- Freeradius-Users - lists.freeradius.org

Mac OSX + PEAP/MSCHAPv2 + Special characters in password
by Olivier Beytrison 15 May '14

15 May '14

Hello, One of our institution reported that some of their users, using Mac OSX, couldn't connect to eduroam. It appears that those users have special characters in their password (éà§£ ect). I can log with such an account using Windows, iOS, Android or eapol_test, but with the default settings on Mac OSX (PEAP/MSCHAPv2) it fails : mschap : MS-CHAP2-Response is incorrect. The current workaround at the moment is to deploy a .mobileconfig profile to configure their 802.1x settings to use TTLS/PAP, which works correctly. We spent some time debugging this issue with Arran and think that's an implementation error by MacOSX regarding the encoding of the password used to generated the hash for MSCHAPv2. But so far I wasn't able to confirm it by looking at the Apple discussion forums. Has anyone of you also encountered this issue ? Regards, Olivier B. -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier(a)heliosnet.org

5 10

Version 3.0.3 has been released
by Alan DeKok 15 May '14

15 May '14

The release notes are available at the usual URL: http://freeradius.org/version3.html Anyone following the git repo will notice massive amounts of commits over the last month. Arran and I have been doing exhaustive testing of the server in a wide variety of circumstances. We've also been running it through three different static analysis tools, and ensuring that the builds are clean. The main highlights of 3.0.3 are: * more of the config is parsed and validated when the server starts. This means typos will be caught immediately, rather than resulting in obscure run-time errors. * DHCP NAKs can be controllably delayed. This lets FreeRADIUS work with horribly broken NAS equipment * The detail file reader is now threaded (where possible) This should greatly improve performance for reading the files * Everything now builds with no warnings from the C compiler, clang static analyzer, or cppcheck. Coverity has 2 minor complains which can be ignored. A number of minor issues found by Code Sonar were also fixed * Allow tag and array references anywhere attributes are allowed in "unlang". This makes the configuration more consistent and simpler * Double-escaping of characters in Perl, and octal characters has been fixed. If your configuration has text like "\\000", you will need to remove one backslash. * Many minor bug fixes, updates to error messages, and consistency fixes Alan DeKok.

5 13

Accounting start and stop time
by Karsten Honsack 15 May '14

15 May '14

Hi Mailinglist-Users, i have a question regarding to the accounting in freeradius. Which part defines the acctstarttime and acctstoptime? The Client? The Server? The Nas? In my accounting Database the time is mostly right but sometimes it is NULL or 1878-03-30. Thank you! -- Rheinische Friedrich-Wilhelms-Universität Bonn Hochschulrechenzentrum Karsten Honsack Wegelerstraße 6 53115 Bonn Tel.: +49 (0)228 73-3456

3 3

Fwd: Radius attributes sent in the wrong packet
by Jan-Ivar Hansen 14 May '14

14 May '14

Hi all! Please excuse me if this is a stupid question, but I'm new to both Linux and FreeRadius, so please have patience with me :) I have tried to set up a FreeRadius/daloRadius/MySql to authenticate users logging on to a Meraki AccessPoint and want to use Radius attributes to override the VLAN for the user. The authentication part works (EAP), but the attributes seems to be sent back to the AP in a Access-Challenge packet, while Meraki needs them to be in the Accept-Accept packet. Do anyone have any suggestions on what I have done wrong since I get this behaviour? Below is the Freeradius -X output, but please let me know if there is any more info I should provide: rad_recv: Access-Request packet from host 10.200.30.210 port 32773, id=204, length=156 User-Name = "kenolsen" NAS-IP-Address = 10.200.30.210 NAS-Port = 0 Called-Station-Id = "00-18-0A-22-81-F0:OIP WiFi" Calling-Station-Id = "74-E1-B6-BA-72-0C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0200000d016b656e6f6c73656e Message-Authenticator = 0xd48e676b8975dc40ae0b7df8b5b866de # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> kenolsen [sql] sql_set_user escaped user --> 'kenolsen' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'kenolsen' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'kenolsen' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'kenolsen' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'ext_kenneth' ORDER BY id [sql] User found in group ext_kenneth [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'ext_kenneth' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 204 to 10.200.30.210 port 32773 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1074" Tunnel-Type:0 = VLAN Filter-Id = "ext_kenneth" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89791f5d897806e31f4b857d445452c2 Finished request 54. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.200.30.210 port 32773, id=205, length=313 User-Name = "kenolsen" NAS-IP-Address = 10.200.30.210 NAS-Port = 0 Called-Station-Id = "00-18-0A-22-81-F0:OIP WiFi" Calling-Station-Id = "74-E1-B6-BA-72-0C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0201009819800000008e1603010089010000850301537328e57ad8721aaca3a6e92b0dfa868dc69e9f05858f21fa893789b2fe20ba00004a00ffc024c023c00ac009c007c008c028c027c014c013c011c012c026c025c02ac029c005c004c002c003c00fc00ec00cc00d003d003c002f000500040035000a0067006b00330039001601000012000a00080006001700180019000b00020100 State = 0x89791f5d897806e31f4b857d445452c2 Message-Authenticator = 0x2b88d5e0c5c86dcfdf2b1c4b2e27a56e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 152 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 142 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0089], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0039], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 02cc], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 205 to 10.200.30.210 port 32773 EAP-Message = 0x0102040019c00000046816030100390200003503011dad871036647c20b8574e35f71995aa73797edcbcd01dbd667dbb48258497c400c01400000dff01000100000b00040300010216030102cc0b0002c80002c50002c2308202be308201a6a003020102020900ac021e13336fac03300d06092a864886f70d01010b05003017311530130603550403130c7562756e7475726164697573301e170d3134303530323138333731345a170d3234303432393138333731345a3017311530130603550403130c7562756e747572616469757330820122300d06092a864886f70d01010105000382010f003082010a0282010100e9581f74a35280ab518c25b5 EAP-Message = 0xcedba6c81f8e235b9762f71f084d32dd193caec09e5e4f237129f9dcd168c2f104b3aa27b511d0fe14bb4222b06c69772b1cb445f713576c2094247dac23ba523a5acc3217d810d26baed3e362d8209183eb75e86f8a726388b373c21edbf43d14b94e356d21572b43da914c882531dd68ebf2c5abfd330ff2eac4cab9af33e79a1be14dbeaf61965580bdac6527cb3beea804131f3f87ae30b8fbf812aaa8f042958a54147a9968c13403f0f11477fc022faadf92a1894b97a6f7cc0c4074542ff88c2db4954dddde11d6bcc8b8cf53386ff8e4434dccac5ee39de63d7ca627f45cf0c30e8404cc37e5ed41907b7d584d29e9330203010001a30d300b EAP-Message = 0x30090603551d1304023000300d06092a864886f70d01010b050003820101002ac1663a6516b752f429fad02eaec1d3eb6c3a346e0c42e809a390d388227558ff65d362bf5551c985abdf3709fd5e6cc5462e3f2df1ebf7eb6cd9e7580f8a47d788bd4b6a9fcb1dcb16c9451659db29e6794cf00cdfd798fff297fcdd1a52597b01ef8c9b463eef515239afe718675cbcc11467fad707e84a965836f78c32dcb49f0f56951a9324193b0f5e3d034d11a714d2d05f7d2169765d2eabc9f4fefed46647a4a949ec29de522c61e0fb3e13c71a344d682f8ea53d52d0108d29c111bdaf08d61b4b12120396125d3669c3dba106a763ff0e80764501f0f630c1 EAP-Message = 0x9a673296a8ab4a178b902ad27f84e8bc51d4776804d752c5491a208a1ba790d8b2bc160301014b0c00014703001741044bea19b4123a8e1f813f354c371e53837bd59da7a923ef7fed1e5d7136392f19bcfbab3e4d9a3a535ca592e441b1287e930887c61729d0723d3e8eef4d28176b0100a78741c2fa11e1a58504346f8e14532adadd6226e7b33545f3ed2d8720a4f383cdd5c038b145c784df485d676a9abaecc3142e616b3942d1a819353c4948e46c19eac709fe009a185fdce3746562c6d057e7fe1aed08bac2ccd1562c9a70b788a1fd5660155a015c32aecbea077cfc324eb2e6a7128997f8aaf61a164a67b516bc75271237db76b6a1d514 EAP-Message = 0x72a1101e42f39faa95f47a5a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89791f5d887b06e31f4b857d445452c2 Finished request 55. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.200.30.210 port 32773, id=206, length=167 User-Name = "kenolsen" NAS-IP-Address = 10.200.30.210 NAS-Port = 0 Called-Station-Id = "00-18-0A-22-81-F0:OIP WiFi" Calling-Station-Id = "74-E1-B6-BA-72-0C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020200061900 State = 0x89791f5d887b06e31f4b857d445452c2 Message-Authenticator = 0x394037ddb3b0fdbf46f42ae3223d445d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 206 to 10.200.30.210 port 32773 EAP-Message = 0x0103007819003732e9439005ca9b383b2a85d0436a86416a80f59fbf23cff4e758bb28b07ef6affd47dae2d117d4610cd53941468ae58ac04790c46df96846a2fe3a5be146588cab8a994df221155ca0a716de3ba5b3eee7f5618946e8286d197e26ee0c4fc8923e2af5e06d0747fb16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89791f5d8b7a06e31f4b857d445452c2 Finished request 56. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.200.30.210 port 32773, id=207, length=305 User-Name = "kenolsen" NAS-IP-Address = 10.200.30.210 NAS-Port = 0 Called-Station-Id = "00-18-0A-22-81-F0:OIP WiFi" Calling-Station-Id = "74-E1-B6-BA-72-0C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0203009019800000008616030100461000004241045594ec9c45c56983087ee7f91eaaaefaa65032b687010df247207f6a0cd8005dfa15648f7b7ff91d885851d7f8ee0653653ae7e6b281c4927bd53394496befe7140301000101160301003029a2298cd0bacb7b20b4b1829a7629dd304c854359504524bf4fd6a4813e56b479b0f4ee5496d102d39ffb9703c40189 State = 0x89791f5d8b7a06e31f4b857d445452c2 Message-Authenticator = 0xc50f2f7b4a32a29dda8f343ced424816 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 134 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 207 to 10.200.30.210 port 32773 EAP-Message = 0x01040041190014030100010116030100308fe191de88bb7fea6f8ee608099440717fbf95bfcbda0f10edbcdec19613b0bb609f1a046dbcbf60202dca0fb7fbd104 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89791f5d8a7d06e31f4b857d445452c2 Finished request 57. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.200.30.210 port 32773, id=208, length=167 User-Name = "kenolsen" NAS-IP-Address = 10.200.30.210 NAS-Port = 0 Called-Station-Id = "00-18-0A-22-81-F0:OIP WiFi" Calling-Station-Id = "74-E1-B6-BA-72-0C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020400061900 State = 0x89791f5d8a7d06e31f4b857d445452c2 Message-Authenticator = 0xcb9d2a18897c7f67f1763c2c11e11a0f # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 208 to 10.200.30.210 port 32773 EAP-Message = 0x0105002b19001703010020d91162c1d81bf6ab6e5d8621dea9fe70392b1202506d88628bc0f14a27aa7918 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89791f5d8d7c06e31f4b857d445452c2 Finished request 58. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.200.30.210 port 32773, id=209, length=204 User-Name = "kenolsen" NAS-IP-Address = 10.200.30.210 NAS-Port = 0 Called-Station-Id = "00-18-0A-22-81-F0:OIP WiFi" Calling-Station-Id = "74-E1-B6-BA-72-0C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0205002b19001703010020fa27eeccbbc2bd134e39ae7caba12b8d0f18105d7977c3aff8ab6f988f7726b6 State = 0x89791f5d8d7c06e31f4b857d445452c2 Message-Authenticator = 0xeeb9b317c2e9c14168d5e08e8858071a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - kenolsen [peap] Got inner identity 'kenolsen' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0205000d016b656e6f6c73656e server { [peap] Setting User-Name to kenolsen Sending tunneled request EAP-Message = 0x0205000d016b656e6f6c73656e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "kenolsen" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 5 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> kenolsen [sql] sql_set_user escaped user --> 'kenolsen' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'kenolsen' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'kenolsen' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'kenolsen' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'ext_kenneth' ORDER BY id [sql] User found in group ext_kenneth [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'ext_kenneth' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1074" Tunnel-Type:0 = VLAN Filter-Id = "ext_kenneth" EAP-Message = 0x010600221a0106001d10256bbeb94704e7c7167dca04979c1e626b656e6f6c73656e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf91b84c8f91d9eac41ebdf4972430c9b [peap] Got tunneled reply RADIUS code 11 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1074" Tunnel-Type:0 = VLAN Filter-Id = "ext_kenneth" EAP-Message = 0x010600221a0106001d10256bbeb94704e7c7167dca04979c1e626b656e6f6c73656e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf91b84c8f91d9eac41ebdf4972430c9b [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 209 to 10.200.30.210 port 32773 EAP-Message = 0x0106004b1900170301004064907aed054cfeccb100a980d466367158a766137fa38a3068cd4b89bb7ecba7a1b1c77482d4827899cf0ff2145ccfff18987b4c1e92a5268799359040077654 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89791f5d8c7f06e31f4b857d445452c2 Finished request 59. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.200.30.210 port 32773, id=210, length=268 User-Name = "kenolsen" NAS-IP-Address = 10.200.30.210 NAS-Port = 0 Called-Station-Id = "00-18-0A-22-81-F0:OIP WiFi" Calling-Station-Id = "74-E1-B6-BA-72-0C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0206006b19001703010060336b6f124c1b571e2aa169389df561909bcfe7039f1f5a03234de50d80091740d49cd8c1e099318e4835407bd6a2071c01b80b6c46dc5e94601079e89d199e4f165c6e809af34374a53cc1c74313f5881138c09aa0eb44614de08c05df47154f State = 0x89791f5d8c7f06e31f4b857d445452c2 Message-Authenticator = 0x29f944cc1f7f6e54d5a07ba3303542f6 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020600431a0206003e318e2efd553869920b66176b5c5ed263d0000000000000000070b6121e45b577d6fddc595bd0eeac6640904df533a6bee3006b656e6f6c73656e server { [peap] Setting User-Name to kenolsen Sending tunneled request EAP-Message = 0x020600431a0206003e318e2efd553869920b66176b5c5ed263d0000000000000000070b6121e45b577d6fddc595bd0eeac6640904df533a6bee3006b656e6f6c73656e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "kenolsen" State = 0xf91b84c8f91d9eac41ebdf4972430c9b server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 67 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> kenolsen [sql] sql_set_user escaped user --> 'kenolsen' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'kenolsen' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'kenolsen' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'kenolsen' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'ext_kenneth' ORDER BY id [sql] User found in group ext_kenneth [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'ext_kenneth' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: kenolsen [mschap] Told to do MS-CHAPv2 for kenolsen with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1074" Tunnel-Type:0 = VLAN Filter-Id = "ext_kenneth" EAP-Message = 0x010700331a0306002e533d36434246424633333039373935433938383538433438363934394637313233344535424545323237 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf91b84c8f81c9eac41ebdf4972430c9b [peap] Got tunneled reply RADIUS code 11 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1074" Tunnel-Type:0 = VLAN Filter-Id = "ext_kenneth" EAP-Message = 0x010700331a0306002e533d36434246424633333039373935433938383538433438363934394637313233344535424545323237 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf91b84c8f81c9eac41ebdf4972430c9b [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 210 to 10.200.30.210 port 32773 EAP-Message = 0x0107005b19001703010050ad29dd793787e29fa7a506c5989bf283b193cff7502e0dd8fd52f5d180c0bc5615c76d86b2bd5e2260dff9ffb2a8aae8b5ff443dd30bff2a9fded9dfe79c9b0296b16d23e23ee6bdebb261ffc64acc65 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89791f5d8f7e06e31f4b857d445452c2 Finished request 60. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.200.30.210 port 32773, id=211, length=204 User-Name = "kenolsen" NAS-IP-Address = 10.200.30.210 NAS-Port = 0 Called-Station-Id = "00-18-0A-22-81-F0:OIP WiFi" Calling-Station-Id = "74-E1-B6-BA-72-0C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0207002b19001703010020a0b3ebc1fad29d64094462a34bd388d1296a2a1d89c6e32a740f4f0449c1bdd8 State = 0x89791f5d8f7e06e31f4b857d445452c2 Message-Authenticator = 0x8e4244440c13ad3141e4c5d5f38de28d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700061a03 server { [peap] Setting User-Name to kenolsen Sending tunneled request EAP-Message = 0x020700061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "kenolsen" State = 0xf91b84c8f81c9eac41ebdf4972430c9b server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> kenolsen [sql] sql_set_user escaped user --> 'kenolsen' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'kenolsen' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'kenolsen' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'kenolsen' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'ext_kenneth' ORDER BY id [sql] User found in group ext_kenneth [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'ext_kenneth' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group post-auth {...} [sql] expand: %{User-Name} -> kenolsen [sql] sql_set_user escaped user --> 'kenolsen' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'kenolsen', '', 'Access-Accept', '2014-05-14 10:27:17') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'kenolsen', '', 'Access-Accept', '2014-05-14 10:27:17') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1074" Tunnel-Type:0 = VLAN Filter-Id = "ext_kenneth" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x292b03d1d71d918f92a7a1c71d3947da MS-MPPE-Recv-Key = 0x85063f06d1fd87ecf9a50aba1f5de2c1 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "kenolsen" [peap] Got tunneled reply RADIUS code 2 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1074" Tunnel-Type:0 = VLAN Filter-Id = "ext_kenneth" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x292b03d1d71d918f92a7a1c71d3947da MS-MPPE-Recv-Key = 0x85063f06d1fd87ecf9a50aba1f5de2c1 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "kenolsen" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 211 to 10.200.30.210 port 32773 EAP-Message = 0x0108002b19001703010020cd3aca9070802ab7d205d353bd0e2a804426053fbf6136b5dbf3d6b501c3123d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x89791f5d8e7106e31f4b857d445452c2 Finished request 61. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.200.30.210 port 32773, id=212, length=204 User-Name = "kenolsen" NAS-IP-Address = 10.200.30.210 NAS-Port = 0 Called-Station-Id = "00-18-0A-22-81-F0:OIP WiFi" Calling-Station-Id = "74-E1-B6-BA-72-0C" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0208002b19001703010020d04c58c70d255ea291896a91cccaddb422002fa0744b17c8cf87e32e0c64f2e3 State = 0x89791f5d8e7106e31f4b857d445452c2 Message-Authenticator = 0x6719a85861f6424e1e18d6a1fe2bc9c6 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "kenolsen", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> kenolsen [sql] sql_set_user escaped user --> 'kenolsen' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'kenolsen', '', 'Access-Accept', '2014-05-14 10:27:17') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'kenolsen', '', 'Access-Accept', '2014-05-14 10:27:17') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 212 to 10.200.30.210 port 32773 MS-MPPE-Recv-Key = 0xf711f46ef6d9c788413cf7c8eed91729daeadf901d63a58c1f89a3d06452eb73 MS-MPPE-Send-Key = 0x0513d5a68982c335ec6b23cb6e805f2bc8e22b03ee0f1bc0bbdc324970f31779 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "kenolsen" Finished request 62. Going to the next request Waking up in 4.8 seconds. Cleaning up request 54 ID 204 with timestamp +3210 Cleaning up request 55 ID 205 with timestamp +3210 Cleaning up request 56 ID 206 with timestamp +3210 Cleaning up request 57 ID 207 with timestamp +3210 Cleaning up request 58 ID 208 with timestamp +3210 Cleaning up request 59 ID 209 with timestamp +3210 Cleaning up request 60 ID 210 with timestamp +3210 Cleaning up request 61 ID 211 with timestamp +3210 Cleaning up request 62 ID 212 with timestamp +3210 Ready to process requests. Regards Jan-Ivar

2 2

Ignore privileged users in PAM_RADIUS auth
by Bob Probert 14 May '14

14 May '14

Hello all, I'm developing PAM policy for a server in which my organization doesn't have control of the RADIUS infrastructure. This particular system is using the RADIUS PAM module only for authentication purposes -- an account must be present on the system in order for a login to be successful. The users of this system must never have access to two accounts -- one we'll call 'system' the other is 'root'. The PAM configuration has 'PAM_RADIUS auth sufficient' prior to Unix auth. I'm concerned that if a RADIUS administrator adds an account for 'root' or 'system' in the RADIUS infrastructure, the user will then get unauthorized "root" or "system" access. Has anyone on the list encountered a similar issue? After inspecting the RADIUS PAM module code, it appears that there aren't any hooks for disabling RADIUS auth for certain users. This appears to be a rather trivial feature to implement, if I add this functionality to the module, is there any interest in my patch? Any other ideas? Thanks!

3 3

Re:Mac OSX + PEAP/MSCHAPv2 + Special characters in password (Olivier Beytrison)
by Rui Ribeiro 14 May '14

14 May '14

Yes, an workmate last year with OS/X 10.6 or 10.7, locale pt_PT, trying to login using a ' char as part of the password. Regards, Rui Ribeiro pt.linkedin.com/pub/rui-ribeiro/16/ab8/434/ > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 14 May 2014 14:44:27 +0200 > From: Olivier Beytrison <olivier(a)heliosnet.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Mac OSX + PEAP/MSCHAPv2 + Special characters in password > Message-ID: <5373652B.80705(a)heliosnet.org> > Content-Type: text/plain; charset=ISO-8859-1 > > Hello, > > One of our institution reported that some of their users, using Mac OSX, > couldn't connect to eduroam. It appears that those users have special > characters in their password (???? ect). > > I can log with such an account using Windows, iOS, Android or > eapol_test, but with the default settings on Mac OSX (PEAP/MSCHAPv2) it > fails : mschap : MS-CHAP2-Response is incorrect. > > The current workaround at the moment is to deploy a .mobileconfig > profile to configure their 802.1x settings to use TTLS/PAP, which works > correctly. > > We spent some time debugging this issue with Arran and think that's an > implementation error by MacOSX regarding the encoding of the password > used to generated the hash for MSCHAPv2. But so far I wasn't able to > confirm it by looking at the Apple discussion forums. > > Has anyone of you also encountered this issue ? > > Regards, > Olivier B. > -- > > Olivier Beytrison > Network & Security Engineer, HES-SO Fribourg > Mail: olivier(a)heliosnet.org > >

1 0

Inconsistent behaviour between -X and raddebug
by Adam Bishop 14 May '14

14 May '14

Good Afternoon, When running raddebug on 2.2.5 I noticed that there seemed to be 2 extra attributes being added into each access accept - EAP-MSK and EAP-EMSK. -X doesn’t do this (and fortunately, FreeRADIUS isn’t actually secretly putting things in to the access accept and not mentioning it). Aside from confusing me for several minutes it’s a cosmetic issue, but what’s the cause of this behaviour? Does raddebug show attributes before they hit the attribute filters perhaps? Regards, Adam Bishop gpg: 0x6609D460 Janet, the UK's research and education network. Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238

2 1

SSH, PAM and FR authentication
by David Li 14 May '14

14 May '14

Hi, My question perhaps is crossing boundaries of Openssh, PAM and FR. I did some Google search but can't seem to find an answer. It seems if I don't have a user prior configured in a "datastore" e.g. /etc/passwd, mysql or ldap, then my attempt to login using ssh as the user would just fail even if I have the user set up in FR server. Several posts on the Internet suggested that there might be a need for a "libnss-radius" like package to allow ssh to look up the user in FR. I am wondering if there are some security reasons that no such package has been developed so far. People must have thought about this I guess. Besides configuring the user id in a separate datastore prior to authentication, is there any other way to solve this issue. Best, David

2 1

xascendsessionsvrkey (data too long) in freeradius 2.2.5
by mohammed Erheem 13 May '14

13 May '14

I installed freeradius 2.2.5 and i have problem with acounting Error: [sql] Couldn't insert SQL accounting START record - Data too long for column 'xascendsessionsvrkey' at row 1 i can't alter radacct table because i have more than 20 million records I try to use freeradius with test database after alter xascendsessionsvrkey to varchaer(255) the value of xascendsessionsvrkey like ===> 3134:4235:3936::/57 ip v6 disable on radius and database server

3 5

freeradius and yubikeys
by Frederic Van Espen 13 May '14

13 May '14

Hi, I'm evaluating the use of yubikey OTP's in combination with freeradius and I'd like to know if there's people out there who can share the experience. In particular: - In which mode are you using the yubikey? - How are you verifying the OTP's? through PAM or through another module? Thanks for any response, Frederic

4 27