HI. I've been trying to fix this problem for weeks: The user "daniel" belongs to usergroup "wifi". In radgroupcheck I set the attribute Auth-Type := Accept for the group "wifi". When I try to connect from the terminal, server returns an Access-accept message, but however i can't still connect, screen of my device shows an eternal loop trying to connect but it doesn't do. I would preciate any help i can obtain from you. thanks. Freeradius server: rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=1, length=156 User-Name = "daniel" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "X.X.X.X.X" Calling-Station-Id = "X.X.X.X.X" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0203000b0164616e69656c Message-Authenticator = 0x3bf87f29f5f2af111857fd6706a12c92 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "daniel", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> daniel [sql] sql_set_user escaped user --> 'daniel' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'daniel' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'daniel' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'daniel' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'wifi' ORDER BY id [sql] User found in group wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop *Sending Access-Accept of id 1 to 10.25.4.250 port 44145* Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Service-Type := Framed-User Finished request 28. Going to the next request Waking up in 4.9 seconds. Cleaning up request 28 ID 1 with timestamp +673 Ready to process requests.
On Fri, Oct 30, 2015 at 04:38:18PM -0400, Daniel Lopez wrote:
The user "daniel" belongs to usergroup "wifi". In radgroupcheck I set the attribute Auth-Type := Accept for the group "wifi". When I try to connect from the terminal, server returns an Access-accept message, but however i can't still connect, screen of my device shows an eternal loop trying to connect but it doesn't do.
Configure the eap module properly for your situation. You can't just return an access-accept for eap; without the correct handshakes between the client and the RADIUS server it won't work, just like you've discovered. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, thanks for your response, I see i can't match Auth-type accept with EAP, i did it because when I set auth-type EAP server also returns error. My previous configuration was Auth-type := EAP My NAS is a tp-link n750 access point, I configure it WPA2 enterprise, AES encryption, GKUP = 30 So when I try to connect with this configuration I receive the following output: rad_recv: Access-Request packet from host 10.25.4.250 port 44145, id=9, length=206 User-Name = "daniel" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Called-Station-Id = "E8-DE-27-F7-83-A4:cdebiles.eti" Calling-Station-Id = "EC-0E-C4-12-81-3F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0209002b19001703010020e2655cfae9bba34897cb25ced3d5addeba14dd79244d067a52920706cecd672b State = 0xf9d08276fed99b298671c9ec938c6074 Message-Authenticator = 0x2a7334490eba3ac3d0321067d0fc8eef # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "daniel", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. *[peap] Peap state send tlv failure* *[peap] Received EAP-TLV response.* *[peap] The users session was previously rejected: returning reject (again.)* *[peap] *** This means you need to read the PREVIOUS messages in the debug output* *[peap] *** to find out the reason why the user was rejected.* *[peap] *** Look for "reject" or "fail". Those earlier messages will tell you.* *[peap] *** what went wrong, and how to fix the problem.* *[eap] Handler failed in EAP/peap* *[eap] Failed in EAP select* *++[eap] returns invalid* *Failed to authenticate the user*. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> daniel attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 9 to 10.25.4.250 port 44145 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. What i'm doing wrong? What i'm missing? Thanks again 2015-10-30 18:02 GMT-04:00 Matthew Newton <mcn4@leicester.ac.uk>:
On Fri, Oct 30, 2015 at 04:38:18PM -0400, Daniel Lopez wrote:
The user "daniel" belongs to usergroup "wifi". In radgroupcheck I set the attribute Auth-Type := Accept for the group "wifi". When I try to connect from the terminal, server returns an Access-accept message, but however i can't still connect, screen of my device shows an eternal loop trying to connect but it doesn't do.
Configure the eap module properly for your situation.
You can't just return an access-accept for eap; without the correct handshakes between the client and the RADIUS server it won't work, just like you've discovered.
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Nov 2, 2015, at 11:08 AM, Daniel Lopez <danilogo1991@gmail.com> wrote:
Hi Matthew, thanks for your response, I see i can't match Auth-type accept with EAP, i did it because when I set auth-type EAP server also returns error. My previous configuration was Auth-type := EAP
Delete that. It's wrong. It's always been wrong.
What i'm doing wrong? What i'm missing?
Start with the default configuration, and follow the guide at http://deployingradius.com It *will* work. Alan DeKok.
I founded where is the problem, it seems to be in radcheck table with Calling-Station-Id attribute, I want to check MAC address for clients so I set : Calling-Station-Id := XX-XX-XX-XX-XX-XX and I get the error, when I delete this row I can connect perfectly, I still need to authenticate users via MAC address so I would preciate any help. Thanks 2015-11-02 12:24 GMT-05:00 Alan DeKok <aland@deployingradius.com>:
On Nov 2, 2015, at 11:08 AM, Daniel Lopez <danilogo1991@gmail.com> wrote:
Hi Matthew, thanks for your response, I see i can't match Auth-type
accept
with EAP, i did it because when I set auth-type EAP server also returns error. My previous configuration was Auth-type := EAP
Delete that. It's wrong. It's always been wrong.
What i'm doing wrong? What i'm missing?
Start with the default configuration, and follow the guide at http://deployingradius.com
It *will* work.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mon, Nov 02, 2015 at 04:03:11PM -0500, Daniel Lopez wrote:
I founded where is the problem, it seems to be in radcheck table with Calling-Station-Id attribute, I want to check MAC address for clients so I set : Calling-Station-Id := XX-XX-XX-XX-XX-XX and I get the error, when I delete this row I can connect perfectly, I still need to authenticate users via MAC address so I would preciate any help. Thanks
man unlang := is assignment. You want == Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Sorry, my mistake was writing the mail I actually set Calling-Station-Id == XX-XX-XX-XX-XX-XX but did'n work 2015-11-02 17:59 GMT-05:00 Matthew Newton <mcn4@leicester.ac.uk>:
On Mon, Nov 02, 2015 at 04:03:11PM -0500, Daniel Lopez wrote:
I founded where is the problem, it seems to be in radcheck table with Calling-Station-Id attribute, I want to check MAC address for clients so I set : Calling-Station-Id := XX-XX-XX-XX-XX-XX and I get the error, when I delete this row I can connect perfectly, I still need to authenticate users via MAC address so I would preciate any help. Thanks
man unlang
:= is assignment.
You want ==
Matthew
-- Matthew Newton, Ph.D. <mcn4@le.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
What I'm doing wrong? What I'm missing?
You're not reading the debug log. Look: *[peap] *** This means you need to read the PREVIOUS messages in the debug output* The servery is telling you. Look back further in the output to find the reason/cause. Post ALL the event to this list for help not just the bits you feel like if you want help as otherwise is just guess work (eg does your client like the radius server cert) no need to set EAP as auth type...the server is clever enough to know that alan
participants (4)
-
Alan Buxey -
Alan DeKok -
Daniel Lopez -
Matthew Newton