- Freeradius-Users - lists.freeradius.org

CoovaChilli FreeRADIUS setup with UAM
by Russell Mike 13 Feb '14

13 Feb '14

Dear List Greetings *Setup Example: * i have CoovaChilli / FreeRADIUS setup with UAM (Universal Access Manager) server. Basically means it is different web server than NAS it self (NAS = CoovaChilli). UAM serve the login page for hotspot users. Saying other way, separate web server for content management system (serving login page base on geographical location, distance, vlan numbers etc. etc..) When any of following condition becomes true 1.) User has fill the wrong password 2.) User calling outside of time slot 3.) User already downloaded the quota specified FreeRADIUS reject the access, which is obvious. Fine !!!! *Question: * how can i configure FreeRADIUS to send the reply messages (Your username/password is wrong) to UAM server rather than NAS ? i am very sure there would be a way to do it and i am not coming across using google search over a week. Thanks / Regards RM --

3 4

how is it correct to use radiusCheckItem AVP?
by Zeus Panchenko 12 Feb '14

12 Feb '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hello, I'm confused with my understanding of how it have to work - the AVP radiusCheckItem I hoped much I can use radiusCheckItem set to "Huntgroup-Name == ZyXEL" set in client LDAP object, to check whether client belongs to the huntgroup or not, to assign relevant profile to the client via check in users file. what I did: - ---[ quotation start: users ]------------------------------------------- # COMMUTATORS DEFAULT Ldap-Group == comm-shell, Cisco-AVPair =* "anything", User-Profile := "cn=comm-shell,ou=profiles,ou=radius,dc=org" Reply-Message = "%{User-Name}, you are comming as Cisco comm-shell.", Fall-Through = no DEFAULT Ldap-Group == comm-shell, Huntgroup-Name == ZyXEL, User-Profile := "cn=comm-shell,ou=profiles,ou=radius,dc=org" Reply-Message = "%{User-Name}, you are comming as ZyXEL comm-shell.", Fall-Through = no DEFAULT Ldap-Group == comm-shell, User-Profile := "cn=comm-shell,ou=profiles,ou=radius,dc=org" Reply-Message = "%{User-Name}, you are comming as comm-shell.", Fall-Through = no - ---[ quotation end ]--------------------------------------------------- - ---[ quotation start: ldap.attrmap ]----------------------------- checkItem Huntgroup-Name radiusHuntgroupName - ---[ quotation end ]------------------------------------------- - ---[ quotation start: client .ldif ]----------------------------- dn: radiusClientIdentifier=1.2.3.4,ou=clients,ou=radius,dc=org cn: 1.2.3.4 objectclass: radiusClient objectclass: top objectclass: radiusprofile radiusclientidentifier: 1.2.3.4 radiusclientsecret: testing123 radiusclientshortname: zyxel.comm.local radiusclienttype: cisco radiushuntgroupname: ZyXEL - ---[ quotation end ]------------------------------------------- - ---[ quotation start: commutators profile .ldif ]---------------- dn: cn=comm-shell,ou=profiles,ou=radius,dc=org cn: comm-shell objectclass: radiusprofile objectclass: person objectclass: top radiuscheckitem: Huntgroup-Name == ZyXEL radiusreplymessage: Hello, shell user. radiusservicetype: Administrative-User sn: comm-shell - ---[ quotation end ]------------------------------------------- - ---[ quotation start: commutator account .ldif ]----------------- dn: cn=test-comm,ou=users,ou=radius,dc=org cn: test-comm description: Commutators shell, test user. objectclass: radiusprofile objectclass: person objectclass: top radiusgroupname: comm-shell radiusreplyitem: cisco-avpair = "shell:priv-lvl=15" sn: test-comm userpassword: *********** - ---[ quotation end ]------------------------------------------- and here is what I have in debug: - ---[ quotation start: debug from radiusd -XX ]------------------- Wed Feb 12 20:10:46 2014 : Debug: - Added client 1.2.3.4 with shared secret testing123 rad_recv: Access-Request packet from host 1.2.3.4 port 1026, id=133, length=70 User-Name = "test-comm" User-Password = "***********" NAS-Identifier = "zyxel.comm.local" NAS-IP-Address = 1.2.3.4 Wed Feb 12 20:10:46 2014 : Info: # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default Wed Feb 12 20:10:46 2014 : Info: +group authorize { ... Wed Feb 12 20:10:46 2014 : Debug: rlm_ldap::ldap_groupcmp: User found in group comm-shell ... Wed Feb 12 20:10:46 2014 : Debug: rlm_ldap::ldap_groupcmp: User found in group comm-shell Wed Feb 12 20:10:46 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Feb 12 20:10:46 2014 : Info: [files] users: Matched entry DEFAULT at line 23 Wed Feb 12 20:10:46 2014 : Info: [files] expand: %{User-Name}, you are comming as comm-shell. -> test-comm, you are comming as comm-shell. Wed Feb 12 20:10:46 2014 : Info: ++[files] = ok ... Wed Feb 12 20:10:46 2014 : Debug: [ldap] extracted attribute Huntgroup-Name from generic item Huntgroup-Name == ZyXEL Wed Feb 12 20:10:46 2014 : Debug: [ldap] radiusReplyMessage -> Reply-Message = "Hello, shell user." Wed Feb 12 20:10:46 2014 : Debug: [ldap] radiusServiceType -> Service-Type = Administrative-User Wed Feb 12 20:10:46 2014 : Info: [ldap] looking for check items in directory... Wed Feb 12 20:10:46 2014 : Debug: [ldap] userPassword -> Cleartext-Password == "***********" Wed Feb 12 20:10:46 2014 : Debug: [ldap] userPassword -> Password-With-Header == "***********" Wed Feb 12 20:10:46 2014 : Info: [ldap] looking for reply items in directory... Wed Feb 12 20:10:46 2014 : Debug: [ldap] extracted attribute Cisco-AVPair from generic item cisco-avpair = "shell:priv-lvl=15" Wed Feb 12 20:10:46 2014 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Feb 12 20:10:46 2014 : Info: ++[ldap] = ok ... Sending Access-Accept of id 133 to 1.2.3.4 port 1026 Reply-Message = "Hello, shell user." Service-Type = Administrative-User Cisco-AVPair = "shell:priv-lvl=15" - ---[ quotation end ]------------------------------------------- so, how can I make the commutators requests match the second rule from file users, not the third one? where am I wrong, please, I'm close to give up? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlL7v8QACgkQr3jpPg/3oyoc3gCaAxLr9v4rZjiW1JdNCUjrgiXi HlkAoI/MA1JlzHHaYrq3zzn+MEc45tsb =i7QQ -----END PGP SIGNATURE-----

1 0

Inheritance of eap.conf settings
by Jonathan Gazeley 12 Feb '14

12 Feb '14

Hi list, I'm neatening up my sprawling FreeRADIUS config and I've noticed something strange. Nothing uses the default eap.conf (and the default virtual server is disabled) but my understanding is that instantiations of the eap module, called like: eap eduroameap {} ... should inherit settings from eap.conf. In my eap.conf I've set: dh_file = /etc/raddb/certs/dh random_file = /dev/urandom And in my numerous EAP modules for various virtual servers, I've removed dh_file and random_file. Nothing complained about random_file being missing but apparently the dh_file being missing is an issue: rlm_eap_tls: Unable to open DH file - (null) rlm_eap: Failed to initialize type tls /etc/raddb/modules/rainboweap[17]: Instantiation failed for module "rainboweap" /etc/raddb/sites-enabled/rainbow-inner[17]: Failed to find "rainboweap" in the "modules" section. /etc/raddb/sites-enabled/rainbow-inner[13]: Errors parsing authenticate section. How come random_file was inherited while dh_file wasn't? Or have I misunderstood how this works, inerheritance doesn't exist, and it's just that random_file has a default value if undefined while dh_file doesn't? Thanks, Jonathan

4 3

Log when the proxy home_server has no response
by Chuang Okis 12 Feb '14

12 Feb '14

Dear all, we have some statistical requirements for eap-sim, I want know if I can identify and log it when we proxy Access-Request/Access-Challenge to external AAA home_server but no response back(timeout)? We now using perl to write our radius logs, so it would be great if we can identify "timeout" as response type and get the value from perl Hash - %RAD_* or somewhere outside by unlang. Is that possible? Best Regards, Okis

2 1

Re: Radius Issue, No response from server
by Rishabh.Shukla 12 Feb '14

12 Feb '14

Hello Alan, Thank you for your reply. I would like to highlight that I have checked that the machines can ping each other. Moreover, they are on the same network and the routing also works. Hence, to me it does not seem like a network issue. I would greatly appreciate any further help in this regard. Thanks Again. --------------------------------------------------------------------------- Best Regards, Rishabh On 2/12/2014 12:08 PM, Rishabh.Shukla wrote: ----- Forwarded Message ----- From: "Alan DeKok" <aland(a)deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, February 10, 2014 8:53:13 PM Subject: Re: Radius Issue, No response from server Rishabh.Shukla wrote: <blockquote> I have also stopped the iptables services still radius server is not listening and during debug we found that the request is not even reaching radius server and moreover I am not getting any error message at all. Then your network is broken. Fix it. This isn't a RADIUS issue. Ensure that the machines can "ping" each other, that they're on the same network, routing works, etc. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </blockquote>

2 1

Re: Radius Issue, No response from server
by Rishabh.Shukla 12 Feb '14

12 Feb '14

Hi, Thank you for your reply. I would like to highlight that I have checked that the switch and the radius server can ping each other. Moreover, they are on the same network and the routing also works. Hence, to me it does not seem like a network issue. I would greatly appreciate any further help in this regard. Thanks Again. ------------------------------------------------------------------------------------------- Best Regards, Rishabh On 2/12/2014 12:06 PM, Rishabh.Shukla wrote: ----- Forwarded Message ----- From: "HCC Mailing Lists" <hcc.lists(a)gmail.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, February 10, 2014 8:25:59 PM Subject: RE: Radius Issue, No response from server I may be stating the obvious, but since you have done the configuration perfectly and the packets are not reaching the RADIUS server you might check the configuration of the switch and the network to make sure they can reach each other. <blockquote> -----Original Message----- From: freeradius-users- bounces+hcc.lists=gmail.com(a)lists.freeradius.org [ mailto:freeradius - users-bounces+hcc.lists=gmail.com(a)lists.freeradius.org ] On Behalf Of Rishabh.Shukla Sent: Monday, February 10, 2014 09:11 To: freeradius-users(a)lists.freeradius.org Cc: Hiren Patel; Ronak Shah Subject: Radius Issue, No response from server Hello, I have deployed radius server + daloradius + MySQL in centos 6 and all <blockquote> configuration is done perfectly. I have added HP ProCurve switch </blockquote> 3400 <blockquote> CL as my NAS for sending authentication requests. The scenarios is this: the server is responding and accepting the packets locally but when I try to authenticate through the HP ProCurve switch the server does not respond. I have also stopped the iptables services still radius server is not listening and during debug we found that the request is not even reaching radius server and moreover I am not getting any error message at all. I will be grateful if anybody can help me out to overcome this </blockquote> problem. <blockquote> Thanks and regards Rishabh. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </blockquote> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </blockquote>

4 4

802.1x radius request reject.
by sampath jayashantha 12 Feb '14

12 Feb '14

Hi , I have created a user and added a node to that user. But im getting below access reject packet. :( Any clue ? rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=199, length=152 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000c0173616d70617468 Message-Authenticator = 0xe791fd6ef5be4d1bbc964ebf48dcdefa server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Calling-Station-Id = 78-45-C4-B5-AC-41 rlm_perl: Added pair Called-Station-Id = 00-0A-B7-BC-5A-84 rlm_perl: Added pair Cisco-NAS-Port = FastEthernet0/4 rlm_perl: Added pair Message-Authenticator = 0xe791fd6ef5be4d1bbc964ebf48dcdefa rlm_perl: Added pair User-Name = sampath rlm_perl: Added pair EAP-Message = 0x0200000c0173616d70617468 rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 192.168.13.45 rlm_perl: Added pair NAS-Port = 50004 rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair Auth-Type = EAP ++[packetfence] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 199 to 192.168.13.45 port 1812 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33cbc0cb31e5b71f340264f3a Finished request 54. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=200, length=279 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33cbc0cb31e5b71f340264f3a EAP-Message = 0x0201007919800000006f160301006a01000066030152fb07ded3e51b3a9c9aa55b0ba6f46016c14e1644de4fbd07186f436a4f3b4e000018002f00 350005000ac013c014c009c00a003200380013000401000025ff010001000000000c000a00000773616d70617468000a0006000400170018000b00020100 Message-Authenticator = 0x6aafb4e647c1076bc2b718e2181f6671 server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 1 length 121 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 111 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 006a], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 049b], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 200 to 192.168.13.45 port 1812 EAP-Message = 0x0102040019c0000004df16030100310200002d030152fb07bc28df3e052535a0db2ea09acfb1e4bce937947a1f3b22eeb766292f1400002f000005 ff01000100160301049b0b0004970004940004913082048d30820375a003020102020900884ec713d33dcea8300d06092a864886f70d01010505003076310b3009060355040613 024341310b30090603550408130251433111300f060355040713084d6f6e747265616c3110300e060355040a1307496e766572736531123010060355040313093132372e302e30 2e313121301f06092a864886f70d0109011612737570706f727440696e76657273652e6361301e170d3134303133303038323134 EAP-Message = 0x325a170d3135303133303038323134325a3076310b3009060355040613024341310b30090603550408130251433111300f060355040713084d6f6e 747265616c3110300e060355040a1307496e766572736531123010060355040313093132372e302e302e313121301f06092a864886f70d0109011612737570706f727440696e76 657273652e636130820122300d06092a864886f70d01010105000382010f003082010a0282010100cb6e98c86adb80fda9fe7c0396961929f7fb69fe2fe295ea79c8b71b9375ef 72feee48711980d5a8fd428e6e3233e0daf800f73b0b7095f2d669c6bce2faaeda9d4734c0a20aaeeb948771b6cbf52daef842d4 EAP-Message = 0xcc7c33a9c611e08be2ffe2c786ad1b685d607f90126c4d262bed4c683e97cdd39c6d03a7c3f2d2acea03542ce43004008518611445858caecde8e5 84104684170db2327c16861bdb2a7e6d827cf4c25197275278d702626a3b2bbcaf28d011d37252e79b7d041c2c0f715134ba4d92afdd9c9f09411877ba134798ff6d74c11ea95f e96c2f70e2c4c42333f750dc88cca9fb13c960eff392c7981f34ab6b27169db27f9f1a8832a8901ffcf29b0203010001a382011c30820118301d0603551d0e04160414d35fe892 a095707f22eee3cb19be4b6cab49ee3c3081a80603551d230481a030819d8014d35fe892a095707f22eee3cb19be4b6cab49ee3c EAP-Message = 0xa17aa4783076310b3009060355040613024341310b30090603550408130251433111300f060355040713084d6f6e747265616c3110300e06035504 0a1307496e766572736531123010060355040313093132372e302e302e313121301f06092a864886f70d0109011612737570706f727440696e76657273652e6361820900884ec7 13d33dcea8300c0603551d130101ff0402300030090603551d1204023000300b0603551d0f0404030205e030130603551d25040c300a06082b0601050507030130110609608648 0186f8420101040403020640300d06092a864886f70d010105050003820101009e1fdecc9821df724b9d9c78b12af5551673703f EAP-Message = 0xd588ff15429f1f34ed6b7926 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33dbf0cb31e5b71f340264f3a Finished request 55. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=201, length=164 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33dbf0cb31e5b71f340264f3a EAP-Message = 0x020200061900 Message-Authenticator = 0x353191b59561f9f1fe76fed6e28ef8a9 server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 201 to 192.168.13.45 port 1812 EAP-Message = 0x010300ef19007bb5e27c4da9bd39dfefc5c3402654575ff7204a10c5e4f018a975a2630c5599830e34267ba452b94ac1b7e2442ea616aecc99dc4b 47687b862d9b4df2fc607342e483df9231cd5c320f09ad144ba7980db161959853db1ca476fcdee76a1fae8744e7583d57291c42904a8c353f7f1ee417e4625efd2a6d8662301c 778e81f944fa4fa66deacb7f01d8687b39b7cc9054c58e4e0a43146042677aa701399ca609a08a9a4bf7a57c9bf36f03898dc606d7fd92cefd01b3976d1f2c217ce90a8dd1a956 c7b0e34d4e99e54f6278e229e3ed458dc2c4f7512023ccd6384a517bef16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33ebe0cb31e5b71f340264f3a Finished request 56. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=202, length=496 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33ebe0cb31e5b71f340264f3a EAP-Message = 0x02030150198000000146160301010610000102010059580f2ba30cc29dc5a15d7df2a9dead82de23679970708fb1c0ace280aee5f6db7256ef1b8f 659768e6e6959d71b576fd75c2d10e484741edf492f0fa72cf2144616a2591fa8bf10da5959fbbd6f98e9d1ae6005c890cb35f4038e0015a8fe69801f8c6601f096a1b5fed5ddf 07c16cdf1845a9bc0fea83db38aa4dba5ab0448f1b78e51230b7d3dadaf1b369882273d34c58ffd4e2d11ad96c5136019a2591a4a667b230511e776e954539b63327cacec28be8 84ffe88fee2be913ee19e0c69396495a1242a0fbaeb5d10536cb5b26670d7e32ee27a4715b402bda8bf497a8564e1832f28df7f5 EAP-Message = 0x31026b26edf1c7a46c69b5f35940c27541d48a52a1e235d91403010001011603010030d7cb7d641679a62d43055e25b36a2a4e2c487b7b313cb39d 38a3bd9d2dc5a4920a83fe83098070b6211205c38efa7b68 Message-Authenticator = 0x69c90a78fea5c6b936dbe253ccf88a43 server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 3 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 202 to 192.168.13.45 port 1812 EAP-Message = 0x01040041190014030100010116030100302d72e9da629993e710a01375e44f3ff6c496bc91aafe3b5efea86d1af805a7b9a01238efc53d2efc31a7 ff63472088bf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33fb90cb31e5b71f340264f3a Finished request 57. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=203, length=164 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33fb90cb31e5b71f340264f3a EAP-Message = 0x020400061900 Message-Authenticator = 0x3c84ad083e4e9d0a8240786169b376cf server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 203 to 192.168.13.45 port 1812 EAP-Message = 0x0105002b19001703010020233ca5ac7fdbf4aee3541cb39f7899bb7e74ea734215947f14d822d238425e59 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d338b80cb31e5b71f340264f3a Finished request 58. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=204, length=201 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d338b80cb31e5b71f340264f3a EAP-Message = 0x0205002b19001703010020738e4cb80e9a4f1f0d240d62bd1cecdd81e2ceef1fcd8a736f92a620ab1e6827 Message-Authenticator = 0x4d5068c89b9e99b0fcac71687069f264 server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 5 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - sampath [peap] Got inner identity 'sampath' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0205000c0173616d70617468 server packetfence { [peap] Setting User-Name to sampath Sending tunneled request EAP-Message = 0x0205000c0173616d70617468 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sampath" NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 server packetfence-tunnel { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "sampath", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 5 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server packetfence-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010600211a0106001c103c9631cb9240941b8ff7cb26b01cdccd73616d70617468 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb763a09fb765baae8b5ff4f7e1e703c3 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010600211a0106001c103c9631cb9240941b8ff7cb26b01cdccd73616d70617468 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb763a09fb765baae8b5ff4f7e1e703c3 [peap] Got tunneled Access-Challenge ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 204 to 192.168.13.45 port 1812 EAP-Message = 0x0106004b190017030100407ea62a6842f0b519ec0bf48a630b60f7e9f84151bee10b16cba686cd23951470367e059996c25fe5f9ab0312a3af8e05 222bd031372641bbc939adbacd345ea6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d339bb0cb31e5b71f340264f3a Finished request 59. Going to the next request Waking up in 3.0 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=205, length=265 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d339bb0cb31e5b71f340264f3a EAP-Message = 0x0206006b190017030100605c575006ef74492c6d35cf856541302dd4f1fb1272c048206638ab77315df28a5585a4cbd8fe6b9accf1e03d27ac3c2c 64d8052b1d08f12dcc61829dbddd05acb0dff7a2427b7fb0f096fe68defb30cecd74a4b9321c185184166c83c77f60a7 Message-Authenticator = 0xdaa88d9bc6343059a93a80ca449d11ae server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 6 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020600421a0206003d31e3766c4f25bb1e54194b8e8fc97544ed0000000000000000fead0628b2da8557a51d90b546624ef9f4ee5e1bdf2eec4400 73616d70617468 server packetfence { [peap] Setting User-Name to sampath Sending tunneled request EAP-Message = 0x020600421a0206003d31e3766c4f25bb1e54194b8e8fc97544ed0000000000000000fead0628b2da8557a51d90b546624ef9f4ee5e1bdf2eec4400 73616d70617468 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "sampath" State = 0xb763a09fb765baae8b5ff4f7e1e703c3 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 server packetfence-tunnel { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "sampath", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 6 length 66 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: sampath [mschap] Client is using MS-CHAPv2 for sampath, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [sampath] (from client 192.168.13.45 port 50004 cli 78-45-C4-B5-AC-41 via TLS tunnel) } # server packetfence-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\006E=691 R=1" EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server packetfence Sending Access-Challenge of id 205 to 192.168.13.45 port 1812 EAP-Message = 0x0107002b190017030100204facc5d6c6a20c7d1d8da40959527f726dbb84e495fd0ebc71ea913fc79b2b12 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cbd15d33aba0cb31e5b71f340264f3a Finished request 60. Going to the next request Waking up in 2.2 seconds. rad_recv: Access-Request packet from host 192.168.13.45 port 1812, id=206, length=201 NAS-IP-Address = 192.168.13.45 NAS-Port = 50004 Cisco-NAS-Port = "FastEthernet0/4" NAS-Port-Type = Ethernet User-Name = "sampath" Called-Station-Id = "00-0A-B7-BC-5A-84" Calling-Station-Id = "78-45-C4-B5-AC-41" Service-Type = Framed-User Framed-MTU = 1500 State = 0x3cbd15d33aba0cb31e5b71f340264f3a EAP-Message = 0x0207002b19001703010020e803f872cda2fc4834ed5079ccedbc963ca3580ad74aada3ce4f6ef81e932f3a Message-Authenticator = 0x2b593816dc1b145744204630a7a77fee server packetfence { # Executing section authorize from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "sampath", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] EAP packet type response id 7 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [sampath] (from client 192.168.13.45 port 50004 cli 78-45-C4-B5-AC-41) } # server packetfence Using Post-Auth-Type REJECT # Executing group from file /usr/local/pf/raddb/sites-enabled/packetfence +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sampath attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 61 for 1 seconds Going to the next request Waking up in 0.4 seconds. Cleaning up request 54 ID 199 with timestamp +2742 Cleaning up request 55 ID 200 with timestamp +2742 Cleaning up request 56 ID 201 with timestamp +2742 Cleaning up request 57 ID 202 with timestamp +2742 Waking up in 0.4 seconds. Sending delayed reject for request 61 Sending Access-Reject of id 206 to 192.168.13.45 port 1812 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 58 ID 203 with timestamp +2743 Waking up in 1.2 seconds. Cleaning up request 59 ID 204 with timestamp +2744 Waking up in 0.8 seconds. Cleaning up request 60 ID 205 with timestamp +2745 Waking up in 2.7 seconds. Cleaning up request 61 ID 206 with timestamp +2747 Ready to process requests. Regards, Sampath Jayashantha

3 2

6. Recommended number of threads (McNutt, Justin M.) - Re: Freeradius-Users Digest, Vol 106, Issue 31
by Rui Ribeiro 12 Feb '14

12 Feb '14

We have 2500 wireless clients at peak time, and I have seen as much as 20 simultaneous authentications before I optimised the freeradius server. We only have one RADIUS server in operation, and another for failover. The number of users is one tree in the forest IMO. Have you timed how long one user takes to authenticate? What is the load of your current server? How long the associate systems take to answer? At the end of the day, again, IMO, you have to balance good sysadmin practices while fine-tuning the associated systems, and fine-tune your freeradius configuration as well. Pay well attention to the debug information, as you can fine tune unlang for some events to not repeat all the way in the several steps of the negotiation; also the latest 2.2 versions seem to perform better than the 2.1.X - we went from 50-90ms down to less than 10ms. Note: have a look at eapol_test and raddebug if you are not using them. Regards On 11 February 2014 22:01, <freeradius-users-request(a)lists.freeradius.org>wrote: > > > Message: 6 > Date: Tue, 11 Feb 2014 20:53:08 +0000 > From: "McNutt, Justin M." <McNuttJ(a)missouri.edu> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Recommended number of threads > Message-ID: > < > 81D8D62C6E5AD1499D9C16729DB5B3DEDED03CE8(a)UM-MBX-N02.um.umsystem.edu> > Content-Type: text/plain; charset="us-ascii" > > I've been seeing some unexplained failures to authenticate 802.1X clients > when my system is under heavier load, and I suspect that I don't have > enough threads running. For reference, I currently have four servers in a > load balanced group with identical configs. Thread settings are these: > > max_servers = 32 > min_spare_servers = 3 > max_spare_servers = 10 > max_requests_per_server = 0 > > We have about 14,500 wireless clients at peak times, though that number > will climb, I'm sure. > > Is there a rule of thumb that will tell me how many threads I should have > (max_servers)? Also, I suspect that there have been authentication > failures due to all threads on a server being busy. Is there a good way to > confirm that? I've poked around in the radiusd logs a bit, but haven't > found much, other than the odd "Login failed" with no reason given. (For > "normal" failures, there are two messages, one of which has a cause like > "bad password" or "account locked out" or some such thing.) > > Advice is welcome. > > --J >

1 0

Conditional Auth Response?
by Darren Ward (darrward) 12 Feb '14

12 Feb '14

Hi All I'm looking for a way to change the response to an auth request based on the attributes in the request - if I receive a request for user 'bob' with just the password then send the response with normal attributes and one that has 'Cisco-Control-Info += "QV50000000" - if I receive a request for user 'bob' with password and 'Cisco-Control-Info = QV<value>' then respond with 'Cisco-Control-Info += "QV0" Basically that value in the first response sets a volume quota limit of 50Meg but when the device sends back a 're-auth' request when it thinks the volume has been used up I ned to respond with the QV0 so FreeRADIUS confirms that is all used up Apologies I just can't make sense of the way to write conditional rules for a user Darren

6 12

Recommended number of threads
by McNutt, Justin M. 11 Feb '14

11 Feb '14

I've been seeing some unexplained failures to authenticate 802.1X clients when my system is under heavier load, and I suspect that I don't have enough threads running. For reference, I currently have four servers in a load balanced group with identical configs. Thread settings are these: max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 We have about 14,500 wireless clients at peak times, though that number will climb, I'm sure. Is there a rule of thumb that will tell me how many threads I should have (max_servers)? Also, I suspect that there have been authentication failures due to all threads on a server being busy. Is there a good way to confirm that? I've poked around in the radiusd logs a bit, but haven't found much, other than the odd "Login failed" with no reason given. (For "normal" failures, there are two messages, one of which has a cause like "bad password" or "account locked out" or some such thing.) Advice is welcome. --J

3 2