- Freeradius-Users - lists.freeradius.org

PAM authentication not working
by Jaap Winius 10 Feb '13

10 Feb '13

Hi folks, Having managed to get freeradius 2.10 to run on Debian squeeze with a username and password defined in /etc/freeradius/users, I was hoping to take a step forward by getting it to authenticate users through PAM. But, that's not working out as I had hoped. Could sombody please tell me what's missing, or what I'm doing wrong? So far I have done the following: 1.) Copied a set of 4096-bit MD5 SSL certificates that were used in the previous configuration to the /etc/freeradius/certs directory. To generate them, each time I used "LongStringNumberOne" for both the input and output passwords. Among the encryption files generated are ca.pem, dh, server.key and server.pem. The ca.pem file was also copied to my laptop's /etc/certs directory and is used with wpasupplicant for testing the system. 2.) Added the following lines to the end of /etc/freeradius/clients: client 192.168.2.0/24 { secret = LongStringNumberTwo shortname = mynet } 3.) Added the following line to the end of /etc/freeradius/users: DEFAULT Auth-Type = Pam 4.) In /etc/freeradius/eap.conf I changed the values of the following two attributes to: default_eap_type = ttls private_key_password = LongStringNumberOne 5.) In /etc/freeradius/radiusd.conf I changed the value of the following attribute to: user = root 6.) In both /etc/freeradius/sites-enabled/default and /etc/freeradius/sites-enabled/inner-tunnel, I uncommented the "pam" entry in section "authenticate". 7.) Some sources suggest changing it, but I chose to leave the contents of /etc/pam.d/radiusd unmodified: @include common-auth @include common-account @include common-password @include common-session 8.) My NAS is a Linksys is a WRT54GS running DD-WRT v24 firmware and is configured as follows: Wireless Mode AP Wireless Network Mode Mixed Wireless Network Name (SSID) mynet Wireless Channel 6 - 2.437 GHz Wireless SSID Broadcast Enable Network Configuration Bridged Security Mode WPA2 Enterprise WPA Algorithms TKIP+AES RADIUS Server Address 192.168.2.12 RADIUS Server Port 1812 RADIUS Shared Secret LongStringNumberTwo Key Renewal Interval (in sec.) 3600 Unfortunately, after starting the server in debugging mode with "freeradius -X", my client's authentication attempts get rejected and I get the following output from the freeradius server: ========================================= rad_recv: Access-Request packet from host 192.168.2.2 port 1025, id=0, length=245 Cleaning up request 6 ID 0 with timestamp +12 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2ecb21dd28cc340c did not finish! WARNING: !! Please read http://wiki.freeradius.org/ Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! User-Name = "jwinius" NAS-IP-Address = 192.168.2.2 Called-Station-Id = "0014bf72f676" Calling-Station-Id = "00110a81fb2b" NAS-Identifier = "0014bf72f676" NAS-Port = 17 Framed-MTU = 1400 State = 0x2ecb21dd28cc340c8873b5871c637572 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700701500170301002073bdd7051dfb44f3caccd4c92... Message-Authenticator = 0x6cbe906a70bc7ee95f9ad3365a0471b0 # Executing section authorize from file /etc/freeradius/sites-enabled/ default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "jwinius", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 112 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request EAP-Message = 0x0201001604109f00ed2b3ff2dd5111997f0ba6cee99e FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request EAP-Message = 0x0201001604109f00ed2b3ff2dd5111997f0ba6cee99e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "jwinius" State = 0xdbd7fca1dbd6f80c791225e3340ea6e4 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/ inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "jwinius", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 1 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 211 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls rlm_eap_ttls: Freeing handler for user jwinius [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jwinius attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 0 to 192.168.2.2 port 1025 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 ========================================= Any idea what I'm doing wrong? Thanks, Jaap

4 10

Session-Timeout anomalies
by Bill Isaacs 09 Feb '13

09 Feb '13

Hello all, I'm researching this anomaly myself in all the documentation, but thought it would also be helpful both to me and to others to post the problem here. SYMPTOM: Some "Access-Period" accounts (accounts which have X number of seconds to continue logging in and out starting from the very first login) are giving too much time -- that is, at some point they reload the full value of the account type and restart the count down. I discovered it while developing some interface code for our customer service dept. So far, this DOES NOT seem to be happening to all accounts. Moreover, the database info and radclient results are inconsistent on these accounts that ARE showing the anomaly. Here is an example of one such account, a development test account which I created for debugging purposes. It's value is 30 days (2592000 seconds) Radclient result: =============== # echo User-Name="cgitest",User-Password="cgitest" | radclient -c 1 -n 3 -r 3 -t 3 -x 127.0.0.1:1812 auth -S shared Sending Access-Request of id 24 to 127.0.0.1 port 1812 User-Name = "cgitest" User-Password = "cgitest" rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=24, length=26 Session-Timeout = 2366393 =============== sql query: SELECT IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) FROM radacct WHERE UserName='cgitest' ORDER BY AcctStartTime LIMIT 1 \g +-------------------------------------------------------------------------------------+ | IFNULL(TIME_TO_SEC(TIMEDIFF(NOW(), MIN(AcctStartTime))),0) | +-------------------------------------------------------------------------------------+ | 1447012 | +-------------------------------------------------------------------------------------+ =============== Ok, the problem here should be obvious but I'll explain these results for those who are impatient. The "Session-Timeout" number is way too large. As I stated previously, this is a 30 day account. It was counting down with no problems until a few days ago. It then mysteriously began reporting in the popup window which I was working on that it had 29.9 days left on it, after it had already counted down to something like 15 days. It simply seems to have reloaded itself, even though the sql query reports the accurate number of seconds which have actually expired. (1447012). So if we do the math: 2592000-1447012=1144988 (or roughly 13.25 days) should be the remaining time on this account. Not 27.38 days. Here is the sql counter from sqlcounter.conf: sqlcounter accessperiod { counter-name = Max-Access-Period-Time check-name = Access-Period reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = never query = “SELECT UNIX_TIMESTAMP() – UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = ‘%{%k}’ ORDER BY AcctStartTime LIMIT 1″ } (Before anyone bitches about the sql query being different, save your pixels -- no matter which style of query is used, the account reports that it began at the same time, there is truly no issue here that I can see). ALSO, BEFORE YOU ASK: There is only 1 radius server and only 1 sql server on the system. Besides, I have tested this exhaustively using different things like the public IP, the fqdn, etc etc. Results are the same - that is to say, wrong. lol Ok so the question then is: where the hell is radclient getting the notion that the account has 2366393 seconds left? Where is "Session-Timeout" getting this information? Why is it only doing it on some accounts and not others? Any insights would be greatly appreciated. I will post the resolution here (unless one of you smart lads or lasses beats me to it ;) ).

2 10

Re: Any interoperability issues with Aruba and Freeradius
by Alex Sharaz 08 Feb '13

08 Feb '13

Aruba now say they only support eap-tls and eap-peap when you offload eap onto their mobility controllers. Rgds Alex On 8 Feb 2013, at 16:46, freeradius-users-request(a)lists.freeradius.org wrote: > Re: Any interoperability issues with Aruba and Freeradius

3 3

Re: Issues with Freeradius crashing after a sighup
by Alex Sharaz 08 Feb '13

08 Feb '13

| See the changelog for 2.2.0. The "passwd" module had issues with |older versions of the server. | |You can also reload individual modules. That will be less likely to |have issues. i.e. | |$ radmin -e "hup passwd" | And from the control-socket code # # Control socket interface. # # HIGHLY experimental! It should NOT be used in production # environments. # The servers are in a production environment. I'd really like to try just reloading the passwd module to see if it makes any difference to the server stability but not at the detriment to any security type issues A On 8 Feb 2013, at 16:09, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Issues with Freeradius crashing after a sighup (Alan DeKok) > 2. RE: [EAP/TLS] Authenfication through a certificate > (vazoumana fofana) > 3. Re: Session-Timeout anomalies (Bill Isaacs) > 4. Re: Session-Timeout anomalies (Alan DeKok) > 5. Any interoperability issues with Aruba and Freeradius > (Alex Sharaz) > 6. Re: MAc-Auth with EAP (Tunde Ogedengbe) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 08 Feb 2013 10:10:05 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Issues with Freeradius crashing after a sighup > Message-ID: <5115154D.5070804(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Alex Sharaz wrote: >> Firstly the 2.1 servers > > <shrug> Upgrade. > >> password files are updated every 15 mins and are followed by a "service freeradius reload" command to bring them on line. > > See the changelog for 2.2.0. The "passwd" module had issues with > older versions of the server. > > You can also reload individual modules. That will be less likely to > have issues. i.e. > > $ radmin -e "hup passwd" > >> Anyone else seen serve crashes on a reload? > > Unfortunately I've seen this before. I haven't seen enough > information to track it down and fix it, though. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Fri, 8 Feb 2013 15:24:53 +0000 > From: vazoumana fofana <zoumlander(a)hotmail.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: [EAP/TLS] Authenfication through a certificate > Message-ID: <SNT137-W406D40D7E02D3B5D51A487D2050(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > i begin setting up configuration. bit i got two problems : > > client with good certificate can be authenticated even if they're not in "users" file. > I assume it's due to my code. Here is under authenticate section of default : > > Auth-Type eap { > eap > if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxx\// ) { > if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxxxxx\// ) { > ok > } > else { > fail > } > It's like when condition is checked, it bypassed "users" file. > > Maybe, i must move these lines under authorize ? > anyone to confirm it ? > > cheers > > >> Date: Mon, 4 Feb 2013 10:32:22 -0500 >> From: aland(a)deployingradius.com >> To: freeradius-users(a)lists.freeradius.org >> Subject: Re: [EAP/TLS] Authenfication through a certificate >> >> vazoumana fofana wrote: >>> i've got question about EAP/TLS and authentification for a client >>> through a certificate ? >>> I succeed setting up. But , i notice that freeradius matches client >>> login with certificate CNAME. >>> Is it possible to change it in order to match email instead of CNAME ? >> >> Yes. >> >> Read the eap.conf file, and the raddb/sites-available/default. This >> is documented. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

3 4

Issues with Freeradius crashing after a sighup
by Alex Sharaz 08 Feb '13

08 Feb '13

Hi all, I've inherited a pair of Freeradius servers running Vsn 2.10 and have build a new server around the 2.2 source code. All of these servers exhibit the same problem in that after a SIGHUP to reload their configuration files the sometimes crash. Firstly the 2.1 servers We have 2 of them configured to support our wired and wireless auth user base. Each server has a primary auth function ( wired or wireless) and acts as a backup for the other server) These are running on an old Debian OS and make use of the Freeradius versions available through the apt-get package manager. Configuration wise everything uses password files and all logs are written to a local hard disk. We don't use SQL or AD or any other systems in the authentication or accounting process. password files are updated every 15 mins and are followed by a "service freeradius reload" command to bring them on line. At least once a day the freeradius daemon will crash just after the "reload" command. The normal logfiles (see below) just show the following with no indication of why the process crashed. Cfashes happen randomly on both servers, although the server handling the wireless network crashes more frequently than the one handling the wired network. Fri Feb 8 00:05:03 2013 : Info: HUP - loading modules Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "attr_filter.post-proxy" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "attr_filter.pre-proxy" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "attr_filter.access_reject" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "attr_filter.accounting_response" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "pap" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "files" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "accounting_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "auth_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "reply_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "pre_proxy_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "post_proxy_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "york_passwd" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "landb_device_info" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "switch_vlan_info" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "sql_log" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "suffix" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "mschap" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "mschap_default" Fri Feb 8 00:05:03 2013 : Info: Module: Reloaded module "detail" Fri Feb 8 00:05:03 2013 : Info: Loaded virtual server <default> Fri Feb 8 00:05:03 2013 : Info: Loaded virtual server inner-tunnel Fri Feb 8 00:05:03 2013 : Info: Loaded virtual server eduroam Freeradius version 2.2 - wireless server The 2.2 server was compiled from source on an Ubuntu 12.04 LTS VmWare server and has a slightly different configuration. Configuration files are used for MAC based authentication and for some standard users such as the university of york eduroam health check test account. For 802.1x authentication I use a back end AD system and authenticate all our "real users" against AD. Configuration files for MAC based authentication RADIUS clients and test users are generated once a day and the system is reloaded at midnight every day. The configuration used on this server is based upon the "template" one provided by UKERNA for their UK eduroam user base. This server can run for a couple of weeks before it crashes. I know I should run the daemon with the -X option and dump the output to a file, but given the random nature of these crashes, I'm not sure I'll have enough disk space to just run in debug mode and collect all the logs. Anyone else seen serve crashes on a reload? Rgds Alex

4 3

regarding radius crashing on sigHUP
by Alex Sharaz 08 Feb '13

08 Feb '13

> Alex Sharaz wrote: >> Anyone else seen serve crashes on a reload? > > Unfortunately I've seen this before. I haven't seen enough > information to track it down and fix it, though. |One workaround is to just do a restart instead of a reload. It's |not likely to make much of a difference. :-) that's what I ended up doing Rgds A

1 0

Re: [EAP/TLS] Authenfication through a certificate
by Alan Buxey 08 Feb '13

08 Feb '13

As already said, post output of radiusd -X (that will clearly show the logic taken) alan

2 1

Re: Freeradius-Users Digest, Vol 94, Issue 19
by Alex Sharaz 08 Feb '13

08 Feb '13

1st response On 8 Feb 2013, at 16:09, freeradius-users-request(a)lists.freeradius.org wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Issues with Freeradius crashing after a sighup (Alan DeKok) > 2. RE: [EAP/TLS] Authenfication through a certificate > (vazoumana fofana) > 3. Re: Session-Timeout anomalies (Bill Isaacs) > 4. Re: Session-Timeout anomalies (Alan DeKok) > 5. Any interoperability issues with Aruba and Freeradius > (Alex Sharaz) > 6. Re: MAc-Auth with EAP (Tunde Ogedengbe) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 08 Feb 2013 10:10:05 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Issues with Freeradius crashing after a sighup > Message-ID: <5115154D.5070804(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Alex Sharaz wrote: >> Firstly the 2.1 servers > > <shrug> Upgrade. > >> password files are updated every 15 mins and are followed by a "service freeradius reload" command to bring them on line. > > See the changelog for 2.2.0. The "passwd" module had issues with > older versions of the server. > > You can also reload individual modules. That will be less likely to > have issues. i.e. > > $ radmin -e "hup passwd" > >> Anyone else seen serve crashes on a reload? > > Unfortunately I've seen this before. I haven't seen enough > information to track it down and fix it, though. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Fri, 8 Feb 2013 15:24:53 +0000 > From: vazoumana fofana <zoumlander(a)hotmail.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: RE: [EAP/TLS] Authenfication through a certificate > Message-ID: <SNT137-W406D40D7E02D3B5D51A487D2050(a)phx.gbl> > Content-Type: text/plain; charset="iso-8859-1" > > > i begin setting up configuration. bit i got two problems : > > client with good certificate can be authenticated even if they're not in "users" file. > I assume it's due to my code. Here is under authenticate section of default : > > Auth-Type eap { > eap > if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxx\// ) { > if ( "%{TLS-Client-Cert-Subject}" =~ /\/xxxxxxxxxxx\// ) { > ok > } > else { > fail > } > It's like when condition is checked, it bypassed "users" file. > > Maybe, i must move these lines under authorize ? > anyone to confirm it ? > > cheers > > >> Date: Mon, 4 Feb 2013 10:32:22 -0500 >> From: aland(a)deployingradius.com >> To: freeradius-users(a)lists.freeradius.org >> Subject: Re: [EAP/TLS] Authenfication through a certificate >> >> vazoumana fofana wrote: >>> i've got question about EAP/TLS and authentification for a client >>> through a certificate ? >>> I succeed setting up. But , i notice that freeradius matches client >>> login with certificate CNAME. >>> Is it possible to change it in order to match email instead of CNAME ? >> >> Yes. >> >> Read the eap.conf file, and the raddb/sites-available/default. This >> is documented. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

MAc-Auth with EAP
by Tunde Ogedengbe 08 Feb '13

08 Feb '13

I am setting up our Freeradius to do authentication for MAC address for windows PC. This is to enable PCs to connect to the AD to access Domain information just before Windows User Logon Screen. The PC is already connected to a Cisco switch port which has been configured 802.1x. I have stored list of authorized MAC addresses in a file called authorized_macs in Freeradius confdir. I have also set up appropriate commands in Authorize and Authentication sections of sites-enabled/default file for authorization and authentication. I can see from the log that the MAC addresses is checked and OK. But there is an [eap] returns reject just after the mac address was successfully checked. I guess I need a way to get radius to force an EAP accept after successful checking of the MAC addresses. Below is my Auth-Type statement which gets the system to do MAC address checking for PCs connecting with the hint “thehive”. The else statement is to cause all other requests to requests to be processed normally using mschap_ad (which is a function that calls ntlm_auth). Auth-Type MS-CHAP { if ( Hint == "validmac") { authorized_macs update control { Auth-Type := Accept } } else { mschap_ad } } Below is the extract of the log highlighting successful mac address checking but still returned [eap] returns reject # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if (outer.Hint == "validmac") [mschapv2] ? Evaluating (outer.Hint == "validmac") -> TRUE [mschapv2] ++? if (outer.Hint == "validmac") -> TRUE [mschapv2] ++- entering if (outer.Hint == "validmac") {...} [authorized_macs] expand: %{Calling-Station-ID} -> 00-1a-a0-b8-3b-73 +++[authorized_macs] returns noop ++- if (outer.Hint == "thehive") returns noop ++ ... skipping else for request 14: Preceding "if" was taken [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [host/hive-rjm2.library.networcs.net] (from client 193.62.48.37 port 50242 cli 00-1a-a0-b8-3b-73 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. -- 'Tunde Ogedengbe "But thanks be to God, who gives me the VICTORY through my Lord Jesus CHRIST" - 1 Corinthians 15:57

2 3

Configuring accounting on Freeradius server
by Deepti kulkarni 08 Feb '13

08 Feb '13

Hello, I am running Freeradius Server version 2.1.10 on a debian machine (64 bit). I have a debian client (using pam_radius_auth) for authentication and accounting. My client can authenticate into the the radius server, however, I dont see any accounting being done. Attached is the radiusd -X output. Is there any configuration required for the pam_radius_auth.so? Also on the freeradius server, I uncommented a line from acct_users - root@debian:/etc/freeradius# cat acct_users # # $Id$ # # This is like the 'users' file, but it is processed only for # accounting packets. # # Select between different accounting methods based for example on the # Realm, the Huntgroup-Name or any combinaison of the attribute/value # pairs contained in an accounting packet. # #DEFAULT Realm == "foo.net", Acct-Type := sql_log.foo # #DEFAULT Huntgroup-Name == "wifi", Acct-Type := sql_log.wifi # #DEFAULT Client-IP-Address == 10.0.0.1, Acct-Type := sql_log.other # #DEFAULT Acct-Status-Type == Start, Acct-Type := sql_log.start # Replace the User-Name with the Stripped-User-Name, if it exists. # DEFAULT User-Name := "%{Stripped-User-Name:-%{User-Name}}" root@debian:/etc/freeradius# Thanks in advance.

3 11