- Freeradius-Users - lists.freeradius.org

regarding cisco dhcp relay agent-generation of circuit id for authentication
by Mahima Kumar 15 Mar '14

15 Mar '14

Please take a look at my config or please Can anyone please post here configuration of a cisco router or switch acting as a dhcp relay agent which generates circuit id and based on this circuit id i can get my client authenticated from the freeradius server and client gets ip address from dhcp server (i have a server which is working fine). I have tried all the possible configs online , but i am unable to get the circuit id. *Cisco 2900 as relay agent configuration :* Scenario 1 ) client --- cisco router relay agent ---- radius and dhcp server Router#sh run Building configuration... Current configuration : 1330 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 10 ! ! ip cef ip dhcp relay information option no ip dhcp relay information check ip dhcp relay information trust-all ! ! multilink bundle-name authenticated ! ! voice-card 0 no dspfarm ! ! vlan internal allocation policy ascending ! interface GigabitEthernet0/0 ip dhcp relay information option-insert ip address 192.168.1.1 255.255.255.0 ip helper-address 10.3.31.40 ip directed-broadcast duplex auto speed auto ! interface GigabitEthernet0/1 ip address 10.3.31.250 255.255.255.0 ip directed-broadcast duplex auto speed auto ! interface Serial0/0/0 no ip address shutdown no fair-queue clock rate 2000000 ! interface Serial0/0/1 no ip address shutdown clock rate 2000000 ! interface Vlan1 no ip address ! ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 ! ip http server no ip http secure-server ! control-plane ! ! line con 0 line aux 0 line vty 0 4 login ! scheduler allocate 20000 1000 ! end Router# *DEBUG OUTPUT * *Mar 14 22:56:53.233: DHCPD: Sending notification of DISCOVER: *Mar 14 22:56:53.233: DHCPD: htype 1 chaddr 0017.e069.24c0 *Mar 14 22:56:53.233: DHCPD: remote id 020a0000c0a8010100000000 *Mar 14 22:56:53.233: DHCPD: circuit id 00000000 *Mar 14 22:56:53.233: DHCPD: setting giaddr to 192.168.1.1. *Mar 14 22:56:53.233: DHCPD: adding relay information option. *Mar 14 22:56:53.233: DHCPD: BOOTREQUEST from 0063.6973.636f.2d30.3031.372e.6530.3639.2e32.3463 .302d.4769.302f.30 forwarded to 10.3.31.40. *Mar 14 22:56:56.765: DHCPD: Sending notification of DISCOVER: *Mar 14 22:56:56.765: DHCPD: htype 1 chaddr 0017.e069.24c0 *Mar 14 22:56:56.765: DHCPD: remote id 020a0000c0a8010100000000 *Mar 14 22:56:56.765: DHCPD: circuit id 00000000 *Mar 14 22:56:56.765: DHCPD: setting giaddr to 192.168.1.1. *Mar 14 22:56:56.765: DHCPD: adding relay information option. *Mar 14 22:56:56.765: DHCPD: BOOTREQUEST from 0063.6973.636f.2d30.3031.372e.6530.3639.2e32.3463 .302d.4769.302f.30 forwarded to 10.3.31.40. *Mar 14 22:56:56.785: DHCP: XID did NOT MATCH in dhcpc_for_us() *Mar 14 22:56:56.785: DHCPD: forwarding BOOTREPLY to client 0017.e069.24c0. *Mar 14 22:56:56.785: DHCPD: No vpn from sub-option, using global *Mar 14 22:56:56.785: DHCPD: Setting giaddr to 192.168.1.1 *Mar 14 22:56:56.785: DHCPD: Forwarding reply on numbered intf *Mar 14 22:56:56.785: DHCPD: relay information option is removed *Mar 14 22:56:56.785: DHCPD: broadcasting BOOTREPLY to client 0017.e069.24c0. *Mar 14 22:56:56.789: DHCPD: Finding a relay for client 0063.6973.636f.2d30.3031.372e.6530.3639 .2e32.3463.302d.4769.302f.30 on interface GigabitEthernet0/0. *Mar 14 22:56:56.789: DHCPD: Seeing if there is an internally specified pool class: *Mar 14 22:56:56.789: DHCPD: htype 1 chaddr 0017.e069.24c0 *Mar 14 22:56:56.789: DHCPD: remote id 020a0000c0a8010100000000 *Mar 14 22:56:56.789: DHCPD: circuit id 00000000 *Mar 14 22:56:56.789: DHCPD: there is no pool for 192.168.1.1. *Mar 14 22:56:56.789: DHCPD: setting giaddr to 192.168.1.1. *Mar 14 22:56:56.789: DHCPD: adding relay information option. *Mar 14 22:56:56.789: DHCPD: BOOTREQUEST from 0063.6973.636f.2d30.3031.372e.6530.3639.2e32.3463 .302d.4769.302f.30 forwarded to 10.3.31.40. *Mar 14 22:56:56.805: DHCP: XID did NOT MATCH in dhcpc_for_us() *Mar 14 22:56:56.805: DHCPD: forwarding BOOTREPLY to client 0017.e069.24c0. *Mar 14 22:56:56.805: DHCPD: No vpn from sub-option, using global *Mar 14 22:56:56.805: DHCPD: Setting giaddr to 192.168.1.1 *Mar 14 22:56:56.805: DHCPD: Forwarding reply on numbered intf *Mar 14 22:56:56.805: DHCPD: relay information option is removed *Mar 14 22:56:56.805: DHCPD: broadcasting BOOTREPLY to client 0017.e069.24c0. PROBLEM : the circuit id value is 0. I need a circuit id to authenticate client from radius server. my client is getting ip address from the dhcp server, and there is end to end connectivity from client---cisco relay agent --- radius and dhcp server . But i need to authenticate my client based on the circuit id generated by the relay agent. *Scenario 2) Switch 3750 as relay agent * client --- switch as relay agent --- radius and dhcp server Switch#sh run Building configuration... Current configuration : 1869 bytes ! version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Switch ! boot-start-marker boot-end-marker ! ! no aaa new-model switch 1 provision ws-c3750g-24ps system mtu routing 1600 ip subnet-zero ip routing ip dhcp relay information option no ip dhcp relay information check ip dhcp relay information trust-all ! spanning-tree mode pvst spanning-tree etherchannel guard misconfig spanning-tree extend system-id ! vlan internal allocation policy ascending ! interface GigabitEthernet1/0/1 switchport access vlan 5 switchport mode access ! interface GigabitEthernet1/0/2 ! interface GigabitEthernet1/0/3 no switchport ip address 10.3.31.250 255.255.255.0 ! interface GigabitEthernet1/0/4 ! ! interface Vlan1 no ip address shutdown ! interface Vlan5 ip dhcp relay information option-insert ip address 192.168.1.1 255.255.255.0 ip helper-address 10.3.31.40 ! ip classless ip http server ! control-plane ! ! line con 0 line vty 5 15 ! end Switch# *DEBUG OUTPUT: * *Mar 1 00:36:39.073: DHCPD: interface Vlan5 coming up *Mar 1 00:36:40.382: DHCPD: Reload workspace interface Vlan5 tableid 0. *Mar 1 00:36:40.382: DHCPD: tableid for 192.168.1.1 on Vlan5 is 0 *Mar 1 00:36:40.382: DHCPD: client's VPN is . *Mar 1 00:36:40.382: DHCPD: Sending notification of DISCOVER: *Mar 1 00:36:40.382: DHCPD: htype 1 chaddr 0017.e069.24c0 *Mar 1 00:36:40.382: DHCPD: remote id 020a0000c0a8010105000000 *Mar 1 00:36:40.382: DHCPD: interface = Vlan5 *Mar 1 00:36:40.382: DHCPD: Looking up binding using address 192.168.1.1 *Mar 1 00:36:40.382: DHCPD: setting giaddr to 192.168.1.1. *Mar 1 00:36:40.382: DHCPD: adding relay information option. *Mar 1 00:36:40.382: DHCPD: BOOTREQUEST from 0063.6973.636f.2d30.3031.372e.6530.3639.2e32.3463.302d.4769.302f.30 forwarded to 10.3.31.40. *Mar 1 00:36:40.407: DHCP: XID did NOT MATCH in dhcpc_for_us() *Mar 1 00:36:40.407: DHCPD: Reload workspace interface GigabitEthernet1/0/3 tableid 0. *Mar 1 00:36:40.407: DHCPD: tableid for 10.3.31.250 on GigabitEthernet1/0/3 is 0 *Mar 1 00:36:40.407: DHCPD: client's VPN is . *Mar 1 00:36:40.407: DHCPD: DHCPOFFER notify setup address 192.168.1.5 mask 255.255.255.0 *Mar 1 00:36:40.407: DHCPD: forwarding BOOTREPLY to client 0017.e069.24c0. *Mar 1 00:36:40.407: DHCPD: Forwarding reply on numbered intf *Mar 1 00:36:40.407: DHCPD: Option82 is currently: *Mar 1 00:36:40.407: 0109312f312f313a31303002157375622d70726f662d312d736c612d70726f662d31 *Mar 1 00:36:40.407: DHCPD: Removing option82 information *Mar 1 00:36:40.407: DHCPD: relay information option removed *Mar 1 00:36:40.407: DHCPD: Option82 is removed *Mar 1 00:36:40.407: DHCPD: broadcasting BOOTREPLY to client 0017.e069.24c0. *Mar 1 00:36:40.407: DHCPD: Reload workspace interface Vlan5 tableid 0. *Mar 1 00:36:40.407: DHCPD: tableid for 192.168.1.1 on Vlan5 is 0 *Mar 1 00:36:40.407: DHCPD: client's VPN is . *Mar 1 00:36:40.407: DHCPD: Finding a relay for client 0063.6973.636f.2d30.3031.372e.6530.3639.2e32.3463.302d.4769.302f.30 on interface Vlan5. *Mar 1 00:36:40.407: DHCPD: there is no pool for 192.168.1.1. *Mar 1 00:36:40.407: DHCPD: Looking up binding using address 192.168.1.1 *Mar 1 00:36:40.407: DHCPD: setting giaddr to 192.168.1.1. *Mar 1 00:36:40.407: DHCPD: adding relay information option. *Mar 1 00:36:40.407: DHCPD: BOOTREQUEST from 0063.6973.636f.2d30.3031.372e.6530.3639.2e32.3463.302d.4769.302f.30 forwarded to 10.3.31.40. *Mar 1 00:36:40.424: DHCP: XID did NOT MATCH in dhcpc_for_us() *Mar 1 00:36:40.424: DHCPD: Reload workspace interface GigabitEthernet1/0/3 tableid 0. *Mar 1 00:36:40.424: DHCPD: tableid for 10.3.31.250 on GigabitEthernet1/0/3 is 0 *Mar 1 00:36:40.424: DHCPD: client's VPN is . *Mar 1 00:36:40.424: DHCPD: forwarding BOOTREPLY to client 0017.e069.24c0. *Mar 1 00:36:40.424: DHCPD: Forwarding reply on numbered intf *Mar 1 00:36:40.424: DHCPD: Option82 is currently: *Mar 1 00:36:40.424: 0109312f312f313a31303002157375622d70726f662d312d736c612d70726f662d31 *Mar 1 00:36:40.424: DHCPD: Removing option82 information *Mar 1 00:36:40.424: DHCPD: relay information option removed *Mar 1 00:36:40.424: DHCPD: Option82 is removed *Mar 1 00:36:40.424: DHCPD: broadcasting BOOTREPLY to client 0017.e069.24c0. *PROBLEM : No circuit id generation which is required by me.* Regards, Mahima Kumar 1365962

2 1

Issue with DHCP with Wireless card
by Hugh McLenaghan 14 Mar '14

14 Mar '14

Hi, I've been struggling getting the DHCP server to work. I have the configuration correct. The server starts fine, it listens on the port. When a client sends a request, the request is received correctly. it's then processed as expected, and it supposedly sends out the reply. However I DO NOT see the reply on the interface when i do a tcpdump. I've tried changing multiple settings including setting broadcast off/on, I've changed the IP address bindings and that doesn't help. I've also tried using different versions of freeradius, from 2.2.x through 3.0.1 and 3.1.0 (the git repository). I know the wireless card will support it, because when i try using the regular ISC DHCPD daemon, it gets an IP address and I can see the request/reply packets. One thing I did notice though in the debug logs of freeradius, is when it supposedly sends the reply packet the source/from address is 0.0.0.0:67 however when ISC DHCPD sends it's response it comes from the IP address of the interface itself e.g. 10.199.100.1:67. I've been fighting with this for days now. I've also tried using ISC-DHCP-relay server to relay the requests from the client WLAN0 interface directly to the DHCP server. It sends the request to the server, which supposedly sends the reply back to it, however again, the response is never seen by the relay server. I'm wondering if somehow the dhcp part of the radius server isn't able to send the packets back, whether it's set up to use a gateway DHCP relay or not. Not sure how to troubleshoot this further. Has anyone else had this issue? For my tests i've been using a raspberry Pi running raspian OS. I'm going to try to do this on a regular VM tomorrow to see if it's related to the OS/hardware. Hugh

5 25

Reject Mac Address
by Khapare Joshi 14 Mar '14

14 Mar '14

Hello all, I am running freeradius-2.1 - users authentication against AD (works well). I have list of MAC address which I want to reject. So the question is how do I tell freeradius server to the file rejectmacaddres.txt file which has banned mac addresses ? Thanks, K

2 2

FreeRadius MSCHAP Authenticatiom With Realm Fails
by T I 14 Mar '14

14 Mar '14

Hi I have FreeRadius 2.0 server with AD as user store. Authenticating using EAP-PEAP-MSCHAP2.Local realm is defined in proxy.conf. Authentications works fine without realm added to the username. As soon as I authenticate using username with realm, i.e. username(a)realm.com, authentication fails. The reason for failure is clear, it fails because radius server mschap module creates challenge hash with username which includes realm. I need the radius mschap module to create hash from stripped username, i.e. which doesn't include the realm. Any ideas? Please see radius debug log below: rad_recv: Access-Request packet from host 192.168.1.254 port 55769, id=138, length=376 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5(a)igor.local" State = 0x3ce95d9d3fed44ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x020400d01980000000c61603010086100000820080791cc56766422be7f48414f5942dda519afd607aea2fae890f9236e8af61cf71c66f4f80a5d427672d7f949a3fa163b959f0f1957f382f533a3f9c23d576dafcb5d36ca04dc7d0002203513a23b9394b75cf98f241a6c585583593f6622829a39a736160f0f83b567fa7bbc253558191630071d1889827f6118f366040f69d8814030100010116030100307173492977a9f772a302c0ecb7d2612700f9433dce8e08ff0e74b84dbc62de5fe5a95921f364f8c68dd38484550022ae Message-Authenticator = 0x9a61469cb26792ebd980f294bd9a64c9 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5(a)igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 138 to 192.168.1.254 port 55769 EAP-Message = 0x0105004119001403010001011603010030b0496fb6db5990b1f6a9cf2425dd8587e12b8f4e394f4bd8ccd2c077fe9ba54077bc170e9af421dda6e1deba0235ae8b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ce95d9d38ec44ec4019661d07f2a324 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.254 port 56590, id=139, length=174 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5(a)igor.local" State = 0x3ce95d9d38ec44ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x020500061900 Message-Authenticator = 0xd034f4a268e3ac260f43575b92006929 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5(a)igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 139 to 192.168.1.254 port 56590 EAP-Message = 0x0106002b190017030100205c4bae935a0f79fa0d08a9ce246433654e7edd61806e1f065cc4bdc32958e161 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ce95d9d39ef44ec4019661d07f2a324 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.254 port 53256, id=140, length=264 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5(a)igor.local" State = 0x3ce95d9d39ef44ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x02060060190017030100209cc7c674b7a342e6bec99adea0f61331d5f99b0f6a5950927de5ae55a0bcbcbd1703010030a3f8d19a2da43ad4bee38bdadeeb8049f2ccd3b6452763ed52490a8ff701f7dddeb0d19ec99dc82884df40d0c650c45c Message-Authenticator = 0x4c2f97f2d3325123f0616a879cb73a5f NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5(a)igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - user5(a)igor.local [peap] Got inner identity 'user5(a)igor.local' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x020600150175736572354069676f722e6c6f63616c server { [peap] Setting User-Name to user5(a)igor.local Sending tunneled request EAP-Message = 0x020600150175736572354069676f722e6c6f63616c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user5(a)igor.local" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok [eap] EAP packet type response id 6 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[mschap] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0107002a1a010700251028ee58cd731c7f9fdd4de2f82cc1bf8e75736572354069676f722e6c6f63616c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2798eb6d20828b51434e222e2c4892 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0107002a1a010700251028ee58cd731c7f9fdd4de2f82cc1bf8e75736572354069676f722e6c6f63616c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d2798eb6d20828b51434e222e2c4892 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 140 to 192.168.1.254 port 53256 EAP-Message = 0x0107004b190017030100400140898f0ff025ef80db345ef75a51b4a94d6b114a1d16ef08e1fc4c2d9de5d9895bd09efcdbc614e3886fa835507c92e6b34d2d657247692685e84c0e1f540f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ce95d9d3aee44ec4019661d07f2a324 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.254 port 47603, id=141, length=312 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5(a)igor.local" State = 0x3ce95d9d3aee44ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x020700901900170301002045693fe624f18512a0f9c83b0b896669c3a55066d0d54494bdee159a241df7cf170301006081573695ccc8dd51297f737d1ab47a212c08801a46c831418959b106028089aac0d7cec2f5aa0740909f7ae40d4274bd4534fa24cc41b9c775c3202ad337b19d7b7062c980579e7d31ca54439954aedcb279acd9cc65df2c1fdb85039fb26142 Message-Authenticator = 0x97fd332a0965353e5459137c179a2c62 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5(a)igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0207004b1a02070046317c71750309db8428b4ec154f7e6c5b840000000000000000a333f4999fd9698891d2fbc675892007431387796abfa13b0075736572354069676f722e6c6f63616c server { [peap] Setting User-Name to user5(a)igor.local Sending tunneled request EAP-Message = 0x0207004b1a02070046317c71750309db8428b4ec154f7e6c5b840000000000000000a333f4999fd9698891d2fbc675892007431387796abfa13b0075736572354069676f722e6c6f63616c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user5(a)igor.local" State = 0x6d2798eb6d20828b51434e222e2c4892 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok [eap] EAP packet type response id 7 length 75 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[mschap] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: user5(a)igor.local [mschap] Told to do MS-CHAPv2 for user5(a)igor.local with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{User-Name} -> user5(a)igor.local [mschap] expand: %{%{User-Name}:-None} -> user5(a)igor.local [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=user5(a)igor.local [mschap] Creating challenge hash with username: user5(a)igor.local [mschap] expand: %{mschap:Challenge} -> 13479bee1886303a [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=13479bee1886303a [mschap] expand: %{mschap:NT-Response} -> a333f4999fd9698891d2fbc675892007431387796abfa13b [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=a333f4999fd9698891d2fbc675892007431387796abfa13b WARNING: The "idmap uid" option is deprecated WARNING: The "idmap gid" option is deprecated Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 141 to 192.168.1.254 port 47603 EAP-Message = 0x0108002b19001703010020849be569aa66a8021ded29e15410bf74c59467c7db34f5995d1b6f91ebe9f22f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ce95d9d3be144ec4019661d07f2a324 Finished request 7. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.1.254 port 49384, id=142, length=248 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "user5(a)igor.local" State = 0x3ce95d9d3be144ec4019661d07f2a324 NAS-Port-Id = "wlan1" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "5C-3C-27-29-AE-0B" Called-Station-Id = "D4-CA-6D-A6-53-7B:eduroam test" EAP-Message = 0x02080050190017030100200ebc17e9bd20cc45f1c1772575868316464689e08bba6f4d934e5e1e4be3b040170301002078626c70503034ac41b926af5220e841c57e097b8fe870a8a49fdf71c2e749f8 Message-Authenticator = 0x658f4273b0c1858d67761528c08eac05 NAS-Identifier = "MikroTik" NAS-IP-Address = 192.168.1.254 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.254/auth-detail-20140313 [auth_log] expand: %t -> Thu Mar 13 16:17:17 2014 ++[auth_log] returns ok ++[mschap] returns noop [suffix] Looking up realm "igor.local" for User-Name = "user5(a)igor.local" [suffix] Found realm "igor.local" [suffix] Adding Stripped-User-Name = "user5" [suffix] Adding Realm = "igor.local" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user5(a)igor.local attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 142 to 192.168.1.254 port 49384 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. Cleaning up request 0 ID 134 with timestamp +3480 Cleaning up request 1 ID 135 with timestamp +3480 Cleaning up request 2 ID 136 with timestamp +3480 Cleaning up request 3 ID 137 with timestamp +3480 Cleaning up request 4 ID 138 with timestamp +3480 Cleaning up request 5 ID 139 with timestamp +3480 Cleaning up request 6 ID 140 with timestamp +3480 Cleaning up request 7 ID 141 with timestamp +3480 Waking up in 1.0 seconds. Cleaning up request 8 ID 142 with timestamp +3480 Ready to process requests.

2 1

mail archive problems?
by John Dennis 13 Mar '14

13 Mar '14

The http://freeradius.org/list/users.html page says the mailing list archive can be found here: http://lists.freeradius.org/pipermail/freeradius-users/ But the server replies: The requested URL /pipermail/freeradius-users/ was not found on this server. Whats up? -- John

3 3

Abu
by Nadir Aliyev 13 Mar '14

13 Mar '14

Hello, I use rlm_sql module and have problems with stale sessions. Sometimes users (more than 4k-5k) disconnects without accounting_stop_query and they can't connect again because session is not closed by normal way and session still active in database. My accounting time is 45 minutes, if new alive-update packets not coming for user from NAS side I close this session manually with a little script. After this process (after 45 minute) user can connects again. I used stale_sessions but it not helped. In my case I want to close for user existing staled session in database if new accounting_start_query (insert query) occurs. How can i realize this? accounting_start_query = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctAuthentic, \ ConnectInfo_start, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey, mac_address, agent, vlan) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', \ '%{NAS-Port}', '%{NAS-Port-Type}', ('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}', '%{Connect-Info}', \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', \ NULLIF('%{Framed-IP-Address}', '')::inet, 0, '%{X-Ascend-Session-Svr-Key}', \ (case when length('%{client-mac-address}')>0 then '%{client-mac-address}' else '%{Calling-Station-Id}' end), \ (case when '%{NAS-IP-Address}' = '10.10.10.10' then '%{Nas-Port-Id}' else '%{circuit-id-tag}' end), \ '%{Nas-Port-Id}')" accounting_start_query_alt = "UPDATE ${acct_table1} \ SET AcctStartTime = ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), AcctStartDelay = 0, \ ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" Thanks! Nadir

2 1

Authorise based on Calling Station ID ?
by Darren Ward (darrward) 13 Mar '14

13 Mar '14

Hi All I have a two box wifi solution where the controller performs dot1x/EAP authentication of the end user then a policy management box that sits behind that implements appropriate QoS and traffic policies to the users traffic Of course the Authen part is easy as it's just the normal username/password in users The Author is a little bit trickier and I was interested in some opinions on how to resolve... Basically the policy manager uses the mac address to authorise the device The mac address was sent by the wifi controller as the calling-station-id but the question is how do I match that field against the user to authorise them? Darren

2 7

otp code state
by Brian Candler 13 Mar '14

13 Mar '14

I notice that raddb/mods-available/otp has a link to <http://www.tri-dsystems.com/> That domain is broken - there are REFUSED responses from both their nameservers. If they have gone out of business, perhaps the file should link to this fork instead? https://code.google.com/p/otpd/ That hasn't had a release since Nov 2009, although SVN has commits from Sep 2012. I'm just trying to work out whether this is a viable option going forward (specifically for yubikey authentication, in place of using a PAM module) I notice that the README file says that you will need: b. A plugin for your auth server, that talks to otpd. You can download plugins from the TRI-D Systems web site, or write your own. Your authentication server software vendor might also supply plugins for otpd. But if their site has gone away, that means it's probably not very useful :-( Regards, Brian.

5 4

Post-proxy attribute filtering oddness
by stefan.paetow＠diamond.ac.uk 12 Mar '14

12 Mar '14

Hi, I've got some post-proxy attribute filtering oddness. The servers are both FreeRADIUS 3.0.1. I send an EAP-TTLS/EAP-GTC (or EAP-TTLS/PAP) authentication to my home server (172.23.142.184), which then proxies the request to the UMBRELLAID.ORG realm's server (172.23.142.185). On return, I can see both MS-MPPE-Send-Key and MS-MPPE-Recv-Key in the response, but if I have attr_filter.post-proxy switched on, the MS-MPPE-Send-Key disappears by the beginning of post-auth (so I'm venturing to guess that this triggers a match in the post-proxy attribute filter). When attr_filter.post-proxy is commented out, it is there. The attr_filter/post-proxy file is standard to the distribution with exception of the addition of the following three lines: DEFAULT: User-Name =* ANY, Class =* ANY, Chargeable-User-Identity =* ANY, : : (for clarity, the colons are indicative of the remainder of the DEFAULT entry) I have two logs, one with an Access-Accept with no MS-MPPE-Send-Key (i.e. with filter enabled), one with an Access-Accept with MS-MPPE-Send-Key (filter disabled). The two logs are at https://www.dropbox.com/sh/0j6num17n2tt0mm/sX8GwxgZjR I'm flummoxed! Can someone explain this? Alan D? Alan B? Arran? Anyone? With Regards Stefan -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

4 9

Setting PEAP Method and Inner-tunnel virtual server
by Hangi Christian 12 Mar '14

12 Mar '14

Thank you so much for your help. I used the chmod command on the root user to allow the permission and I used the testing user command as a regular user in the debugging mode and it worked. But, I tried to test all the protocols, they are working in the default testing. I tried to set only EAP PEAP-MSCHAPv2 method by commenting out all the others EAP methods except EAP-TLS and EAP-TTLS, and setting default_eap_type = peap. i also changed the password from cleartext into somethin like this ** " testing" User-password = "P@ssw0rd "** But I don't know how to configure the inner-tunnel virtual server inside the sites-enabled in order to allow 802.1x authentication. when i tried to test without configuring the inner-tunnel virtual server i got this . rad_recv: Access-Request packet from host 127.0.0.1 port 55247, id=123, length=77 User-Name = "testing" User-Password = "P@ssw0rd" NAS-IP-Address = 192.168.9.27 NAS-Port = 0 Message-Authenticator = 0x42afe3cc71c80db704cb5b4d6f915c1e server inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] No EAP-Message, not doing EAP ++[eap] = noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry testing at line 51 [files] expand: Hello,%{User-Name} -> Hello,testing ++[files] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = ok ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. } # server inner-tunnel Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 123 to 127.0.0.1 port 55247 Reply-Message = "Hello,testing" Waking up in 4.9 seconds. Cleaning up request 0 ID 123 with timestamp +16 Ready to process requests. i tried to test the peap method using jradius simulator i got this Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 123 to 127.0.0.1 port 55247 Reply-Message = "Hello,testing" Waking up in 4.9 seconds. Cleaning up request 0 ID 123 with timestamp +16 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 47000, id=2, length=73 User-Name = "testing" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 EAP-Message = 0x0200000c0174657374696e67 Message-Authenticator = 0x3cc3c953e07cc82b12dc94c65102acd1 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated ++[unix] = notfound WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry testing at line 51 [files] expand: Hello,%{User-Name} -> Hello,testing ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 2 to 127.0.0.1 port 47000 Reply-Message = "Hello,testing" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcf4ca028cf4db9debca7c7b78161462f Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 47000, id=3, length=151 User-Name = "testing" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 State = 0xcf4ca028cf4db9debca7c7b78161462f EAP-Message = 0x020100481900160301003d010000390301531ff150fa7d236ea125d229a2f796c081b24c29d4b8fd319c253f294bec4dfd0000120039003800330032001600130035002f000a0100 Message-Authenticator = 0xe3826c6167a24627480ce56fbd6769a0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 72 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 003d], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 08d0], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 3 to 127.0.0.1 port 47000 EAP-Message = 0x0102040019c000000b1f160301002a020000260301531ff1501b19bf495e28952a475864897eae5fcc49b9269c4515e0631ef156910000390016030108d00b0008cc0008c90003de308203da308202c2a003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3134303232353039343530365a170d3135303232353039343530365a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100aed3f4e6fa9efadea640eccdba95ba84671a37bd5f8f0526f781d7f52310288efaa32fa4a513a922af4adfe4b160dad05cb685dbbfb809801b7eba53bed1 EAP-Message = 0xb37c222a83b63d94afe8d30f195808535b8ace500284ce9163df58c24b7dc64f2c11817aedc26a45da19a8184ae6c3a357ebf7bbb0bd39cb62f9273fcdaf512343aaca2110b87b2c2115cf7f43299bfd922641a4dd9773e0d6cb904efe06a6a265131a04b08f37d455c557c056e311304cb1a84cf993992b0b01647bd46d591c01f50afc0c11c8093785b9fb90dd102383981dbdec2283e96fe537b589d446df50d8693917fabf154ddc66caa6a3ef01e608f17565eb2520cd41ed765d977e9b3d450203010001a34f304d30130603551d25040c300a06082b0601050507030130360603551d1f042f302d302ba029a0278625687474703a2f2f777777 EAP-Message = 0x2e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d01010505000382010100d7f9a17398b726d5861c69fb1425fc06ec2ced7f2a22b411d42c03275ac249d7236d84bcdf767616edd9c1b15aadbe57aa8c9c9a0350e998066a9407bbd9c7ede47f1020b4115429bc60dec66afc0a1db3def7cd5b2bc8423fc950f7db57a682999127e2abda907ebb7a8b3b040e1296840bce6847fd44e3263d1399b3f85129313e5c4405f287488035e2df63840f2833398d80c68b4c13e328f46af697946722924e1546254ad9d8a4387bbe348d010f147e9c59a4a1258944f07d8351b28b7ed7e7eef81522158fe7ae14aa39 EAP-Message = 0x680bc8b86dc2911707736c66 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcf4ca028ce4eb9debca7c7b78161462f Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 47000, id=4, length=85 User-Name = "testing" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 State = 0xcf4ca028ce4eb9debca7c7b78161462f EAP-Message = 0x020200061900 Message-Authenticator = 0xd8c05c3b9c781d52ed7b93d2d7e5f299 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 4 to 127.0.0.1 port 47000 EAP-Message = 0x010303fc1940f113789d5fe58467daa0b48d626dcb3d8da9062245d90c64ea654f3981c73a5ca1267f6e525a0004e5308204e1308203c9a003020102020900a9f66bfe117a6d3a300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3134303232353039343530365a EAP-Message = 0x170d3135303232353039343530365a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100e179503ca3da7dcf981aff930f99b8c5a2296ba5072376dc3ad0566b0f09807a284b1ff4cbc0812143ef3a248f2ff2940cc71e1edfaa16 EAP-Message = 0x6091744a8a2cf21a400b59a98250e0097f78c4f7eb5359a896c83856df1239276c4984ed013d5083dfc1f54dbe83082bfca40f48542185e58b53a68c2278b86523dd381d94afc91f584a9471dd84d1582a2c5ae2a59a15c291cfb885c37dedaacd9e0d8582c629cbf7df7a1ae856e776c039d75bdc388105e0e7f881360e1c1deb7c161ef4dd374dc14250813390f4f75cc47c2b675098927890b9d73231ab79cf492ba86b7e4901a29ea1c406a89505622c378939677bd76cf58a49e3fa442ab2093278776958f3370203010001a382013430820130301d0603551d0e0416041432ea5b0d0283f7fe235134d0055fca1822af60a93081c80603551d23 EAP-Message = 0x0481c03081bd801432ea5b0d0283f7fe235134d0055fca1822af60a9a18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a9f66bfe117a6d3a300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578 EAP-Message = 0x616d706c655f6361 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcf4ca028cd4fb9debca7c7b78161462f Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 47000, id=5, length=85 User-Name = "testing" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 State = 0xcf4ca028cd4fb9debca7c7b78161462f EAP-Message = 0x020300061900 Message-Authenticator = 0xb79350a495b09dc0b764088a6e733871 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 5 to 127.0.0.1 port 47000 EAP-Message = 0x0104033919002e63726c300d06092a864886f70d01010505000382010100a4e27f07df6259c73bdf038c528225ab72be8e8447acf759c13159d2e48eb016b6f54c410363392f9d36b4d9a652e871e000e39dd1ae409a5106fa7582ed55601a764fab3bd81e384c3de62d04394a30ab1f0b0820e1eeeb27209c237cf39eb401d76d67756d1dd2129f849a0845e39b159304fe5c62e3950f4d49b6db7b314fc7f244ef19f9efba015dde6d609eaf3556a83b404bb64718b64e7b16d050e103dd715e20691b4a6e31d31ab065bb7a6b8b0f8f27b42726e9c9187f94572613e5c36e433a7b24afffa293930597e486a477c228cc2a9d50f5c916a50f144b3c EAP-Message = 0x7a7a633cb797174fe44470f989dd72a3e9783c745df5cf318e3e84bd246d11d900160301020d0c0002090080a8f0e70aef23c507c30ad6cb681afb5153bfc1417fbe2b4b6ccd4898760c984564b5308bacd50cdcc3ee5e9ddf84cf6047239302a988c35b1c78f6da77b18e079216b679e618fff798faaec47a25ed37480f74dd76d8cbd125384fed51b31efa6ff0feb3e8de9f387c2ee7cc313d2de8ae2e67b01605e9b019720135e9685b5b000102008025814b22830831f6716e74da15ba9866e69b7f29a54fafff0bdeeb38cadbbab1ffb7d1ccc326a9f7b3e5d7c12b446fd44e09c5294b9d2dbaa0273d82358d97297e176d5c8d5ce98fd52aa9a8 EAP-Message = 0x711535a625454a646980373ccb9639d0ebf2b44bc9f0985cfe4c763948d90a838cab0e491f82323dcb1fac770281519ae7a3f4b2010045dc48edf7fdf54171fb368899a00e657c859fcc3fab1f4da00a892dac500c3209280b06420037a1cc2c74333bf826196f3564a008c7e756af5d45b91e619031509ed5afe63bc9d63130f00e462fbe807aee61798a5b3880f83e8e4f6e98779c92e8b8cb18b516b8579e88f2696efd71d0f3498a395025e78c2f00e487aec42affc9dc521b20547e4f6ccf0967b0e145e9ebc8c34b195356a8ed0fca339b11e1a2e8dfc655a72e1db0da0a0df88852bc37307c7ea7eead34495fce92831bece6f74412597d10f3 EAP-Message = 0x75d5d456af23cdd69bc61243b41168d572cabf8768a2780054e9949c1cb9bf222692af5cd4e08a19acba977d1671098c9131876d1b30fefa1816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcf4ca028cc48b9debca7c7b78161462f Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 47000, id=6, length=315 User-Name = "testing" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 State = 0xcf4ca028cc48b9debca7c7b78161462f EAP-Message = 0x020400ec19001603010086100000820080a77f24ad2050e6bd07cbbef0f616a25dc4d4022a5a8ff6e4f0a4aa13254ed96e6d343ea6c9e92f8905f1889d772e5e85e966b0e0d4c510d1eb9e9105dc8beb84c2f56e9723994de83325df2017edbf1cdd8ec6da78f3403b9dcd3e29a794d5d091d321f9bc435b87a880cff4d730cfd8bd8c7000c0d4cdc452799ad8968dc4541403010001011603010050c491f1ada3008208f04f195129505068ddeb05f6f2b1d9e6bfd8e309f143be46cb9d9668d481f23d7a80c3c99485d2ab8180df3dbf52b8e3af67465835f446620d1f13735fa3f83850591a3947be7655 Message-Authenticator = 0x86eb2811521a1551f40507327ff12743 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 236 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 6 to 127.0.0.1 port 47000 EAP-Message = 0x0105004119001403010001011603010030924cb8cd91029f0767c24ee999838826f05fe99d10722855956dae0ff10e6c4ac9bf0e17151503ba04ccba9b09d0e497 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcf4ca028cb49b9debca7c7b78161462f Finished request 5. Going to the next request Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 47000, id=7, length=85 User-Name = "testing" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 State = 0xcf4ca028cb49b9debca7c7b78161462f EAP-Message = 0x020500061900 Message-Authenticator = 0x6cf39e9e692ebc10078a1dea5845477d # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 7 to 127.0.0.1 port 47000 EAP-Message = 0x0106002b1900170301002057428dfbc1a703902f590dfce56bae6cd5e6c39efca98488f76badf9b0852fa0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcf4ca028ca4ab9debca7c7b78161462f Finished request 6. Going to the next request Waking up in 4.1 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 47000, id=8, length=175 User-Name = "testing" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 State = 0xcf4ca028ca4ab9debca7c7b78161462f EAP-Message = 0x0206006019001703010020121d5f70b18873c2ce8adc64ee86316d43cc5c587a65cfede3885092292f45621703010030ae623579fca299bdad152eff69c508636ec69ba9fb2c62f443a75d108dae0e2f80a5cfee6ab81fe8ffe3a8e96fccc18e Message-Authenticator = 0xea19005096c49a314c145dd25e9c8ec2 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 96 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - testing [peap] Got inner identity 'testing' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0206000c0174657374696e67 server { [peap] Setting User-Name to testing Sending tunneled request EAP-Message = 0x0206000c0174657374696e67 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testing" server inner-tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +group authorize { ++[chap] = noop ++[mschap] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop ++update control { ++} # update control = noop [eap] EAP packet type response id 6 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [files] users: Matched entry testing at line 51 [files] expand: Hello,%{User-Name} -> Hello,testing ++[files] = ok ++[expiration] = noop ++[logintime] = noop ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +group authenticate { [eap] EAP Identity [eap] No such EAP type mschapv2 [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated } # server inner-tunnel [peap] Got tunneled reply code 3 Reply-Message = "Hello,testing" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 Reply-Message = "Hello,testing" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 8 to 127.0.0.1 port 47000 EAP-Message = 0x0107002b1900170301002057077c5e5c4d4c0e362ffe95fff5a33129b376ed00b69e00c99fffcda1428251 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcf4ca028c94bb9debca7c7b78161462f Finished request 7. Going to the next request Waking up in 4.0 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 47000, id=9, length=175 User-Name = "testing" NAS-Port = 0 NAS-IP-Address = 127.0.0.1 State = 0xcf4ca028c94bb9debca7c7b78161462f EAP-Message = 0x0207006019001703010020a0530d6df4bf549909743f057be762457c2b6abd38eb6235375f20a27e93fc851703010030fad2db6536da7f64fcc88f8b2a13970065906d4af2accb08c2d89846de9b30519d192e030afa21f131badbc40cbff6da Message-Authenticator = 0xd47ab810fc992cf5a094df676da234a6 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 7 length 96 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 9 to 127.0.0.1 port 47000 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.0 seconds. Cleaning up request 1 ID 2 with timestamp +800 Cleaning up request 2 ID 3 with timestamp +800 Cleaning up request 3 ID 4 with timestamp +800 Cleaning up request 4 ID 5 with timestamp +800 Waking up in 0.8 seconds. Cleaning up request 5 ID 6 with timestamp +800 Cleaning up request 6 ID 7 with timestamp +800 Cleaning up request 7 ID 8 with timestamp +800 Waking up in 1.0 seconds. Cleaning up request 8 ID 9 with timestamp +800 Ready to process requests.

3 2