- Freeradius-Users - lists.freeradius.org

FreeRadius 3.0.1 perl module attr problem
by Alexander Kosykh 05 Mar '14

05 Mar '14

Hi I'm trying to move my freeradius 2.2 configuration to new installed 3.0.1. All seem to work but perl clean up some attributes empty. This is my test perl script use strict; use warnings; # use ... use Data::Dumper; use DBI; # mysql information base # # Configuration parameters use constant { DEBUG => '1', # for debuggin # # database parameters DB_HOSTNAME => 'db.example.com', DB_NAME => 'radius', DB_USER => 'radius', DB_PASS => 'secret' }; # Bring the global hashes into the package scope our (%RAD_REQUEST, %RAD_REPLY, %RAD_CHECK); # # This the remapping of return values # use constant { RLM_MODULE_REJECT => 0, # /* immediately reject the request */ RLM_MODULE_FAIL => 1, # /* module failed, don't reply */ RLM_MODULE_OK => 2, # /* the module is OK, continue */ RLM_MODULE_HANDLED => 3, # /* the module handled the request, so stop. */ RLM_MODULE_INVALID => 4, # /* the module considers the request invalid. */ RLM_MODULE_USERLOCK => 5, # /* reject the request (user is locked out) */ RLM_MODULE_NOTFOUND => 6, # /* user not found */ RLM_MODULE_NOOP => 7, # /* module succeeded without doing anything */ RLM_MODULE_UPDATED => 8, # /* OK (pairs modified) */ RLM_MODULE_NUMCODES => 9, # /* How many return codes there are */ # Same as src/include/radiusd.h L_DBG => 1, L_AUTH => 2, L_INFO => 3, L_ERR => 4, L_PROXY => 5, L_ACCT => 6 }; our $dbh; # Connecting datebase sub CLONE { $dbh = DBI->connect("dbi:mysql:dbname=".DB_NAME.";host=".DB_HOSTNAME,DB_USER,DB_PASS,{PrintError => 0}) or &radiusd::radlog(L_DBG, "DEBUG post_auth: DBI error: ".$DBI::errstr); if (!defined($dbh)) { &err_out; &radiusd::radlog(L_ERR, "can't connect to database!"); $RAD_REPLY {'Reply-Message'} = "Internal server error"; return RLM_MODULE_FAIL; } } sub authorize { print Dumper (%RAD_REQUEST); return RLM_MODULE_OK; } And the radius -X output This one without perl script Ready to process requests. rad_recv: Access-Request packet from host 192.168.20.240 port 1812, id=62, length=205 User-Name = 'test_jur' CHAP-Password = 0x01cc75f2ddb427d70 CHAP-Challenge = 0xea55985e715e3e1f Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = 'test-se600' NAS-Port = 50462720 NAS-Real-Port = 838860811 NAS-Port-Type = Virtual NAS-Port-Id = '3/2 vlan-id 11 pppoe 60' Medium-Type = DSL Mac-Addr = '00-50-56-84-69-59' Platform-Type = SE-600 OS-Version = '12.1.1.5' (5) # Executing section authorize from file /usr/local/etc/raddb/sites-available/pppoe (5) authorize { (5) filter_username filter_username { (5) ? if (!User-Name) (5) ? if (!User-Name) -> FALSE (5) ? if (User-Name =~ /([0-9A-F]{2}[:-]){5}([0-9A-F]{2})$/) (5) ? if (User-Name =~ /([0-9A-F]{2}[:-]){5}([0-9A-F]{2})$/) -> FALSE (5) ? if (User-Name == 'Redback') (5) ? if (User-Name == 'Redback') -> FALSE (5) ? if (User-Name =~ / /) (5) ? if (User-Name =~ / /) -> FALSE (5) ? if (User-Name =~ /@.*@/ ) (5) ? if (User-Name =~ /@.*@/ ) -> FALSE (5) ? if (User-Name =~ /\\.\\./ ) (5) ? if (User-Name =~ /\\.\\./ ) -> FALSE (5) ? if (User-Name =~ /\\.$/) (5) ? if (User-Name =~ /\\.$/) -> FALSE (5) ? if (User-Name =~ /(a)\\./) (5) ? if (User-Name =~ /(a)\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [preprocess] = ok (5) ? if (OS-Version == '12.1.1.5') (5) ? if (OS-Version == '12.1.1.5') -> TRUE (5) if (OS-Version == '12.1.1.5') { ... } # empty sub-section is ignored ..... And this one with perl rad_recv: Access-Request packet from host 192.168.20.240 port 1812, id=60, length=205 User-Name = 'test_jur' CHAP-Password = 0x016dbecc2a777 CHAP-Challenge = 0xec96dfb8b8af Service-Type = Framed-User Framed-Protocol = PPP NAS-Identifier = 'test-se600' NAS-Port = 50462720 NAS-Real-Port = 838860811 NAS-Port-Type = Virtual NAS-Port-Id = '3/2 vlan-id 11 pppoe 58' Medium-Type = DSL Mac-Addr = '00-50-56-84-69-59' Platform-Type = SE-600 OS-Version = '12.1.1.5' (0) # Executing section authorize from file /usr/local/etc/raddb/sites-available/pppoe (0) authorize { $VAR1 = 'OS-Version'; $VAR2 = ''; $VAR3 = 'NAS-Port-Type'; $VAR4 = 'Virtual'; $VAR5 = 'NAS-Real-Port'; $VAR6 = '838860811'; $VAR7 = 'CHAP-Password'; $VAR8 = '0x016dbecc2a777'; $VAR9 = 'Service-Type'; $VAR10 = 'Framed-User'; $VAR11 = 'Medium-Type'; $VAR12 = 'DSL'; $VAR13 = 'Framed-Protocol'; $VAR14 = 'PPP'; $VAR15 = 'User-Name'; $VAR16 = ''; $VAR17 = 'CHAP-Challenge'; $VAR18 = '0xec96dfb8b8af'; $VAR19 = 'NAS-Identifier'; $VAR20 = ''; $VAR21 = 'Platform-Type'; $VAR22 = 'SE-600'; $VAR23 = 'NAS-Port'; $VAR24 = '50462720'; $VAR25 = 'Mac-Addr'; $VAR26 = ''; $VAR27 = 'NAS-Port-Id'; $VAR28 = ''; rlm_perl: Added pair OS-Version = rlm_perl: Added pair NAS-Port-Type = Virtual rlm_perl: Added pair NAS-Real-Port = 838860811 rlm_perl: Added pair CHAP-Password = 0x016dbecc2a777 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Medium-Type = DSL rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair User-Name = rlm_perl: Added pair CHAP-Challenge = 0xec96dfb8b8af rlm_perl: Added pair NAS-Identifier = rlm_perl: Added pair Platform-Type = SE-600 rlm_perl: Added pair NAS-Port = 50462720 rlm_perl: Added pair Mac-Addr = rlm_perl: Added pair NAS-Port-Id = (0) [perl_pppoe] = ok (0) filter_username filter_username { (0) ? if (!User-Name) (0) ? if (!User-Name) -> FALSE (0) ? if (User-Name =~ /([0-9A-F]{2}[:-]){5}([0-9A-F]{2})$/) (0) ? if (User-Name =~ /([0-9A-F]{2}[:-]){5}([0-9A-F]{2})$/) -> FALSE (0) ? if (User-Name == 'Redback') (0) ? if (User-Name == 'Redback') -> FALSE (0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE (0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE (0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE (0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = ok (0) [preprocess] = ok (0) ? if (OS-Version == '12.1.1.5') (0) ? if (OS-Version == '12.1.1.5') -> FALSE .... As you can see in the second -X output perl cleared some attributes: OS-Version (which I tested with if statement after perl) User-Name NAS-Identifier Mac-Addr NAS-Port-Id Why is it so? Did I do something wrong or it's a perl bug? P.S. In 2.2 this perl script work fine. *Regards,* *Alexander.*

2 1

APC NetBotz User attribute issue.
by Rishabh.Shukla 04 Mar '14

04 Mar '14

Hello All, * Our Setup -> Centos, Free Radius, MySQL and Daloradius as Front End management GUI Tool. * Devices use for Authentication -> APC NetBotz 200 Rack monitoring device as NAS. * Attribute Details of user -> 1- APC-Service-Type = Admin and 2- Auth-Type =System * Goal -> NetBotz Device users should get authenticated & login with Administrative rights. * Problem -> We need to get APC Netbotz authentication from Radius server configured and APC has 3 level of users : 1-Administrator, 2-Device, 3-Read only. Along with radius authentication radius need to supply user attributes to Netbotz for user level & its access credentials. We have configured Administrative attribute with users in radius but it does not supply with authentication, there for user get only very lower level access "read only". Our goal is to get Administrative access with radius authentication. * Radisud debug mode output as follows : # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "rishabh", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> rishabh [sql] sql_set_user escaped user --> 'rishabh' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rishabh' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'rishabh' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User rishabh not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> rishabh attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 38 to 192.168.12.240 port 64015 Waking up in 4.9 seconds. Cleaning up request 0 ID 38 with timestamp +9 Ready to process requests. Please help us to resolve above issue. Thanks, Rishabh

4 4

FreeRADIUS 3.0: 3rd party module build structure?
by Julius Plenz 03 Mar '14

03 Mar '14

Hi, I'm currently trying to migrate a FreeRADIUS 2.x config to the new 3.0 version. I have a few custom rlm_* modules that I want to compile against the 3.0 sources. Previously, I had a Makefile similar to this: FR_SOURCE = $(HOME)/src/freeradius TARGET = rlm_omapi SRCS = rlm_omapi.c RLM_DIR = $(FR_SOURCE)/src/modules/rlm_example/ top_builddir = $(FR_SOURCE)/ include $(FR_SOURCE)/src/modules/rules.mak RLM_CFLAGS = -I/server/dhcp/server/include -I/server/dhcp/src/isc-dhcp/bind/include RLM_LDFLAGS = -L/server/dhcp/server/lib -ldhcpctl -lomapi -ldns -lisc This way I got "magically working" targets to build and install my module. However, now the build system was changed for good and I cannot really figure out how to achieve the same effect. (In particular, the "rules.mak" file is apparently "No longer needed" since 80f92e5aee, Feb 27 2013.) Is there an easy way so I don't have to write out all the long libtool command lines myself? Any help is appreciated! Julius

3 9

FreeRadius v.2.2.3 Proxy/Copy mode issue
by Giuliano De Paolis 03 Mar '14

03 Mar '14

Hi all. I post this topic to help me to solve this strange behavior occurred in a scenario involving the Proxy/Copy server. I have 2 installation of FreeRadius 2.2.3. Please find the details below: INSTALLATION A FR: FreeRadius Server 2.2.3 O.S.: Solaris 10 Update 2011 Generic_147440-09 Proxy pool server: 1 Copy pool server: 1 INSTALLATION B FR: FreeRadius Server 2.2.3 O.S.: Solaris 10 Update 2009 Generic_142900-14 Proxy pool server: 10 Copy pool server: 10 Here's the architecture (common for both the installations): RadiusClient --> Proxy --> BE Accounting Radius Server On the Installation (A) all works fine; due to high traffic the FR Proxy server performs both proxy and copy operations and I'm able to see all the responses on my radius client. On the Installation (B) instead, despise the correct proxy/copy operations execution, there are several request packets from wich I do not receive the corresponding response packets on the Radius Client. The strange thing is that all the packets (even the missing ones) are traced at snoop level by the BE Accounting Layer. On the Proxy Layer I can "see" the missing packets, but even running at debug my FR Server I didn't see any specific error regarding to the missing packets. Can you suggest me what kind of checks I can perform to understand better where the problem is? Thanks in advance, best regards. G.

2 1

How many NAS kann radius take?
by Anja Ruckdaeschel 03 Mar '14

03 Mar '14

Hi there! Having some performance trouble at our campus site with lots of "Discarding Duplicate request" errors. Our setup is freeradius 2.2.0 with ldap and sql. ; Intel Xeon CPU E5630 2.53GHz 2CPUs with 8 Core (hyperthreading enabled), 24 GB RAM sql is only used to determine the replied VLAN-ID from a very small read only table by a local mysql instance, so no performance or connection issues here (we do not do accounting into the db or anything like that). ldap works fast. And there are no messages from rlm_ldap or rlm_sql which indicate trouble with sql or ldap connections So we kind of sorted out the "classic causes" for slowing down radius .... If our people move over the campus with ~3.000 smartphones with actvated wifi, request numbers increase when they enter new wi-fi cells and trouble begins: There is barely an auth ok or incorrect in the log but lots of discarding duplicates messages and cpu load is going up to 120 and a higher number of messages like Tue Feb 11 18:22:37 2014 : Error: rlm_eap: No EAP session matching the State variable. appears in the log. I can see that there are a few messages like Tue Feb 11 09:26:50 2014 : Info: WARNING: Module rlm_preprocess became unblocked for request 241193 and Tue Feb 11 09:26:51 2014 : Info: WARNING: Module rlm_eap became unblocked for request 241193 at the time when the problem appears. Can this point to the preprocess module where it gets "slow", with eap getting blocked as a consequence of a blocked preprocess module? We have a lot of NAS in our environment: there are over 2200 NAS in total in clients.conf, which are 350 heavily used WLAN access points (auth only, no acct) and switches which do a administrative login only every 5 min, and ~ 10 VPN controllers. As having so many NAS, preprocess has to do a max of 2200 expansion like Fri Feb 7 15:41:16 2014 : Debug: [preprocess] expand: %{Client-IP-Address} -> x.x.x.x in order to determine the allowed client. That are ~26.400 checks for preprocess in one peap/mschap request for example (~12 request-packtes x NAS). Is there some kind of "recommened maximum number of NAS" for one instance of freeradius? Here is our thread_pool and request config: max_request_time = 120 cleanup_delay = 5 #256 x NAS (By the way: "This should be 256 multiplied by the number of clients. # e.g. With 4 clients, this number should be 1024. " Is client in this contenxt supplicant or NAS?) max_requests = 563200 thread pool { start_servers = 5 max_servers = 128 min_spare_servers = 3 max_spare_servers = 128 # max_queue_size = 65536 max_requests_per_server = 0 } Thanks for your help Kind regards Anja

8 28

FR3 reply ldap's attr when bind as a user
by zz d 03 Mar '14

03 Mar '14

I can bind as a user by configure in virtual server authorize { update { control:Auth-Type := ldap } } It works well and can authenticate a user with LDAP . The "radiusd -X" output like (2) ldap : Performing search in 'ou=a,dc=b,dc=domain' with filter '(sAMAccountName=abc)' (2) ldap : Waiting for search result... (2) ldap : User object found at DN "CN=s,OU=s,OU=s,OU=a,DC=b,DC=domain" (2) ldap : Waiting for bind result... (2) ldap : Bind successful (2) ldap : Bind as user "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" was successful What I want to do is update reply:Reply-Message with the user information, such as reply:Reply-Message := "CN=a,OU=ab,OU=a,OU=qiyi,DC=b,DC=domain" I've tried to update reply in "mods-available/ldap", but it not work. Is it possible? Any suggestions will be appreciated.

2 7

configuring multiple LDAPs
by Guy Bitansky 02 Mar '14

02 Mar '14

Hi I'm trying to do the following: Proxy requests that arrive to "MYREALM\<user_name>" to a custom virtual server that is handles LDAP requests. I defined the right proxy definitions in the proxy.conf and created the virtual server properly. The problem is that EAP is not carried out. In the default server it says: "eap : Request is supposed to be proxied to Realm XXXXXX. Not doing EAP.". The thing is that when the request arrives at the authorize section of the virtual server, eap is not started again because the request still contains a proxy field and eap module lets it go. Is there a better way of doing this? I am trying to create a configuration that can handle multiple servers of different types: * LDAP * ActiveDirectory * External RADIUS server I thought that I could proxy the different incoming requests according to the realm of the user to the correct server, weather a virtual internal server or an external proxy server. This works pretty good except the eap part. Any suggestions ?? Thanks J

2 1

[ttls] <<< TLS 1.0 Alert [length 0002], fatal bad_certificate
by Ben 01 Mar '14

01 Mar '14

Hi all, In my quest to get TTLS working I'm making slow and painful progress. I've now reached this stage, I can see what Freeradius is complaining about but don't know how to fix it. I've tried putting the root cert on the client, the intermediate cert on the client, the chain of intermediate+root on the client... nothing works !!!! What certificate am I supposed to be putting on the client to get TTLS working ????? This is all with the current 2.2.x version and the auth user just in the radb/users file. Thanks rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=25, length=166 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0200000801626f62 Message-Authenticator = 0x3b90b7bce827872043429fc5d3c4d4fa # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 0 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry bob at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 25 to 172.16.100.254 port 32771 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfce0cbcffce1c61e13af06a62b033add Finished request 99. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=26, length=182 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x020100060315 State = 0xfce0cbcffce1c61e13af06a62b033add Message-Authenticator = 0x544d5ecfbb5fcfea7fc92c6af9995988 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry bob at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 26 to 172.16.100.254 port 32771 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfce0cbcffde2de1e13af06a62b033add Finished request 100. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=27, length=409 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0xXXXX State = 0xfce0cbcffde2de1e13af06a62b033add Message-Authenticator = 0x51c1fa9a013d0796e3c69e73feacaee9 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 233 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 00de], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 003e], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 0d03], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 27 to 172.16.100.254 port 32771 EAP-Message = 0xXXXXX EAP-Message = 0xXXXX EAP-Message = 0xXXXXX EAP-Message = 0xXXXXX EAP-Message = 0x54563bfc875ead29ea258ceb Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfce0cbcffee3de1e13af06a62b033add Finished request 101. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=28, length=182 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x020300061500 State = 0xfce0cbcffee3de1e13af06a62b033add Message-Authenticator = 0x0b7f096f4fc0c8acb5407c07e58c4f13 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 28 to 172.16.100.254 port 32771 EAP-Message = 0xXXXXX EAP-Message = 0xXXXXX EAP-Message = 0xXXXXXX EAP-Message = 0xXXXXXX EAP-Message = 0x010056212ec4da360bb41484 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfce0cbcfffe4de1e13af06a62b033add Finished request 102. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=29, length=182 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x020400061500 State = 0xfce0cbcfffe4de1e13af06a62b033add Message-Authenticator = 0x94688416253b77d96df25b1c2f7d9a1f # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 29 to 172.16.100.254 port 32771 EAP-Message = 0xXXXXX EAP-Message = 0xXXXXX EAP-Message = 0xxXXXX EAP-Message = 0xXXXXX EAP-Message = 0x0e06035504081307456e676c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfce0cbcff8e5de1e13af06a62b033add Finished request 103. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=30, length=182 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x020500061500 State = 0xfce0cbcff8e5de1e13af06a62b033add Message-Authenticator = 0x4ab77dde9316429ec01785aea3bf8f23 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 30 to 172.16.100.254 port 32771 EAP-Message = 0xXXXXXX EAP-Message = 0xXXXXXX EAP-Message = 0xXXXXXX Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfce0cbcff9e6de1e13af06a62b033add Finished request 104. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=31, length=189 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0206000d15001503010002022a State = 0xfce0cbcff9e6de1e13af06a62b033add Message-Authenticator = 0xd3580f9793092740ddc482652114e45a # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 13 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> bob attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 105 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 105 Sending Access-Reject of id 31 to 172.16.100.254 port 32771 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=31, length=189 Sending duplicate reply to client XYZwifi2 port 32771 - ID: 31 Sending Access-Reject of id 31 to 172.16.100.254 port 32771 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=32, length=166 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0200000801626f62 Message-Authenticator = 0xe1dae59cd99e96df6fa5959228d8ed52 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 0 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry bob at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 32 to 172.16.100.254 port 32771 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1bfbd3351bfade698a8490efd3984a5c Finished request 106. Going to the next request Waking up in 1.5 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=33, length=182 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x020100060315 State = 0x1bfbd3351bfade698a8490efd3984a5c Message-Authenticator = 0x680c5830cb9579e83b610caf7bf1f22d # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] = updated [files] users: Matched entry bob at line 1 ++[files] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = updated Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 33 to 172.16.100.254 port 32771 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1bfbd3351af9c6698a8490efd3984a5c Finished request 107. Going to the next request Waking up in 1.5 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=34, length=409 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0xXXXXXXX State = 0x1bfbd3351af9c6698a8490efd3984a5c Message-Authenticator = 0x0e0248858e573f5236dbc87ccc0ba636 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 2 length 233 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 00de], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 003e], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 0d03], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 34 to 172.16.100.254 port 32771 EAP-Message = 0xXXXXXXX EAP-Message = 0xXXXXXXX EAP-Message = 0xXXXXXXX EAP-Message = 0xXXXXXXX EAP-Message = 0x54563bfc875ead29ea258ceb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1bfbd33519f8c6698a8490efd3984a5c Finished request 108. Going to the next request Waking up in 1.4 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=35, length=182 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x020300061500 State = 0x1bfbd33519f8c6698a8490efd3984a5c Message-Authenticator = 0x6ef912f386d9451add40ddb6eab06618 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 35 to 172.16.100.254 port 32771 EAP-Message = 0xXXXXXX EAP-Message = 0xXXXXXX EAP-Message = 0xXXXXXX EAP-Message = 0xXXXXXX EAP-Message = 0x010056212ec4da360bb41484 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1bfbd33518ffc6698a8490efd3984a5c Finished request 109. Going to the next request Waking up in 1.3 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=36, length=182 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x020400061500 State = 0x1bfbd33518ffc6698a8490efd3984a5c Message-Authenticator = 0x9c6e329e9225bce68c8aff6c2e6c91a1 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 36 to 172.16.100.254 port 32771 EAP-Message = 0xXXXXXX EAP-Message = 0xXXXXX EAP-Message = 0xXXXXX EAP-Message = 0xXXXXX EAP-Message = 0x0e06035504081307456e676c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1bfbd3351ffec6698a8490efd3984a5c Finished request 110. Going to the next request Waking up in 1.3 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=37, length=182 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x020500061500 State = 0x1bfbd3351ffec6698a8490efd3984a5c Message-Authenticator = 0xe496aa258d721f863cba6a3fcf4eb638 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] = handled +} # group authenticate = handled Sending Access-Challenge of id 37 to 172.16.100.254 port 32771 EAP-Message = 0xXXXXXXX EAP-Message = 0xXXXXXXX EAP-Message = 0xXXXXXXX Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1bfbd3351efdc6698a8490efd3984a5c Finished request 111. Going to the next request Waking up in 1.3 seconds. rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=38, length=189 User-Name = "bob" NAS-IP-Address = 172.16.100.254 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "84-1B-FF-FF-FF-FF:XXXXXXXXX" Calling-Station-Id = "10-AE-FF-FF-FF-FF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0206000d15001503010002022a State = 0x1bfbd3351efdc6698a8490efd3984a5c Message-Authenticator = 0xfd05c1a5ced3bc05e5a969aad7e6c316 # Executing section authorize from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++[chap] = noop ++[mschap] = noop ++[digest] = noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] = noop [eap] EAP packet type response id 6 length 13 [eap] Continuing tunnel setup. ++[eap] = ok +} # group authorize = ok Found Auth-Type = EAP # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group authenticate { [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [ttls] eaptls_process returned 4 [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/freeradius_new/etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> bob attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 112 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 112 Sending Access-Reject of id 38 to 172.16.100.254 port 32771 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Request packet from host 172.16.100.254 port 32771, id=38, length=189 Sending duplicate reply to client XYZwifi2 port 32771 - ID: 38 Sending Access-Reject of id 38 to 172.16.100.254 port 32771 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.3 seconds. Cleaning up request 99 ID 25 with timestamp +564 Cleaning up request 100 ID 26 with timestamp +564 Waking up in 0.1 seconds. Cleaning up request 101 ID 27 with timestamp +564 Cleaning up request 102 ID 28 with timestamp +565 Cleaning up request 103 ID 29 with timestamp +565 Cleaning up request 104 ID 30 with timestamp +565 Waking up in 1.0 seconds. Cleaning up request 105 ID 31 with timestamp +565 Waking up in 2.1 seconds. Cleaning up request 106 ID 32 with timestamp +568 Cleaning up request 107 ID 33 with timestamp +568 Waking up in 0.1 seconds. Cleaning up request 108 ID 34 with timestamp +568 Cleaning up request 109 ID 35 with timestamp +568 Cleaning up request 110 ID 36 with timestamp +568 Cleaning up request 111 ID 37 with timestamp +568 Waking up in 1.0 seconds. Cleaning up request 112 ID 38 with timestamp +568 Ready to process requests.

6 7

Re: EAP-TLS with CRL Howto
by Gregory Sloop 01 Mar '14

01 Mar '14

Sorry, I see I posted to you direct... [I'll try again.] --- AD> RHEL should have 3.x as the "freeradius3" package. I did an RPM search and 6.5 appears to be using 2.1.12 - I'd guess RHEL7 [when it's out] will come with a 3.x branch. [Actually I went and looked out of curiosity and RHEL7 is supposed to be based on FC19, which appears to only have 2.2, not 3.x. FC20 does have a 3.x branch however.] But perhaps I'm missing something. AD> The rest are (to be honest) completely retarded for using a version AD> that was 2 years out of date when Ubuntu 12.04 was released. AD> I think I might just start doing Ubuntu packages myself. That would be nice. While I'm not against compiling something myself, having to watch for security patches and re-compile to fix them etc - isn't a task I'm ready to sign up for usually... so using the distro packaging is a lot easier. Thanks for the follow-up. -Greg

2 1

Read TLS Client cert outside of authentication
by Travis Dimmig 28 Feb '14

28 Feb '14

Is it possible to read fields of the client cert divorced from the act of authenticating with it? Specifically, I have a FreeRADIUS server that proxies the authentication requests to have the actual authentication done by another, but I want to be able to inspect the value of the CommonName from the server doing the proxying. The examples in the post-auth section show exactly the kind of control I want, where the values of cert fields are populated in FreeRADIUS internal attributes, but I need access to them from the server that is otherwise just proxying the requests. I thought of having the authentication server add the values back into the reply, but an ideal solution would not require any changes on the authentication server. Travis Dimmig Senior Software Developer Impulse Point www.impulse.com<http://www.impulse.com/>

2 1