EAP - TLS Free Radius Configuration question.
I have been trying to debug this configuration for quite some time and I think it's almost correct but I'm missing something and could really use your help. *****Versions:******* freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 mysql Ver 14.14 Distrib 5.5.46, for debian-linux-gnu (x86_64) using readline 6.3 Ubuntu 14.04 kernel 4.3 64 bit. ******freeradius -XXX******** Sun Jan 24 23:19:39 2016 : Info: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 44707, id=0, length=128 User-Name = "chillispot" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000f016368696c6c6973706f74 Message-Authenticator = 0xe86fc9d356c87144c7d115539c17172b Sun Jan 24 23:45:40 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/XXXXXXXX Sun Jan 24 23:45:40 2016 : Info: +- entering group authorize {...} Sun Jan 24 23:45:40 2016 : Info: ++[preprocess] returns ok Sun Jan 24 23:45:40 2016 : Info: [eap] EAP packet type response id 0 length 15 Sun Jan 24 23:45:40 2016 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Sun Jan 24 23:45:40 2016 : Info: ++[eap] returns updated Sun Jan 24 23:45:40 2016 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Sun Jan 24 23:45:40 2016 : Info: [sql] expand: -> Sun Jan 24 23:45:40 2016 : Error: [sql] Error generating query; rejecting user Sun Jan 24 23:45:40 2016 : Debug: rlm_sql (sql): Released sql socket id: 1 Sun Jan 24 23:45:40 2016 : Info: ++[sql] returns fail Sun Jan 24 23:45:40 2016 : Info: Using Post-Auth-Type Reject Sun Jan 24 23:45:40 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/XXXXXXX Sun Jan 24 23:45:40 2016 : Info: +- entering group REJECT {...} Sun Jan 24 23:45:40 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> chillispot Sun Jan 24 23:45:40 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sun Jan 24 23:45:40 2016 : Info: ++[attr_filter.access_reject] returns updated Sun Jan 24 23:45:40 2016 : Info: Delaying reject of request 7 for 1 seconds Sun Jan 24 23:45:40 2016 : Debug: Going to the next request Sun Jan 24 23:45:40 2016 : Debug: Waking up in 0.9 seconds. Sun Jan 24 23:45:41 2016 : Info: Sending delayed reject for request 7 Sending Access-Reject of id 0 to 127.0.0.1 port 44707 Sun Jan 24 23:45:41 2016 : Debug: Waking up in 4.9 seconds. Sun Jan 24 23:45:46 2016 : Info: Cleaning up request 7 ID 0 with timestamp +3210 Sun Jan 24 23:45:46 2016 : Info: Ready to process requests. ****** eapol response ********* root@XXXXXXX:/etc/freeradius/sites-available# eapol_test -c /etc/freeradius/eapol_test/eap-tls -a 127.0.0.1 -p 1812 -s testing123Reading configuration file '/etc/freeradius/eapol_test/eap-tls' Line: 7 - start of a new network block key_mgmt: 0x1 eap methods - hexdump(len=16): 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 identity - hexdump_ascii(len=10): **** HEX DUMPS REMOVED **** Authentication server 127.0.0.1:1812 RADIUS local address: 127.0.0.1:44707 ENGINE: Loading dynamic engine ENGINE: Loading dynamic engine EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: KEY_RX entering state NO_KEY_RECEIVE EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE Sending fake EAP-Request-Identity EAPOL: Received EAP-Packet frame EAPOL: SUPP_PAE entering state RESTART EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=0 method=1 vendor=0 vendorMethod=0 EAP: EAP entering state IDENTITY CTRL-EVENT-EAP-STARTED EAP authentication started EAP: Status notification: started (param=) EAP: EAP-Request Identity data - hexdump_ascii(len=0): EAP: using real identity - hexdump_ascii(len=10): 63 68 69 6c 6c 69 73 70 6f 74 chillispot EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp WPA: eapol_test_eapol_send(type=0 len=15) TX EAP -> RADIUS - hexdump(len=15): 02 00 00 0f 01 63 68 69 6c 6c 69 73 70 6f 74 Encapsulating EAP message into a RADIUS packet Learned identity from EAP-Response-Identity - hexdump(len=10): 63 68 69 6c 6c 69 73 70 6f 74 Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=0 length=128 Attribute 1 (User-Name) length=12 Value: 'chillispot' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '02-00-00-00-00-01' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=24 Value: 'CONNECT 11Mbps 802.11b' Attribute 79 (EAP-Message) length=17 Value: 0200000f016368696c6c6973706f74 Attribute 80 (Message-Authenticator) length=18 Value: e86fc9d356c87144c7d115539c17172b Next RADIUS client retransmit in 3 seconds EAPOL: SUPP_BE entering state RECEIVE Received 20 bytes from RADIUS server Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=0 length=20 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 1.00 sec Allowing RADIUS Access-Reject without Message-Authenticator since it does not include EAP-Message RADIUS packet matching with station could not extract EAP-Message from RADIUS message EAPOL: EAP key not available EAPOL: EAP Session-Id not available WPA: Clear old PMK and PTK MPPE keys OK: 0 mismatch: 1 FAILURE ***** eap-tls.conf ****** # eapol_test -c eap-tls.conf -s testing123 # # Set also "nostrip" in raddb/proxy.conf, realm "example.com" # And make it a LOCAL realm. # network={ key_mgmt=WPA-EAP eap=TLS identity="chillispot" ca_cert="etc/freeradius/certs/ca.pem" client_cert="etc/freeradius/certs/client.crt" private_key="etc/freeradius/certs/client.key" private_key_passwd="XXXXXXXXXXXXXXXXXX" } mysql, freeradius, and the eapol command were all run from within the same physical server box via ssh. When I expose the file option instead of sql it calls from the users file and it works fine. I have traced mysql and it does not seem to be generating any query. So my guess is this is getting stopped or discarded in the initial security checks before sql somewhere. I have tried this with every permutation I can think of including disabling firewalls. There is not much information I could find on the authenticator but my guess is the packet is not getting formatting correctly as a result of my configuration/setup, or there is something odd with the certs, or something similar and since I have restricted this down to only eap-tls it is causing the failure. If anybody wants the tshark output, just let me know what switches / or how you want it sent. It can get fairly verbose, and I was trying to keep the initial email to under the size of a novel. I am very thankful for your time and for any advice or help you can provide. Regards with thanks, Jeff.
1 - upgrade your freeradius. 2.1.12 is hideously old 2 - your sql is failing because the sql query is broken/empty You don't need to look at switches etc etc. If it works when users file is used then server/NAS communicating okay. Fix the sql alan
Hi Alan, That did the trick. I needed to wipe out openssl building from source too, rebuild all certs, and set a few basic configurations in the new root raddb directory but it all went really well. Sql went right in too. Thank you for your help. Regards with thanks, Jeff. On Mon, Jan 25, 2016 at 8:20 AM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
1 - upgrade your freeradius. 2.1.12 is hideously old
2 - your sql is failing because the sql query is broken/empty
You don't need to look at switches etc etc. If it works when users file is used then server/NAS communicating okay. Fix the sql
alan
Hi Alan, I spoke too soon about the sql part. As it turns out it did not go in at all. I was cruising through the tests and failed to notice the new output format. The real output is a line above the expected output. The inner-tunnel is ok, without sql enabled. I followed the instructions for configuring as well as enabling sql. A few trial and errors and managed to get what I hope is most of it enabled. I hit a wall. I get the following when running radiusd -xx -l stdout -f /usr/local/etc/raddb/mods-enabled/digest[12]: Failed to link to module 'rlm_digest': /usr/local/lib/rlm_digest.so: undefined symbol: debug_flag There is some chatter about this being a possible bug, also some chatter about recompiling freeradius with some extra flags but I figured I would ask the experts first. Thank you for your time and any assistance you can provide. Regards with thanks, Jeff. On Mon, Jan 25, 2016 at 1:55 PM, Jeff Ausfeld <jeffausfeld@gmail.com> wrote:
Hi Alan,
That did the trick. I needed to wipe out openssl building from source too, rebuild all certs, and set a few basic configurations in the new root raddb directory but it all went really well. Sql went right in too. Thank you for your help.
Regards with thanks, Jeff.
On Mon, Jan 25, 2016 at 8:20 AM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
1 - upgrade your freeradius. 2.1.12 is hideously old
2 - your sql is failing because the sql query is broken/empty
You don't need to look at switches etc etc. If it works when users file is used then server/NAS communicating okay. Fix the sql
alan
On Jan 25, 2016, at 7:11 PM, Jeff Ausfeld <jeffausfeld@gmail.com> wrote:
/usr/local/etc/raddb/mods-enabled/digest[12]: Failed to link to module 'rlm_digest': /usr/local/lib/rlm_digest.so: undefined symbol: debug_flag
You have two different versions of the server installed. Please remove the old one *completely*, including all old libraries, plugins, etc. Alan DeKok.
Hi Alan, I am amending the reply, as it does not paint the whole picture. Apparently all of the mods-enabled have the same problem. When I would remove one of the symlinks the next mod (not alphabetically) would show up in the same error. When I take sql out of the picture and go default, everything quiets down again. Regards with thanks, Jeff. On Mon, Jan 25, 2016 at 7:11 PM, Jeff Ausfeld <jeffausfeld@gmail.com> wrote:
Hi Alan,
I spoke too soon about the sql part. As it turns out it did not go in at all. I was cruising through the tests and failed to notice the new output format. The real output is a line above the expected output. The inner-tunnel is ok, without sql enabled.
I followed the instructions for configuring as well as enabling sql. A few trial and errors and managed to get what I hope is most of it enabled. I hit a wall.
I get the following when running
radiusd -xx -l stdout -f
/usr/local/etc/raddb/mods-enabled/digest[12]: Failed to link to module 'rlm_digest': /usr/local/lib/rlm_digest.so: undefined symbol: debug_flag
There is some chatter about this being a possible bug, also some chatter about recompiling freeradius with some extra flags but I figured I would ask the experts first.
Thank you for your time and any assistance you can provide.
Regards with thanks, Jeff.
On Mon, Jan 25, 2016 at 1:55 PM, Jeff Ausfeld <jeffausfeld@gmail.com> wrote:
Hi Alan,
That did the trick. I needed to wipe out openssl building from source too, rebuild all certs, and set a few basic configurations in the new root raddb directory but it all went really well. Sql went right in too. Thank you for your help.
Regards with thanks, Jeff.
On Mon, Jan 25, 2016 at 8:20 AM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
1 - upgrade your freeradius. 2.1.12 is hideously old
2 - your sql is failing because the sql query is broken/empty
You don't need to look at switches etc etc. If it works when users file is used then server/NAS communicating okay. Fix the sql
alan
participants (3)
-
Alan Buxey -
Alan DeKok -
Jeff Ausfeld