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli 90-72-40-dd-6a-cc) Fri Jun 13 10:04:27 2014 : Auth: (1361) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12754 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:04:27 2014 : Auth: (1362) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12754 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:05:20 2014 : Auth: (1489) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12964 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:05:20 2014 : Auth: (1490) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 12964 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:05:50 2014 : Auth: (1543) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli f0-b4-79-14-a0-7d via TLS tunnel) Fri Jun 13 10:05:50 2014 : Auth: (1544) Login OK: [userxb(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 29 cli f0-b4-79-14-a0-7d) Fri Jun 13 10:06:16 2014 : Auth: (1563) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13158 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:06:17 2014 : Auth: (1564) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13158 cli FC-25-3F-DC-34-4D) Fri Jun 13 10:06:21 2014 : Auth: (1579) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13175 cli FC-25-3F-DC-34-4D via TLS tunnel) Fri Jun 13 10:06:21 2014 : Auth: (1580) Login OK: [user932(a)uni-wuppertal.de] (from client radius1.eduroamclient.xy port 13175 cli FC-25-3F-DC-34-4D) -- --- Dipl.-Ing. Michael Simon ---- Bergische Universität Wuppertal - ZIM ------ Netzwerk- und Systemplanung -------- simon(a)uni-wuppertal.de --------- Tel. +49 202 439-2235 ---------- Fax. +49 202 439-2910

3 4

MSCHAP authentication against Active directory OR MySQL
by Krzysztof Grobelak 13 Jun '14

13 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello All, On my freeRADIUS instance i am able to authenticate MSCHAP requests against Active Directory using the ntlm_auth module and Samba aditionally i can authenticate another group of WiMAX devices with MACHAP against MySQL database. But if I enable the config for WiMAX devices the are being authenticated aginst Active Directory and not the MySQL db. Now I would like to be able to configure the server so that both groups can be authenticated local users against Active Directory and the WiMAX devices against database. Can you guys advice how i can make it happen? I suspect unlang will be needed to do this but if you could specify how exactly it would be awesome. would it be something along those lines?? authorise{ mschap{ if("%{NAS-IP-Address}" == "1.1.1.1"){ sql } else{ ntlm_auth } } } I hope I did not mixed up terminology too much ;) Regards, Krzysztof -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBAgAGBQJTma/YAAoJEM/U1HoKR/xkaq0IAJOcPRpsH61wh8sVHrafl0da mCVYN/T94FRSVsOgRtpCpz3zKtfiorla2bL06RN+EQhPxtyist8dX1xNyUnzETaR QcY+/OCDHtVtWX4GGiOMP75DaUNDOj76NtAGLZOe+48Jtjvv3aoSCO4MZgUhbIbN wY4vKxeuA5PJ0SVQD1D8rWIKxxZNwLj24gCowpAA9TJsS1qpqZfLMwYd+uu/vo1O 1ztX7rhkzFdNAn8fJkIpHQLPad0PcAohHevbwIzgivHBtM2euYHvgjFY7yQurSXh G0WuoeWSri3oc3QriTiMc+wIQb1QTSvyTzZwjXhcdB3D0NGJKe3MIPJfCQDIk80= =Fhp6 -----END PGP SIGNATURE----- Airspeed Telecom

2 2

question about 802.1x
by Daniel Soto 13 Jun '14

13 Jun '14

I have been trying without success to authenticate users in the 802.1x user file, is there a way to do it. ? I would create a default rule in the "users " file for all users starting at the domain " WINDOWS \ * " authenticate locally with the Auth -Type = Access My freeradius version is 2.1.12 thank you very much -- hi every body.

3 4

Unable to disconnect user after Max-Daily-Session
by Alexandre Rubert 13 Jun '14

13 Jun '14

Hello, I use Freeradius 2.1.10 for three years and my clients use coova to connect to my radius. In my MySQL database I set : radcheck : myusername --- Cleartext-Password --- := --- pass myusername --- Max-User-Machine --- := --- 1 myusername --- Max-All-Session --- := --- 300 myusername --- Max-Daily-Session --- := --- 170 radgroupreply: mygroup --- Acct-Interim-Interval --- := --- 90 radusergroup myusername --- mygroup --- 1 When I connect to my hotspot through coovachilli, I'm not disconnected after Max-Daily-Session (170seconds) but after Max-All-Session (300seconds) there is a Session-Timeout and I am disconnected. When I retry to connect Radius reply I've used all the time (300seconds) Now When I stay connected 200 seconds and disconnect mannualy. I can't reconnect due to the Max-Daily-Session. I think everything work but I'd like to be disconnected when I reach the Max-Daily-Session like when I reach the Max-All-Session. PS : Freeradius and Coova are not on the same machine, I don't know if it's a problem. Thanks

2 3

post-auth section in FR v2.1.12
by gabriel_skupien 13 Jun '14

13 Jun '14

I am using EAP-TLS and I am trying to use post-auth section to dynamically assign (based on the ldap group membership) vlan ID to the user. Leaving the LDAP part away for testing purposes and concentrating just on the post-auth section - I cannot make FR to override VLAN ID in post-auth section. Here is the config: post-auth { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-Id := "36" } exec Post-Auth-Type REJECT { attr_filter.access_reject } } And nothing happens here: .... # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[reply] returns noop ++[exec] returns noop Sending Access-Challenge of id 127 to X.X.X.X port 32769 Tunnel-Private-Group-Id:0 = "36" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd55884fdd75c9555353e80afe21cb577 Finished request 6. .... But it finally ends with this: ..... Sending Access-Accept of id 128 to X.X.X.X port 32769 Tunnel-Private-Group-Id:0 = "84" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Cisco-AVPair += "XXX" EAP-Message = 0xXXXX Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "XXXX" Finished request 7. Hence, 3 questions: 1) Does FR v2.1.12 support post-auth section? 2) Can you explain the aim of "Sending Access-Challenge" ? 2) Where is the best place to authorize users in LDAP while using EAP-TLS? Is it post-auth? ps. it works fine while authorizing users based on LDAP in the authorize section but we prefer to postpone this task to post-auth. In that way we can achieve to goals: -use ldap group membership for vlan assignments and -significantly reduce LDAP load jinx

4 8

syslog detail accounting
by Munroe Sollog 12 Jun '14

12 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I currently have freeradius 2.1.12 on a cent6 system. It is only being used to collect accounting data for a VPN. The RADIUS auth is happening somewhere else. The detail logs are currently being stored in /var/log/radius/radacct/<client IP>/detail-<daily-file>. However, while radius itself is logging to syslog, this detail file is not using syslog. My ultimate goal is to be able to forward all of these detail accounting logs to a central syslog server for analysis. My current solution is I have a daemon that watches all of the files, slurps it up and re-emits it as syslog data to an rsyslog server. I am hoping there is a way to configure freeradius to do this so I can dismantle my hack. - - Munroe -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Icedove - http://www.enigmail.net/ iQEcBAEBAgAGBQJTmdlmAAoJEPbbZiWCKDVCT88IAOzyHdS4wh1I4dsTAhCA+2e6 +Uty2U67YK3qRB3ZZ5MyZsmh1btIdwY9FqrbvHZJJrurMaekgI9sLaCwulbpfQC9 /TcJx7UqfWOSs+bJwk45sKOtB/DW9oC6KiBdaNXJzRPxg1KycptfEk25l+Qku84e sPEkH7lc4Agop7xdhEfftzPDnuDAulwIPCJcDKHl9jrKA76wgd+JTkH5CIZxLYH0 ow4teLwqozIRbD/BD3bFgrbK5y2w1jGMkBxKs1uf9M1p1gKbaYEL71ZUSBWF/2nx FmF6c2IMh2THYvKy4jK2BMWAp8e/r2Xc6KtmSAevQdSAMDNkH2CDIa5WsWbiuhs= =py0p -----END PGP SIGNATURE-----

5 8

RE: MSCHAPV2 authenticate including the suffix
by Dean Goldhill 12 Jun '14

12 Jun '14

Hello, Thanks for looking at this. I have attached 2 debug outputs, 1- using domain@user with TTLS & MSCHAPV2 (not EAP-MSCHAPV2) - does not work 2- using domain@user with TTLS & EAP-MSCHAPV2 - does work SO the issues is that when the username contains a suffix, using MSCHAPV2 (as opposed to EAP-MSCHAPV2) I get rejected. If using EAP-MSCHAPV2, it works fine. When using EAP-MSCHAPV2 the CHAP challenge and response messages are inside the EAP message, when using MSCHAPV2, the Chap messages are separate attributes within the inner tunnel. I.E: [ttls] Got tunneled request User-Name = "josef(a)testdomain.com" MS-CHAP-Challenge = 0x1bd3c8b9d05f712d166a28dc85032e3d MS-CHAP2-Response = 0xeb00e4aa1d015b333de96b68fa7258f868270000000000000000777975f5b969b39b08978f3ec81d1dd949960dde0f65af72 So this is 1- using domain@user with TTLS & MSCHAPV2 (not EAP-MSCHAPV2) - does not work: radiusd: FreeRADIUS Version 2.2.5, for host x86_64-redhat-linux-gnu, built on Apr 29 2014 at 09:18:14 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/sql/mysql/ippool-dhcp.conf including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 192.168.42.114 { require_message_authenticator = no secret = "radius" shortname = "test" } client 192.168.42.16 { require_message_authenticator = no secret = "radius" shortname = "test2" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "192.168.152.3" port = "" login = "freeradius" password = "freeradius" radius_db = "ManagedRADIUSWiFi" read_groups = yes sqltrace = yes sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':='" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to freeradius@192.168.152.3:/ManagedRADIUSWiFi rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 36002 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=70, length=151 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User EAP-Message = 0x0201000e01616e6f6e796d6f7573 User-Name = "anonymous" NAS-Port = 44309 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x5753364a5128f3c9e44d876ffa66a057 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> anonymous [sql] sql_set_user escaped user --> 'anonymous' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':=' -> SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' rlm_sql_mysql: query: SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 70 to 192.168.42.16 port 20008 EAP-Message = 0x010200160410274708d3fbb2f2884ede6102efa8fac5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13befe1b51ad39d66d296a9ad51 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=71, length=161 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13befe1b51ad39d66d296a9ad51 EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0xf289380646fc6271b4810647cfe84f1c # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[files] = noop [sql] expand: %{User-Name} -> anonymous [sql] sql_set_user escaped user --> 'anonymous' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':=' -> SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' rlm_sql_mysql: query: SELECT '111', 'anonymous', 'Cleartext-Password', (select GuestAuthRADIUS ('anonymous', 'AC-72-89-16-1B-1A' ,'192.168.42.16')), ':=' [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'anonymous' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'anonymous' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 71 to 192.168.42.16 port 20008 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13beee0a41ad39d66d296a9ad51 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=72, length=260 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13beee0a41ad39d66d296a9ad51 EAP-Message = 0x0203006915800000005f160301005a010000560301539878d34807df7593edd62e18def29542ada6f478c3f8ecdd45e04bef429d510000280039003800330032001600130035002f00150012000a0005000400090014001100030006000800ff01000005000f000101 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0xb15bf35f503ae46a166e90aa2cb51c83 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 105 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 95 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 005a], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 0036], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 08d0], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 72 to 192.168.42.16 port 20008 EAP-Message = 0x0104040015c000000b2b1603010036020000320301539877b727a2bb42e83ab4c8c3dfd371eda380e6cc19300db412e1a20a13701400003900000aff01000100000f00010116030108d00b0008cc0008c90003de308203da308202c2a003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361 EAP-Message = 0x746520417574686f72697479301e170d3134303631313135323730345a170d3135303631313135323730345a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d0a67f56d1218a0a58127603fe396e0160e12705798fdcffe06102c318b7ef9b2176b32f852224eeed482d2ae89f2a0e3b8b EAP-Message = 0xa64fa02f2fbaa1a39b287cd33eafabd326c98dba127ce8b0e44f48db533593598d5391fd079b633cbf92ab99027756e45356ec2ae2f0f32f28bceb364e0d2f123e6276560ef03a8a6fb1ebf4fd63b82006ddca60484df672e0ad74ea2188b295fbe028275a61cad572f73ab977ea9eba084c60677aef2bcc7762832524d649c1e832bd576f8b832583af68d50d6c8e8fa2bc68f417ad3e048042515ead2c650199bcf74b3459641692df0ba363a6c65e7d756e50ff80fc6dd178276bf719b41c1d9fc1338b9a7789a110287c1c4b0203010001a34f304d30130603551d25040c300a06082b0601050507030130360603551d1f042f302d302ba029a027 EAP-Message = 0x8625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d010105050003820101009d6e0fa587fab9dc4a9b4905c18f17669d904c6b5c3b1440304d5ce4625915e54cbbd7dfcce48441a51ed45798252e59ceede8362eb553b09e2c8d6be51940a1bb96ac0bcf06b7cdef5175605a7984c67b9058ac8a21f4b7397d3ac4f4e6677cd3302a78d865b433d2514255f6ae1b784f88ab2f01ec6ebd928591eeebd0dff400393bae2aa4acb14be31f56e824b9386f40ca8ed2e3026a17b27585d8079e7e86eb3a91c5dd07e552c31df48d67c4f8982e7aeb15358c5501bb7b5906f7935b06cb EAP-Message = 0x71200169cea51e7af1c334c0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13bede7a41ad39d66d296a9ad51 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=73, length=161 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13bede7a41ad39d66d296a9ad51 EAP-Message = 0x020400061500 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x9919f28a6ccf424901a11bc90785e61a # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 73 to 192.168.42.16 port 20008 EAP-Message = 0x0105040015c000000b2b1e7a5bff52453e4c9694a7407bf3e1e883321da050c6fa53e4a05a83d8c7077349330a2c1ac202be61c5c75833905c13f4ec0004e5308204e1308203c9a003020102020900dfa3486c6cb1f96e300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930 EAP-Message = 0x1e170d3134303631313135323730345a170d3135303631313135323730345a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c8fcd609bf8dd3edc91006985ff77c8643e8479cc90a5e4d5894e363b614dd90bf73272be715f9 EAP-Message = 0xe41b51c815ad8ce1cb9bfc5084ad728e75005644152bdd82e97809b77d2baa16e22fe4638a8516a11e9df56b7f6ea31e61f857caa5256a32d28a1d0f6e384f2ff4ee93e351069faf4ca06e682c7772ff53415e29f9bf076afe00f042d6c57063e558670fa4b5f4ad4a5ca28277fb789ca3e943f0f0b828831ae871a61aae88b3db06daae7df9356e4ab6afb2e6d148d9c2c9866e82ff857c9465ae636b517037f6bd8c8c9fbdafd5c5cd5305f015d4988f4cd34e38aaee5380a0f942f1c4c4b055a15c86b5f0aede98b5dc3b82d22cae163a484927fcf868bb0203010001a382013430820130301d0603551d0e041604140d99bc282493fbc134a9dec9 EAP-Message = 0xc277c212c932dd1d3081c80603551d230481c03081bd80140d99bc282493fbc134a9dec9c277c212c932dd1da18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900dfa3486c6cb1f96e300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777 EAP-Message = 0x772e6578616d706c652e636f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13bece6a41ad39d66d296a9ad51 Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=74, length=161 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13bece6a41ad39d66d296a9ad51 EAP-Message = 0x020500061500 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x42ccd33da273d165fe94cb08485725f3 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 74 to 192.168.42.16 port 20008 EAP-Message = 0x01060349158000000b2b6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010095c6536dc2a04e2b2508da21065191ea4ac1db7167daca4192246690a1087cf7b070972df9b8a62dd10be43c06f198c9d93f202ddf39691311bb27695fc8cb744f2218ffcdd6514f03078e595fc01ec9141342a81ac921a7396227603d7b4048222a29f38340ba361aacac3328e77cfcd520580aca674883469e5864b345e32a1c98bd9e74ce6e87ff7ff9b7f48608950bc56fb7ccae1aacea92edf7227813fc87390cce2bd04eb09881045a687723577faf1ba909af2beccfb646d835549e3d91dfe871212054884517001aa21426 EAP-Message = 0x97169fd53671f7a1944d9e1b03930cd247c33f567e49e8863f67e7625498cd069c8ee8ccdca8afab008e5160bfee716745160301020d0c0002090080ef8cb67830bf429c4b9ad4714e77aaa750c3db460d39315a8c6fcdfa5c4d9f2d1759901723a901aecd8a5488b65b6dea6dc9385ff769702783b1111064e222d4c4f9e1220b2b1863ca2764bed79f4de5cc029915f46e71b2e247f3efbea696b49dfaa6e54ed45fc427fdf0f3bfbf2e234172f350331fd40471e5a02d72504cf3000102008087eb3efa9305dc25e738b3c809d212dab5f3c46db43e605ec4567303aa8093ccfeea15eda7cfc4712b1c68c7d3ec96888cbf4a4c03d281c79aa0936f EAP-Message = 0xb282b38f87453a8f1f69ac5d9a930f1eeda767e6ddad449c6861cbe35c298b50c7d441b61c3e2ee9c76bccfbd99dd2476f5b340d95d06bfcfd49fa202130ea4aa8a6b23801003ff1e095cfb2fa5e706f707cc797f7379f7ee8d100ec4982a7d6eab8aa54f310a400189223023d0256c3fdc439f337b0448c61395d36988f388ccf4412dcfa41a0d3a0231ab9a5a05a6cd69ff658a95f12fad83dfb574ee0e7ae96327a7016af2eb3ff58977c7b14eb69c54e6dd9dee36c68cbe46999d5a774145d7816779d57cc5e90a9511522cc12ad85c7121daf5ae18fa867a84ddec3073073df68f410f14ad281c8b205e61c8bb568c3888af010738fed1cc7a204 EAP-Message = 0xdfd2cfdc7e48153e9f26e843b4c240024c7ad447963ae8b06ac5168336be99df211d9e31230cd0e5a9f600e84f9925461873a7dfe4d317e1555cb2fed7cda3ba3e01ee384b163bcfde16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13bebe5a41ad39d66d296a9ad51 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=75, length=363 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13bebe5a41ad39d66d296a9ad51 EAP-Message = 0x020600d01580000000c616030100861000008200809912a4353193f80d27e13256d7d9599ccf053866a1045ddb003667bf8c59aee651274ca600ec4f67a6e313a4b6acf4569185891b4241389077605ea710a5778ea9ed92a2f57eb700ccf60893eac836e9e5325d13b301a372a48c1a1c4be8eb4ac65693e704dac202aba70652931e3861506c6e57d9906ee323b338389fc79bea14030100010116030100308441ff34f8ba50ea7526ab96a8fdb322634eca5488c3d17293ef299b6df1f08513f772136509bd5a84587c797a20bb04 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x2c4cc7284a3bb559e0a44801d10521d0 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 208 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 198 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 75 to 192.168.42.16 port 20008 EAP-Message = 0x0107004515800000003b14030100010116030100304da578a541d3aeeb31afc9111c8ebb1e9ed16c02a7abf8b1549bfef95e0318ce49e87f19939786fa9f1526990c3f4bb1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xefe3b13beae4a41ad39d66d296a9ad51 Finished request 5. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.42.16 port 20008, id=76, length=314 NAS-Port-Id = "AP2/1" Calling-Station-Id = "AC-72-89-16-1B-1A" Called-Station-Id = "00-26-3E-62-42-86:GW-Auth" Service-Type = Framed-User User-Name = "anonymous" NAS-Port = 44309 State = 0xefe3b13beae4a41ad39d66d296a9ad51 EAP-Message = 0x0207009f1580000000951703010090572132c3bb100f7e832eb74bf857e6384aeb34021c9b0745c39f235bde009d1b409dad39bafeff6260237341e10c9fd063090c63503c2dbc3b1553de553c1873d88539fabe38c250f1dd1c9d2df2e9b2806190c098f4ebfd4a769c7f65154a1e02a708e129096b8d3e8fb0c6e8fe9bab2b43d71fcf6ad14e4fd8e676cb351b0e233467b65cccdbc25281355b3bdc0b40 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.42.16 NAS-Identifier = "Juniper" Message-Authenticator = 0x16f5285e0cd4416af24a8e8fd9ba000c # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 7 length 159 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 149 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "josef(a)testdomain.com" MS-CHAP-Challenge = 0x1bd3c8b9d05f712d166a28dc85032e3d MS-CHAP2-Response = 0xeb00e4aa1d015b333de96b68fa7258f868270000000000000000777975f5b969b39b08978f3ec81d1dd949960dde0f65af72 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "josef(a)testdomain.com" MS-CHAP-Challenge = 0x1bd3c8b9d05f712d166a28dc85032e3d MS-CHAP2-Response = 0xeb00e4aa1d015b333de96b68fa7258f868270000000000000000777975f5b969b39b08978f3ec81d1dd949960dde0f65af72 FreeRADIUS-Proxied-To = 127.0.0.1 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] = ok [suffix] Looking up realm "testdomain.com" for User-Name = "josef(a)testdomain.com" [suffix] No such realm "testdomain.com" ++[suffix] = noop ++update control { ++} # update control = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[files] = noop [sql] expand: %{User-Name} -> josef(a)testdomain.com [sql] sql_set_user escaped user --> 'josef(a)testdomain.com' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT '111', '%{SQL-User-Name}', 'Cleartext-Password', (select GuestAuthRADIUS ('%{SQL-User-Name}', '%{Calling-Station-Id}' ,'%{Packet-Src-IP-Address}')), ':=' -> SELECT '111', 'josef(a)testdomain.com', 'Cleartext-Password', (select GuestAuthRADIUS ('josef(a)testdomain.com', '' ,'192.168.42.16')), ':=' rlm_sql_mysql: query: SELECT '111', 'josef(a)testdomain.com', 'Cleartext-Password', (select GuestAuthRADIUS ('josef(a)testdomain.com', '' ,'192.168.42.16')), ':=' [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'josef(a)testdomain.com' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'josef(a)testdomain.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'josef(a)testdomain.com' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = BINARY 'josef(a)testdomain.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = ok Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group MS-CHAP { [mschap] Creating challenge hash with username: josef(a)testdomain.com [mschap] Client is using MS-CHAPv2 for josef(a)testdomain.com, we need NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject +} # group MS-CHAP = reject Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> josef(a)testdomain.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated } # server inner-tunnel [ttls] Got tunneled reply code 3 MS-CHAP-Error = "\353E=691 R=1" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 76 to 192.168.42.16 port 20008 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds.

2 1