Server: Debian 6 (Squeeze) 2.6.32-5-amd64 FreeRadius: 2.1.10 (Debian package) Client: HP E-MSM460 AP (MSCHAPv2, Use message authenticator) Authentication methods for the MSM460 are: MSCHAPv2, MSCHAP, CHAP, EAP MD5 and PAP. I'm trying to set up a simple MAC-Auth based network using HP 2610 switches and MSM640 wireless APs as radius clients. I've added the AP to the clients.conf and configured the AP to use MAC-based authentication and it appears to be talking to FreeRadius using MSCHAPv2 correctly. We only have a few dozen clients, so I'm using the perl module to read and cache a text file of MAC addresses. My script watches the file's mtime and re-loads it as necessary. I've followed the instructions on http://wiki.freeradius.org/Rlm_perl, but I get the following error: /etc/freeradius/users[204]: Parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type After some trial and error, I found that adding perl to the authorize and authenticate sections of sites-available/inner-tunnel would get rid of the error, but I have no idea if that solved the problem or merely masked it and caused he next one. There appears to be something seriously wrong with the way this config is working, because rlm_perl is calling the AUTHORIZE function but not AUTHENTICATE. I've pasted the debug of an authentication attempt below. It appears to be taking the CLIENT mschap authentication and somehow applying those attributes to mangle USER authentication. rad_recv: Access-Request packet from host 192.168.0.29 port 35063, id=48, length =275 Acct-Session-Id = "1ca83cd8-00013b2c" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 User-Name = "984b4af5bf40" Calling-Station-Id = "98:4b:4a:f5:bf:40" Called-Station-Id = "2c:41:38:f4:f5:c0" Service-Type = Login-User MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc6800000000000000 00fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba Colubris-AVPair = "ssid=TSV-UC" Colubris-AVPair = "phytype=IEEE802dot11n" Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "984b4af5bf40", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 204 ++[files] returns ok rlm_perl: AUTHORIZE rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11 rlm_perl: RAD_REQUEST: Acct-Session-Id = 1ca83cd8-00013b2c rlm_perl: RAD_REQUEST: Service-Type = Login-User rlm_perl: RAD_REQUEST: Called-Station-Id = 2c:41:38:f4:f5:c0 rlm_perl: RAD_REQUEST: Calling-Station-Id = 98:4b:4a:f5:bf:40 rlm_perl: RAD_REQUEST: Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e rlm_perl: RAD_REQUEST: MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 rlm_perl: RAD_REQUEST: User-Name = 984b4af5bf40 rlm_perl: RAD_REQUEST: NAS-Identifier = CN18D332BD rlm_perl: RAD_REQUEST: MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc680000000000000000fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba rlm_perl: RAD_REQUEST: Colubris-AVPair = ARRAY(0x127d4d8) rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.0.29 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Acct-Session-Id = 1ca83cd8-00013b2c rlm_perl: Added pair Service-Type = Login-User rlm_perl: Added pair Called-Station-Id = 2c:41:38:f4:f5:c0 rlm_perl: Added pair Calling-Station-Id = 98:4b:4a:f5:bf:40 rlm_perl: Added pair Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e rlm_perl: Added pair MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 rlm_perl: Added pair User-Name = 984b4af5bf40 rlm_perl: Added pair NAS-Identifier = CN18D332BD rlm_perl: Added pair MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc680000000000000000fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba rlm_perl: Added pair Colubris-AVPair = ssid=TSV-UC rlm_perl: Added pair Colubris-AVPair = phytype=IEEE802dot11n rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 192.168.0.29 rlm_perl: Added pair Auth-Type = MSCHAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: 984b4af5bf40 [mschap] Told to do MS-CHAPv2 for 984b4af5bf40 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 984b4af5bf40 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 48 to 192.168.0.29 port 35063 Regards, Glen.
On 03/26/2012 10:01 AM, Glen Harris wrote:
Server: Debian 6 (Squeeze) 2.6.32-5-amd64 FreeRadius: 2.1.10 (Debian package) Client: HP E-MSM460 AP (MSCHAPv2, Use message authenticator) Authentication methods for the MSM460 are: MSCHAPv2, MSCHAP, CHAP, EAP MD5 and PAP.
I'm trying to set up a simple MAC-Auth based network using HP 2610 switches and MSM640 wireless APs as radius clients. I've added the AP to
This is a matter of choice, but personally I would advise against using MAC-auth on wireless. It provides illusory security, and 802.1x is pretty easy on modern equipment. You call however.
the clients.conf and configured the AP to use MAC-based authentication and it appears to be talking to FreeRadius using MSCHAPv2 correctly.
Well, see below for more on this; IMO it's not "correct" to use MSCHAPv2 for mac-auth. It's a hack, presumably created for people with dumb radius servers that assume ever authentication is tied to something with a username/password.
We only have a few dozen clients, so I'm using the perl module to read and cache a text file of MAC addresses. My script watches the file's mtime and re-loads it as necessary. I've followed the instructions on http://wiki.freeradius.org/Rlm_perl, but I get the following error:
/etc/freeradius/users[204]: Parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type
Why are you trying to set Auth-Type to "Perl"? Since the requests are MSCHAP, unless you've written a full MSCHAP implementation in Perl, you won't be able to authenticate them. If you just want to whitelist MACs, run perl in "authorize".
After some trial and error, I found that adding perl to the authorize and authenticate sections of sites-available/inner-tunnel would get rid of the error, but I have no idea if that solved the problem or merely masked it and caused he next one.
There appears to be something seriously wrong with the way this config is working, because rlm_perl is calling the AUTHORIZE function but not AUTHENTICATE. I've pasted the debug of an authentication attempt below. It appears to be taking the CLIENT mschap authentication and somehow applying those attributes to mangle USER authentication.
I don't understand this paragraph. What do you mean by "client mschap authentication" and "mangle user authentication". In any event - the "problems" are all spelt out in the debug if you read carefully:
rad_recv: Access-Request packet from host 192.168.0.29 port 35063, id=48, length =275 Acct-Session-Id = "1ca83cd8-00013b2c" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 User-Name = "984b4af5bf40" Calling-Station-Id = "98:4b:4a:f5:bf:40" Called-Station-Id = "2c:41:38:f4:f5:c0" Service-Type = Login-User MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc6800000000000000 00fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba Colubris-AVPair = "ssid=TSV-UC" Colubris-AVPair = "phytype=IEEE802dot11n" Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e
The above is an MSCHAP request. However, the username appears to be a MAC address, so maybe the NAS is trying to do MSCHAP "mac auth". Sigh.
# Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'
The "mschap" module sets Auth-Type to itself, correctly.
++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "984b4af5bf40", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 204 <snip>
++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP
Auth-Type is still MSCHAP
# Executing group from file /etc/freeradius/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password.
No password is set, therefore auth is going to fail...
[mschap] Creating challenge hash with username: 984b4af5bf40 [mschap] Told to do MS-CHAPv2 for 984b4af5bf40 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject
...and auth fails. I am going to take a wild guess, that your NAS does MAC-auth via an mschap request. I am going to guess the password it uses is either the same as the username, or a fixed value. You could try adding lines like this to the "users" file: 984b4af5bf40 Cleartext-Password := "984b4af5bf40" Or, if your NAS can be made to do so, disable the dumb "lets do MAC-auth by simulating mschap so that Microsoft IAS/NPS users can play too" mode. Then, MAC-auth requests will come in as PAP, and you can just set "Auth-Type = Accept" after you've performed the "known good" MAC address check. Your "perl" module is running OK in "authorize", so any checks you can do, you can do there.
Changed subject line to reflect new topic. I've taken your advice and asked for the project requirements to be modified. We'll just have to deal with incompatible devices (and their users) on an ad-hoc basis - and maybe give some people an reason to upgrade. ;-) I'm now using a bog standard freeradius install with SQL enabled and talking to a mysql database. It worked perfectly out of the box with the MSM460 set to use WPA2 and AES. I still need to provide MAC address restriction on a per-user basis. Yes, I know it's fairly easy these days to spoof the MAC address, but that will be a deliberate act by a user. It is not being used as a technical security measure but as an indication of intent that will have consequences. mysql> select * from radcheck; +----+----------+--------------------+----+-------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+-------------------+ | 1 | user01 | Cleartext-Password | := | pass01 | | 2 | user01 | Calling-Station-Id | == | 98-4B-4A-F5-BF-40 | +----+----------+--------------------+----+-------------------+ With just a username and password in the table, I can authenticate from my device. I see the crypto handshaking, the sql module returns ok for the user and the password is verified. When I add the second row in the table, the auth fails. Tracing backwards, peap reports "Peap state send tlv failure", caused by mschap reporting "No Cleartext-Password configured", caused by rlm_sql reporting "User user01 not found". Replaying the SQL query from the debug manually: mysql> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user01' ORDER BY id; +----+----------+--------------------+-------------------+----+ | id | username | attribute | value | op | +----+----------+--------------------+-------------------+----+ | 1 | user01 | Cleartext-Password | pass01 | := | | 2 | user01 | Calling-Station-Id | 98-4B-4A-F5-BF-40 | == | +----+----------+--------------------+-------------------+----+ So, there's something wrong with how I'm doing my check items - they're not matching and the Cleartext-Password attribute is not being set. I've read the SQL_HOWTO and Operators docs on the website and come up with this myself. I copied and pasted the attribute and value from the debug output directly: Calling-Station-Id = "98-4B-4A-F5-BF-40" I can simply change the username of row 2 to another string (eg "foo") and my device will authenticate again. Change it back and it won't. Many thanks, glen. On 26/03/12 19:10, Phil Mayers wrote:
On 03/26/2012 10:01 AM, Glen Harris wrote:
Server: Debian 6 (Squeeze) 2.6.32-5-amd64 FreeRadius: 2.1.10 (Debian package) Client: HP E-MSM460 AP (MSCHAPv2, Use message authenticator) Authentication methods for the MSM460 are: MSCHAPv2, MSCHAP, CHAP, EAP MD5 and PAP.
I'm trying to set up a simple MAC-Auth based network using HP 2610 switches and MSM640 wireless APs as radius clients. I've added the AP to
This is a matter of choice, but personally I would advise against using MAC-auth on wireless. It provides illusory security, and 802.1x is pretty easy on modern equipment. You call however.
On Wed, Apr 4, 2012 at 4:01 PM, Glen Harris <astfgl@iamnota.org> wrote:
Replaying the SQL query from the debug manually:
mysql> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user01' ORDER BY id; +----+----------+--------------------+-------------------+----+ | id | username | attribute | value | op | +----+----------+--------------------+-------------------+----+ | 1 | user01 | Cleartext-Password | pass01 | := | | 2 | user01 | Calling-Station-Id | 98-4B-4A-F5-BF-40 | == | +----+----------+--------------------+-------------------+----+
So, there's something wrong with how I'm doing my check items - they're not matching and the Cleartext-Password attribute is not being set.
If it doesn't find Calling-Station-Id with value '98-4B-4A-F5-BF-40' in the request, the cleartext-password won't be set. Can you paste the debug log? I'm guessing that the request to the inner tunnel probably don't have Calling-Station-Id attribute. -- Fajar
On 04/04/12 11:21, Fajar A. Nugraha wrote:
On Wed, Apr 4, 2012 at 4:01 PM, Glen Harris<astfgl@iamnota.org> wrote:
Replaying the SQL query from the debug manually:
mysql> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user01' ORDER BY id; +----+----------+--------------------+-------------------+----+ | id | username | attribute | value | op | +----+----------+--------------------+-------------------+----+ | 1 | user01 | Cleartext-Password | pass01 | := | | 2 | user01 | Calling-Station-Id | 98-4B-4A-F5-BF-40 | == | +----+----------+--------------------+-------------------+----+
So, there's something wrong with how I'm doing my check items - they're not matching and the Cleartext-Password attribute is not being set. If it doesn't find Calling-Station-Id with value '98-4B-4A-F5-BF-40' in the request, the cleartext-password won't be set.
Can you paste the debug log? I'm guessing that the request to the inner tunnel probably don't have Calling-Station-Id attribute.
Here it is: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Nov 14 2010 at 21:12:30 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /usr/local/etc/freeradius-clients.txt including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.10 { require_message_authenticator = no secret = "SANITIZED" shortname = "sw-unclass-a" } client 192.168.0.11 { require_message_authenticator = no secret = "SANITIZED" shortname = "sw-unclass-b" } client 192.168.0.12 { require_message_authenticator = no secret = "SANITIZED" shortname = "sw-tsv-unc-a" } client 192.168.0.29 { require_message_authenticator = no secret = "SANITIZED" shortname = "ap-j" } client 192.168.0.250 { require_message_authenticator = no secret = "SANITIZED" shortname = "tplink" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radiusd" password = "ap4r" radius_db = "FreeRadius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radiusd@localhost:/FreeRadius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.29 port 35128, id=130, length=307 Acct-Multi-Session-Id = "2C-41-38-F4-F5-C0-98-4B-4A-F5-BF-40-4F-7B-77-63-00-01-0B-E8" Acct-Session-Id = "0ff777b7-00000010" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 Framed-MTU = 1496 User-Name = "user01" Calling-Station-Id = "98-4B-4A-F5-BF-40" Called-Station-Id = "2C-41-38-F4-F5-C0" Service-Type = Framed-User EAP-Message = 0x0202000b01757365723031 Colubris-AVPair = "ssid=TSV-UC-TEST" Colubris-AVPair = "vsc-unique-id=1" Colubris-AVPair = "phytype=IEEE802dot11 " Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x0eef665177a64c3c83710d0d5454e1d5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 130 to 192.168.0.29 port 35128 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0a17f1a40a14e880e2cbb206f9f6828d Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.29 port 35128, id=136, length=514 Acct-Multi-Session-Id = "2C-41-38-F4-F5-C0-98-4B-4A-F5-BF-40-4F-7B-77-63-00-01-0B-E8" Acct-Session-Id = "0ff777b7-00000010" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 Framed-MTU = 1496 User-Name = "user01" Calling-Station-Id = "98-4B-4A-F5-BF-40" Called-Station-Id = "2C-41-38-F4-F5-C0" Service-Type = Framed-User EAP-Message = 0x020300c81980000000be16030100b9010000b503014f7b77612146ddbbd1de2b667480c14b4caf083dcd2a2df3a3ae34fd45847ac3000048c014c00a00390038c00fc0050035c012c00800160013c00dc003000ac013c00900330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000044000b000403000102000a00340032000100020003000400050006000700080009000a000b000c000d000e000f001000110012001300140015001600170018001900230000 State = 0x0a17f1a40a14e880e2cbb206f9f6828d Colubris-AVPair = "ssid=TSV-UC-TEST" Colubris-AVPair = "vsc-unique-id=1" Colubris-AVPair = "phytype=IEEE802dot11 " Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x8d020c6210b5001bf97537ce33011cea # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 200 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 190 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 00b9], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 02d6], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 136 to 192.168.0.29 port 35128 EAP-Message = 0x0104040019c00000052c16030100310200002d03014f7b7763f4a1a48ae76e31db7beceef53698b2b17e867813d824f041a23edbef000039000005ff0100010016030102d60b0002d20002cf0002cc308202c8308201b0020900ef8da76680d1e58d300d06092a864886f70d01010505003026312430220603550403131b6d6f6e69746f72696e672e75632e6762726d70612e676f762e6175301e170d3132303331383232333634315a170d3232303331363232333634315a3026312430220603550403131b6d6f6e69746f72696e672e75632e6762726d70612e676f762e617530820122300d06092a864886f70d01010105000382010f003082010a EAP-Message = 0x028201010099b5753e289071ff65d8be4d09269e464f565931841a0e65dfa99c3a0a31876e946535c38eee0b296892dae8afbe5ddc82977201a7b46a1d02ad0f5c45cb73952be25957a793e99215097b7d0bfb251e00eddf418e40f3b275c03825f6007201a354b09b6e001e332c5ba7ba9eb89f2567e235bd35de267ef685869e1ded9dad07f1ccf40571039a7089c5add9a9f0e3b570205709356afaece180e72d696cefedfd535c66f4f8fb8c63cda4f3d3c472d9fe9623ef7025df96e3a4435c25e80f336f766027cc5e15eaf9cffcd34ed3b6c43907a3b7d4ba0467bf952f1ab04fc81975d073413e8db05026f0be0c82b794fa52c8d56de44508 EAP-Message = 0xa25a964a952986930203010001300d06092a864886f70d01010505000382010100366fe69eb4fec4c541987a132be3d69ae8a92da6e5059792ee5cf92a972fcb828832154792632617f409260a2ea1d2734b1e8e9ae1f0f195bdd8ea68ba5a6cf490324a59bdfa593519f68e70c84d55ab6a4c4bb1bac4174eea795b4094cfd5f807eb76b30997c253bd7d2576bd87888799b9c63d22253dc9cf8e860bd9f19b00aeddb5e8c015ee257fe5071959e262a1efcdaefeb6b2ede8a8c2613344f47654f6647a6c5743b5cf6574bacda621b029f760781a2048daaae4579d8102c0b73598f7119c9232e63ac74b1b9701de3a408fc55a8021173b807498589b EAP-Message = 0x928677bb583320909318d7bcfbca1c303530614c8d9768bfd03743824817af1c75e7bfb0160301020d0c0002090080df8c974544fae5ba7197906f609271237251d7ed083b96c782ca023faefb0b2762bf9e182d3ea07643c38571ed1847568eaffae228435e0d00f8c664324616400d6cbf78004444ab47d5d132a2c466698c389c6a9aae99b6a92356f1d6e2a7b33cbd6a0de0b15e1bbe5def485d00c59adddfbeeaf2e692fc3877a49e8fcd2a530001020080de1f11827e89724c5b62ad98a8f4dc56cd6edf77320380088a3ef76fa2e0daa7cbf64bd3f073b8c25246ab86ad67212d6ad6642190f69659af543538f1358ec21287d2613e1c36e868 EAP-Message = 0x8f36c8721909ed56c412841c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0a17f1a40b13e880e2cbb206f9f6828d Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.29 port 35128, id=23, length=320 Acct-Multi-Session-Id = "2C-41-38-F4-F5-C0-98-4B-4A-F5-BF-40-4F-7B-77-63-00-01-0B-E8" Acct-Session-Id = "0ff777b7-00000010" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 Framed-MTU = 1496 User-Name = "user01" Calling-Station-Id = "98-4B-4A-F5-BF-40" Called-Station-Id = "2C-41-38-F4-F5-C0" Service-Type = Framed-User EAP-Message = 0x020400061900 State = 0x0a17f1a40b13e880e2cbb206f9f6828d Colubris-AVPair = "ssid=TSV-UC-TEST" Colubris-AVPair = "vsc-unique-id=1" Colubris-AVPair = "phytype=IEEE802dot11 " Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0xaa6acc68f2872978c06efbf41aad086a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 23 to 192.168.0.29 port 35128 EAP-Message = 0x0105013c19006e84ed7024e1bcd1cb1cebe248d3d70f0dd2defeadef53409c9b3477812975a6958a1779d85f123b7b56c701001aea5e9438f0c6dc60a6ac54426df5a6d53f562e1acf5e7b27a6eb895f58c76f5812ac3e163e54f8e84ee3a94bffe4a2e136ecd2ba970e6f833d705979a8c6c29235f35507e96bcea8e0307b68ac3a99a3095ffc9f14bee2d65d02b1b833e5ad09123d2d1beab4f3e9dc930ceaa957a808083d103ef273ffc50f9910596f994f2349cfa682b738b4b860500a09b490b1ad2c98642d0a2ecae6c6c56afecbc61540f2d5f3223edd458236f004fcf3e7382fabb23fde103fd0e77eae4df3e82fffcc74f4145b836306f93b EAP-Message = 0x44ebfebdcdbec2148de756666aec75474c92aa2c711e929178451beda3ca6403a93ba4607d3b5c38679668c46d7c02dbafd45dbde16c16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0a17f1a40812e880e2cbb206f9f6828d Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.29 port 35128, id=157, length=522 Acct-Multi-Session-Id = "2C-41-38-F4-F5-C0-98-4B-4A-F5-BF-40-4F-7B-77-63-00-01-0B-E8" Acct-Session-Id = "0ff777b7-00000010" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 Framed-MTU = 1496 User-Name = "user01" Calling-Station-Id = "98-4B-4A-F5-BF-40" Called-Station-Id = "2C-41-38-F4-F5-C0" Service-Type = Framed-User EAP-Message = 0x020500d01980000000c616030100861000008200804d781e88b2db37ce491d1a54a2b2bfd3f78a0c3e25e24055b130ff42096fa512efc38ba218699f51745cc0a366765ada09e36ed01a317b58f2ceb4ea164cf075609bf57e7aeb360ccc6094d882d9efe99526f24e57882526a17306f0811ce40a525e83e0a6c8b9969aefa34bfe37cd78811406d6519eb5bc4ad61cd2d047709514030100010116030100300e501c963e0dd296fb26968363ac52cac83c0bae5f7f1f4fd0911e2ecc7869e5fa69babb42ea06f9797642f320adb1f1 State = 0x0a17f1a40812e880e2cbb206f9f6828d Colubris-AVPair = "ssid=TSV-UC-TEST" Colubris-AVPair = "vsc-unique-id=1" Colubris-AVPair = "phytype=IEEE802dot11 " Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x612249344222bf5bec391ae5bc857d5c # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 157 to 192.168.0.29 port 35128 EAP-Message = 0x0106004119001403010001011603010030e761b4dffa138d5f36d2cf60cd2adf126975ceadcb413a818a1bf2e91938d987e44d14dd08e0c13fadcf62cc4e263e1e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0a17f1a40911e880e2cbb206f9f6828d Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.29 port 35128, id=177, length=320 Acct-Multi-Session-Id = "2C-41-38-F4-F5-C0-98-4B-4A-F5-BF-40-4F-7B-77-63-00-01-0B-E8" Acct-Session-Id = "0ff777b7-00000010" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 Framed-MTU = 1496 User-Name = "user01" Calling-Station-Id = "98-4B-4A-F5-BF-40" Called-Station-Id = "2C-41-38-F4-F5-C0" Service-Type = Framed-User EAP-Message = 0x020600061900 State = 0x0a17f1a40911e880e2cbb206f9f6828d Colubris-AVPair = "ssid=TSV-UC-TEST" Colubris-AVPair = "vsc-unique-id=1" Colubris-AVPair = "phytype=IEEE802dot11 " Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x990f278a3fa747defc70367e70d41e61 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 177 to 192.168.0.29 port 35128 EAP-Message = 0x0107002b1900170301002052c82190ff70ac8a9ca7231a66fffa3ad5b1fba71246b7d4c955a36dc1f50dc1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0a17f1a40e10e880e2cbb206f9f6828d Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.29 port 35128, id=107, length=394 Acct-Multi-Session-Id = "2C-41-38-F4-F5-C0-98-4B-4A-F5-BF-40-4F-7B-77-63-00-01-0B-E8" Acct-Session-Id = "0ff777b7-00000010" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 Framed-MTU = 1496 User-Name = "user01" Calling-Station-Id = "98-4B-4A-F5-BF-40" Called-Station-Id = "2C-41-38-F4-F5-C0" Service-Type = Framed-User EAP-Message = 0x0207005019001703010020853054e59535b41735e1bc9e1c102b1b3a7527ddcc82ba9b7022b735354d8d77170301002071f8d8fbb33355fbdfe3b8469a610ff9b88f0bd8e0e6153e5dd575a8aa161f64 State = 0x0a17f1a40e10e880e2cbb206f9f6828d Colubris-AVPair = "ssid=TSV-UC-TEST" Colubris-AVPair = "vsc-unique-id=1" Colubris-AVPair = "phytype=IEEE802dot11 " Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x8891696c4972452ab6dc03aba97e449f # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - user01 [peap] Got inner identity 'user01' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0207000b01757365723031 server { PEAP: Setting User-Name to user01 Sending tunneled request EAP-Message = 0x0207000b01757365723031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user01" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> user01 [sql] sql_set_user escaped user --> 'user01' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user01' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user01' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User user01 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800201a0108001b10c69cb6de790f1bcb7778785882eddddc757365723031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0911e3ea0919f981bd157231c23b3342 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800201a0108001b10c69cb6de790f1bcb7778785882eddddc757365723031 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0911e3ea0919f981bd157231c23b3342 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 107 to 192.168.0.29 port 35128 EAP-Message = 0x0108004b1900170301004031b231f886bf5c0794923bf0b33a81d967ae7d1f9fdca182a5cd8a559bb80a6c6a32ac4c0b441f82adb6292511f0bb452886d529d4808c2bade87e91aed623da Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0a17f1a40f1fe880e2cbb206f9f6828d Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.29 port 35128, id=169, length=458 Acct-Multi-Session-Id = "2C-41-38-F4-F5-C0-98-4B-4A-F5-BF-40-4F-7B-77-63-00-01-0B-E8" Acct-Session-Id = "0ff777b7-00000010" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 Framed-MTU = 1496 User-Name = "user01" Calling-Station-Id = "98-4B-4A-F5-BF-40" Called-Station-Id = "2C-41-38-F4-F5-C0" Service-Type = Framed-User EAP-Message = 0x02080090190017030100209a91ffc5db877129276b9186a8a98eddcf29886c84629d93808c21f30bfc03a61703010060030ad56a6259e5f91b9a8da8705fb25981ca3073f44c609816bda9a4825691b6ed357005e2510cd89a446377dabf669d3598fa12a066ea2c38bb20122fa632d4866e171bb3ea42cb43f2eff4359458765c196e60adc4181613805dd50edbcd70 State = 0x0a17f1a40f1fe880e2cbb206f9f6828d Colubris-AVPair = "ssid=TSV-UC-TEST" Colubris-AVPair = "vsc-unique-id=1" Colubris-AVPair = "phytype=IEEE802dot11 " Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x54c0b38b1fd056fff9da4772a51c2eff # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800411a0208003c31410d32098bebd01469debab3a1c0cdb1000000000000000090c59003c3cc3e46d5954d175eb495d1d31d03ffaba797b200757365723031 server { PEAP: Setting User-Name to user01 Sending tunneled request EAP-Message = 0x020800411a0208003c31410d32098bebd01469debab3a1c0cdb1000000000000000090c59003c3cc3e46d5954d175eb495d1d31d03ffaba797b200757365723031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "user01" State = 0x0911e3ea0919f981bd157231c23b3342 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 65 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> user01 [sql] sql_set_user escaped user --> 'user01' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user01' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user01' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User user01 not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: user01 [mschap] Told to do MS-CHAPv2 for user01 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled Sending Access-Challenge of id 169 to 192.168.0.29 port 35128 EAP-Message = 0x0109002b1900170301002031a8037cff2939b1d0e01b6efd2a8f50ef63e24ad52a13dd383d7087c52b4ef6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0a17f1a40c1ee880e2cbb206f9f6828d Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.29 port 35128, id=9, length=394 Acct-Multi-Session-Id = "2C-41-38-F4-F5-C0-98-4B-4A-F5-BF-40-4F-7B-77-63-00-01-0B-E8" Acct-Session-Id = "0ff777b7-00000010" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 Framed-MTU = 1496 User-Name = "user01" Calling-Station-Id = "98-4B-4A-F5-BF-40" Called-Station-Id = "2C-41-38-F4-F5-C0" Service-Type = Framed-User EAP-Message = 0x020900501900170301002066cc7f86447ddf15db8aa3e3ccde9da8d23dae24c2378eae039b6606ae021f281703010020af0b814f7dd662e7e6a9c66a1427dd31af254d21c29be54c90a789aadd81e0c5 State = 0x0a17f1a40c1ee880e2cbb206f9f6828d Colubris-AVPair = "ssid=TSV-UC-TEST" Colubris-AVPair = "vsc-unique-id=1" Colubris-AVPair = "phytype=IEEE802dot11 " Colubris-Attr-250 = 0x00000000 Colubris-Attr-249 = 0x00000000 Message-Authenticator = 0x2c9d9b7ab12ea8d2d5f57c26ec2d6902 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user01", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [sql] expand: %{User-Name} -> user01 [sql] sql_set_user escaped user --> 'user01' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user01', '', 'Access-Reject', '2012-04-04 08:19:15') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'user01', '', 'Access-Reject', '2012-04-04 08:19:15') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> user01 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 7 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 7 Sending Access-Reject of id 9 to 192.168.0.29 port 35128 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. Cleaning up request 0 ID 130 with timestamp +119 Cleaning up request 1 ID 136 with timestamp +119 Cleaning up request 2 ID 23 with timestamp +119 Cleaning up request 3 ID 157 with timestamp +119 Cleaning up request 4 ID 177 with timestamp +119 Cleaning up request 5 ID 107 with timestamp +119 Cleaning up request 6 ID 169 with timestamp +119 Waking up in 1.0 seconds. Cleaning up request 7 ID 9 with timestamp +119 Ready to process requests. Regards, glen.
Glen Harris wrote:
Can you paste the debug log? I'm guessing that the request to the inner tunnel probably don't have Calling-Station-Id attribute.
Here it is:
Did you read it? There's a lot of stuff, but it's pretty obvious what's going on:
[sql] expand: %{User-Name} -> user01 [sql] sql_set_user escaped user --> 'user01' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user01' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user01' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User user01 not found ++[sql] returns notfound
What does that look like? Alan DeKok.
On 04/04/12 18:00, Alan DeKok wrote:
Glen Harris wrote:
Can you paste the debug log? I'm guessing that the request to the inner tunnel probably don't have Calling-Station-Id attribute.
Here it is: Did you read it? There's a lot of stuff, but it's pretty obvious what's going on:
[sql] expand: %{User-Name} -> user01 [sql] sql_set_user escaped user --> 'user01' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user01' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user01' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User user01 not found ++[sql] returns notfound What does that look like?
It looks like the user 'user01' does not exist in the database, or possibly that rows for the username 'user01' do exist but my Calling-Station-Id check item is wrong and the user is not being matched because of that. OK, from what Fajar has said, make that probably. There are two rows in the radcheck table with that username (Cleartext-Password and Calling-Station-Id), and both are being returned when I replay the above SQL manually from the msql client. rlm_sql handles the evaluation of check item conditions. In that case, a failure of the Calling-Station-Id match would result in the user not being found. There's no details from rlm_sql in the debug to show the evaluation of the check items, but I assume that it has access to Calling-Station-Id to do the comparison. Big assumption, but it's there as an attribute both earlier and later in the debug log. Is there a way to see what values are being comparing inside the module? I had assumed that this example: user01 Cleartext-Password := pass01, Calling-Station-Id == "98-4B-4A-F5-BF-40" would translate to the radcheck table as: +----+----------+--------------------+-------------------+----+ | id | username | attribute | value | op | +----+----------+--------------------+-------------------+----+ | 1 | user01 | Cleartext-Password | pass01 | := | | 2 | user01 | Calling-Station-Id | 98-4B-4A-F5-BF-40 | == | +----+----------+--------------------+-------------------+----+ I'm sorry, I know I'm being a pain, but I honestly can't see where I'm going wrong. Fajar has suggested that I use radclient to do my testing as well as some other ideas. I'm in Australia, so it's well after work now but I'll try first thing tomorrow morning. I'll also try with the users file, again I should have validated my check item syntax with that first. Regards, glen.
Hi,
mysql> select * from radcheck; +----+----------+--------------------+----+-------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+-------------------+ | 1 | user01 | Cleartext-Password | := | pass01 | | 2 | user01 | Calling-Station-Id | == | 98-4B-4A-F5-BF-40 | +----+----------+--------------------+----+-------------------+
okay
mysql> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user01' ORDER BY id; +----+----------+--------------------+-------------------+----+ | id | username | attribute | value | op | +----+----------+--------------------+-------------------+----+ | 1 | user01 | Cleartext-Password | pass01 | := | | 2 | user01 | Calling-Station-Id | 98-4B-4A-F5-BF-40 | == | +----+----------+--------------------+-------------------+----+
yep. okay. but if you look at your debug output: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user01' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User user01 not found so, there is no user01 in the radusergroup SQL table. so it fails. so if you dont need the sqlusergroup, turn it off. alan
On Wed, Apr 4, 2012 at 3:27 PM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:
so, there is no user01 in the radusergroup SQL table. so it fails. so if you dont need the sqlusergroup, turn it off.
Shouldn't it work even without radusergroup? @Glen, can you try testing with simple PAP? This is to isolate EAP-related problem. You probably need to use radclient to manually add Calling-Station-Id attribute to the request. Look at the end of "radtest" program (which is a shell script) to see an example how to use radclient. -- Fajar
On 04/04/12 18:34, Fajar A. Nugraha wrote:
@Glen, can you try testing with simple PAP? This is to isolate EAP-related problem.
You probably need to use radclient to manually add Calling-Station-Id attribute to the request. Look at the end of "radtest" program (which is a shell script) to see an example how to use radclient.
I've just tried with radclient: echo "User-Name = user01, Password = pass01, Calling-Station-Id = 98-4B-4A-F5-BF-40" | radclient -s localhost:1812 auth testing123 successfully authenticates the user using rlm_sql and pap. Changing the MAC to a different value fails the SQL query and authentication as expected. Going back to the access point, I can now understand that the failure is happening inside the inner-tunnel virtual server. First the authorize section is called which does the SQL query but can't match the user, then the authenticate section which fails because there's no password set. 5 minutes of googling later I found a pointer to copy_request_to_tunnel in the peap section of eap.conf and my client devices started authenticating. Many thanks to everyone who helped. Regards, glen.
On 04/04/12 18:27, Alan Buxey wrote:
Hi,
mysql> select * from radcheck; +----+----------+--------------------+----+-------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+-------------------+ | 1 | user01 | Cleartext-Password | := | pass01 | | 2 | user01 | Calling-Station-Id | == | 98-4B-4A-F5-BF-40 | +----+----------+--------------------+----+-------------------+
okay
mysql> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user01' ORDER BY id; +----+----------+--------------------+-------------------+----+ | id | username | attribute | value | op | +----+----------+--------------------+-------------------+----+ | 1 | user01 | Cleartext-Password | pass01 | := | | 2 | user01 | Calling-Station-Id | 98-4B-4A-F5-BF-40 | == | +----+----------+--------------------+-------------------+----+ yep. okay.
but if you look at your debug output:
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user01' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User user01 not found
so, there is no user01 in the radusergroup SQL table. so it fails. so if you dont need the sqlusergroup, turn it off.
Thanks for the explanation. Just so I understand completely, why does authentication work when there is only the Cleartext-Password row in the radcheck table? Does the radusergroup query somehow come into play when there's a second check item? Nothing else changes, radusergroup is being queried and returning no results in both cases. Regards, glen.
On Wed, Apr 4, 2012 at 3:41 PM, Glen Harris <astfgl@iamnota.org> wrote:
Just so I understand completely, why does authentication work when there is only the Cleartext-Password row in the radcheck table?
If the condition in "==" doesn't match, the check item with ":=" (i.e. cleartext-password) will not be returned.
Does the radusergroup query somehow come into play when there's a second check item?
It shouldn't, Which is why I suggested you try with simple PAP. I've used "==" for Calling-Station-Id for several years with PAP + MSCHAP, but admittedly never tried it with EAP, so I'd like to isolate the problem first. Recently I changed it to ":=" plus some unlang block that does the actual comparison/rejection, to make debugging easier. That is, now I can put "incorrect calling-station-id" in my logs rather than a generic "user not found" message. You can also try this method later if you want. -- Fajar
participants (5)
-
Alan Buxey -
Alan DeKok -
Fajar A. Nugraha -
Glen Harris -
Phil Mayers