- Freeradius-Users - lists.freeradius.org

Failed to Authenticate Cisco WLC 5508 to FreeRadius Server by using EAP.
by Poon Weng Chee 18 Dec '13

18 Dec '13

Hey guys, I want to implement the Cisco WLC 5508 to FreeRadius server, basically the FreeRadius Server is integrate with LDAP. The connection will look like diagram below, WLC 5508 --------> FreeRadius (Integrated LDAP) The connection between WLC 5508 to FreeRadius is using EAP. I got an errors while doing the test, the errors are below, +- entering group authorize {...} [ldap] performing user authorization for evening [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> evening [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=evening) [ldap] expand: dc=fng,dc=fnf,dc=local -> dc=fng,dc=fnf,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=fng,dc=fnf,dc=local, with filter (uid=evening) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user evening authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [eap] EAP packet type response id 1 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation I also getting this Accept-Challenge and Accept-Request, see the errors below, ++[eap] returns handled Sending Access-Challenge of id 153 to 10.201.65.241 port 32769 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7acc1b267ace021e658dc33386efc594 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.201.65.241 port 32769, id=154, length=347 User-Name = "evening" Calling-Station-Id = "00-23-12-11-6f-c5" Called-Station-Id = "ec-c8-82-ab-03-10:FNTest" NAS-Port = 1 Cisco-AVPair = "audit-session-id=0ac941f10001e76252a7e42a" NAS-IP-Address = 10.201.65.241 NAS-Identifier = "F&N_COM_WLC5508_2" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "10" EAP-Message = 0x0202006d198000000063160301005e0100005a030152a7e33ffc9ad76b67fac2d1ba43bfca99c29126ee731235c001ea8bfdf4bd32000018002f00350005000ac013c014c009c00a003200380013000401000019ff01000100000a0006000400170018000b0002010000230000 State = 0x7acc1b267ace021e658dc33386efc594 Message-Authenticator = 0x59835b7747b9a7654512b48586a132a5 What are the possibility that the authentication failed between Cisco WLC to FreeRadius?? Hope you guys can assist me on this particular issues. Really appreciate it for your help. Thanks & Regards, Weng Chee DISCLAIMER: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you are not the intended recipient or the person responsible, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error, please immediately notify us. Thank you.

2 1

Regex Split on forward slash?
by Peter Lambrechtsen 17 Dec '13

17 Dec '13

I'm trying to do a global split on a forward slash in FreeRadius 2.1.12. Essentially I am trying to do a split on the ADSL Circuit ID: ADSL-Agent-Circuit-Id = "POLT01 eth 1/1/02/05/4/14/1:10" And trying to grab the value in the 6th split being "14" and check it's a 14. I would have hoped something like this regex would work: if ("%{ADSL-Agent-Circuit-Id}" =~ /(?<=\/)([\w-]*)(?=\/)/ ) { update request { Tmp-String-1 = "%{0}" Tmp-String-2 = "%{1}" Tmp-String-3 = "%{2}" Tmp-String-4 = "%{3}" Tmp-String-5 = "%{4}" Tmp-String-6 = "%{5}" Tmp-String-7 = "%{6}" } } And it would put each match into a Variable, or using /\//g too. But neither option works. Any suggestions on how to make it work, as I think taking it into Perl may be the best option.

4 7

how to install debugging symbols
by Hachmer, Tobias 16 Dec '13

16 Dec '13

Hello, I build radiusd RPM packages from the 3.0.x branch using the provided spec file. While debugging I recognized that are no debugging symbols installed by default and no package which contains them. What do I have to do in order to install the debugging symbols? Kind regards, Tobias Hachmer

6 15

SQL MAC Authentication
by Christopher Kuhn 16 Dec '13

16 Dec '13

Hello, I have a FreeRADIUS 2.1.10 server which is currently working as an authentication server on our wireless network. It is able to successfully use PEAP-MSCHAP and LDAP queries to an Active Directory database for authentication. We have now been trying to implement MAC address authentication on the wired network, using a Cisco switch and this same FreeRADIUS server. The goal is to use a MySQL database of MACs to check against. However, testing so far has failed to auth the test machines. The radius.radcheck table: +----+--------------+--------------------+----+--------------+ | id | username | attribute | op | value | +----+--------------+--------------------+----+--------------+ | 1 | 28d2441b77c9 | Cleartext-Password | := | 28d2441b77c9 | | 2 | aabbcc112233 | Cleartext-Password | := | aabbcc112233 | +----+--------------+--------------------+----+--------------+ The debug output: Ready to process requests. rad_recv: Access-Request packet from host 10.25.22.31 port 49181, id=0, length=118 NAS-IP-Address = 10.25.22.31 NAS-Port-Type = Ethernet NAS-Port = 76 User-Name = "28d2441b77c9" Acct-Session-Id = "050004EE" Calling-Station-Id = "28-D2-44-1B-77-C9" EAP-Message = 0x0200001101323864323434316237376339 Message-Authenticator = 0x0c1c468757ad8814bb6dae782e1ac927 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "28d2441b77c9", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 189 ++[files] returns ok [sql] expand: %{User-Name} -> 28d2441b77c9 [sql] sql_set_user escaped user --> '28d2441b77c9' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '28d2441b77c9' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '28d2441b77c9' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '28d2441b77c9' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [ldap] performing user authorization for 28d2441b77c9 [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=28d2441b77c9) [ldap] expand: DC=company,DC=tld -> DC=company,DC=tld [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to server.company.tld:636, authentication 0 [ldap] setting TLS mode to 1 [ldap] bind as [redacted] [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in DC=company,DC=tld, with filter (sAMAccountName=28d2441b77c9) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.25.22.31 port 49181 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8246357d82472c193c76c7709d2aae65 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.25.22.31 port 49181, id=0, length=153 Cleaning up request 1 ID 0 with timestamp +37 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x8246357d82472c19 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! NAS-IP-Address = 10.25.22.31 NAS-Port-Type = Ethernet NAS-Port = 76 User-Name = "28d2441b77c9" Acct-Session-Id = "050004EE" State = 0x8246357d82472c193c76c7709d2aae65 Calling-Station-Id = "28-D2-44-1B-77-C9" EAP-Message = 0x020100220410ab090564f0a81fef7cc5fa4ad743a959323864323434316237376339 Message-Authenticator = 0xb33f92e3651c00e500fe3b5722276082 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "28d2441b77c9", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 34 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 189 ++[files] returns ok [sql] expand: %{User-Name} -> 28d2441b77c9 [sql] sql_set_user escaped user --> '28d2441b77c9' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '28d2441b77c9' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '28d2441b77c9' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '28d2441b77c9' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [ldap] performing user authorization for 28d2441b77c9 [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=28d2441b77c9) [ldap] expand: DC=company,DC=tld -> DC=company,DC=tld [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=company,DC=tld, with filter (sAMAccountName=28d2441b77c9) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] Response appears to match, but EAP type is wrong. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect ( [ldap] User not found): [28d2441b77c9] (from client test-switch port 76 cli 28-D2-44-1B-77-C9) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 28d2441b77c9 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.8 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 0 to 10.25.22.31 port 49181 What I do not understand: 1) Why does finding the user in SQL not seem to count for authentication (is it supposed to return updated)? 2) Why does FreeRADIUS continue on to try LDAP, even showing it as the exclusive reason for failure? 3) What am I missing that will cause an Access-Accept if a user is found in SQL? I hope you can forgive a first-timer for any relevant information I have left out.Any feedback you can give is greatly appreciated.

2 1

Freeradius+LDAP+MYSQL Simultaneous-Use
by ultaman khoo 16 Dec '13

16 Dec '13

Hi All, Appreciate someone can help on how to get Simultaneous-Use function working with Freeradius+MYSQL+LDAP, any link or website will be helpful. Regards, Alex

3 3

Unable to locate mysql-devel package on Ubuntu 11.04
by brijesh shingadiya 16 Dec '13

16 Dec '13

Hi Everyone, I am trying to make my freeradius server as a DHCP server. I am trying to install mysql-devel package as mentioned in the document but I keep getting error "Unable to locate mysql-devel package". Any inputs on this would be highle appreciated. Thanks, Brijesh

4 5

LDAP + Active Directory Authentication Issue
by Luke Ramsden 16 Dec '13

16 Dec '13

Hi, I am trying to authenticate users against Active Directory using LDAP. I can perform the initial bind using an ldap bind account. I can then successfully find the Distinguished Name in Active Directory given a domain user's username. I would now like to re-bind using that Distinguished Name in order to authenticate the password they supplied as described in point 4 here: http://thecarlhall.wordpress.com/2011/01/04/ldap-authentication-authorizati… The problem I am having is my server errors out with 'No Auth-Type found' come authentication time. I added 'set_auth_type = yes' to mods-available/ldap but it seems to have had no effect. I am very new to this so am still finding my feet - can anyone help? Subset of output from terminal (redacted some personal info): (0) ldap : Performing search in 'ou=Users,dc=example,dc=domain,dc=com' with filter '(uid=example-user)' (0) ldap : Waiting for search result... (0) ldap : User object found at DN "CN=Name,OU=Users,DC=example,DC=domain,DC=com" rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): Closing connection (0): Too many free connections (5 > 3) (0) [ldap] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = 'example-user', looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (0) WARNING: pap : Authentication will fail unless a "known good" password is available. (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post Auth-Type = Reject (0) Failed to authenticate the user. (0) Using Post-Auth-Type Reject Many thanks

4 5

redundant ldap configuration
by Polish 16 Dec '13

16 Dec '13

Hello, I tried setup redundant ldap on latest git version of FR3. ldaps are defined in module ldap: ldap ldap1 { ... } ldap ldap3 { ... } sites default and inner-tunnel are changed from ldap to redundant { ldap1 ldap3 } If connections to ldap is established, fr returns "Login OK" and eapol_test SUCCESS. If someone ldap connection is down, fr returns "Login OK", but eapol_test trying resending requests (in freeradius log I see "Discarding duplicate request from client test port 36732 - ID: 11 due to unfinished request") In debug "freeradius -fxx -l stdout" returns Login incorect, and eapol_test failed immediatly: (9) redundant redundant { (9) ERROR: ldap1 : All ldap connections are in use (9) [ldap1] = fail (9) ERROR: ldap3 : All ldap connections are in use (9) [ldap3] = fail (9) } # redundant redundant = fail (9) } # authorize = fail LDAP server is eDirectory. Thank you for tips Pavel Polacek

5 11

Request ID ATTRIBUTE
by Mehdi Ravanbakhsh 14 Dec '13

14 Dec '13

Hi All what is the ATTRIBUTE of request ID ? Best regards.

2 4

received signal SIGSEGV, Segmentation fault. malloc_consolidate (av=0x7ffff5e2de80) at malloc.c:5196
by Hachmer, Tobias 13 Dec '13

13 Dec '13

Hello, I'm testing kerberos authentication with the workaround from yesterday (https://github.com/FreeRADIUS/freeradius-server/commit/ea887a2ab7308a6f612d…) After 2-3 authentication tests radiusd get a SIGSEGV. OS: CentOS 6.5 x86_64 FR built today from v3.0.x branch BT: rad_recv: Access-Request packet from host 127.0.0.1 port 55082, id=14, length=103 User-Name = 'hachmer' User-Password = 'pw' NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x64454c20cfa4534882ca622de7e32c0e (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) filter_username filter_username { (2) ? if (User-Name != "%{tolower:%{User-Name}}") Program received signal SIGSEGV, Segmentation fault. malloc_consolidate (av=0x7ffff5e2de80) at malloc.c:5196 5196 nextsize = chunksize(nextchunk); Missing separate debuginfos, use: debuginfo-install ncurses-libs-5.7-3.20090208.el6.x86_64 pcre-7.8-6.el6.x86_64 sqlite-3.6.20-1.el6.x86_64 (gdb) bt #0 malloc_consolidate (av=0x7ffff5e2de80) at malloc.c:5196 #1 0x00007ffff5b17405 in _int_malloc (av=0x7ffff5e2de80, bytes=<value optimized out>) at malloc.c:4406 #2 0x00007ffff5b18991 in __libc_malloc (bytes=1104) at malloc.c:3664 #3 0x00007ffff715063f in __talloc (ctx=<value optimized out>, el_size=<value optimized out>, count=<value optimized out>, name=<value optimized out>) at ../talloc.c:560 #4 _talloc_named_const (ctx=<value optimized out>, el_size=<value optimized out>, count=<value optimized out>, name=<value optimized out>) at ../talloc.c:669 #5 _talloc_array (ctx=<value optimized out>, el_size=<value optimized out>, count=<value optimized out>, name=<value optimized out>) at ../talloc.c:2217 #6 0x00007ffff7bcf0f4 in xlat_aprint (ctx=0xa16a40, request=0xa16a40, node=0x913af0, escape=0, escape_ctx=0x0, lvl=0) at src/main/xlat.c:1895 #7 0x00007ffff7bcfcd1 in xlat_process (out=0x7fffffffc1b8, request=0xa16a40, head=<value optimized out>, escape=0, escape_ctx=0x0) at src/main/xlat.c:1976 #8 0x00007ffff7bcff8c in xlat_expand (out=0x7fffffffc2c0, outlen=0, request=0xa16a40, fmt=0x81c0c0 "%{tolower:%{User-Name}}", escape=0, escape_ctx=0x0) at src/main/xlat.c:2068 #9 0x00007ffff7bcb7e8 in radius_expand_tmpl (out=0x7fffffffc2c0, request=0xa16a40, vpt=<value optimized out>) at src/main/evaluate.c:108 #10 0x00007ffff7bcbfd8 in radius_evaluate_map (request=0xa16a40, modreturn=<value optimized out>, depth=<value optimized out>, c=0x81bd30) at src/main/evaluate.c:424 #11 0x00007ffff7bcc5b1 in radius_evaluate_cond (request=0xa16a40, modreturn=10, depth=0, c=<value optimized out>) at src/main/evaluate.c:597 #12 0x000000000041ed3b in modcall_recurse (request=0xa16a40, component=RLM_COMPONENT_AUTZ, depth=2, entry=0x7fffffffd3d0) at src/main/modcall.c:480 #13 0x00000000004201d4 in modcall_child (request=<value optimized out>, component=RLM_COMPONENT_AUTZ, depth=2, entry=0x7fffffffd3b8, c=0xa026a0, result=0x7fffffffc9ec) at src/main/modcall.c:414 #14 0x000000000041eb5f in modcall_recurse (request=0xa16a40, component=RLM_COMPONENT_AUTZ, depth=1, entry=0x7fffffffd3b8) at src/main/modcall.c:780 #15 0x00000000004201d4 in modcall_child (request=<value optimized out>, component=RLM_COMPONENT_AUTZ, depth=1, entry=0x7fffffffd3a0, c=0xa02620, result=0x7fffffffcf4c) at src/main/modcall.c:414 #16 0x000000000041eb5f in modcall_recurse (request=0xa16a40, component=RLM_COMPONENT_AUTZ, depth=0, entry=0x7fffffffd3a0) at src/main/modcall.c:780 #17 0x00000000004200fd in modcall (component=<value optimized out>, c=<value optimized out>, request=<value optimized out>) at src/main/modcall.c:1036 #18 0x000000000041af93 in indexed_modcall (comp=RLM_COMPONENT_AUTZ, idx=0, request=0xa16a40) at src/main/modules.c:747 #19 0x000000000040cc42 in rad_authenticate (request=0xa16a40) at src/main/auth.c:409 #20 0x000000000042b41c in request_running (request=0xa16a40, action=1) at src/main/process.c:1210 #21 0x000000000042af4d in request_queue_or_run (request=0xa16a40, process=0x42b2e0 <request_running>) at src/main/process.c:850 #22 0x000000000042d2b0 in request_receive (listener=0xa131f0, packet=0x8fe710, client=0x8110a0, fun=0x40c9b0 <rad_authenticate>) at src/main/process.c:1409 #23 0x00000000004158b3 in auth_socket_recv (listener=0xa131f0) at src/main/listen.c:1509 #24 0x000000000042777b in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0xa131f0) at src/main/process.c:3494 #25 0x00007ffff79abcbb in fr_event_loop (el=0xa05770) at src/lib/event.c:417 #26 0x0000000000420b14 in main (argc=<value optimized out>, argv=<value optimized out>) at src/main/radiusd.c:479 Thanks in advance, Tobias Hachmer

2 10