Sorry Alan, I don't know! How do I find out? The clients are Cisco wireless controllers. On Sat, Jul 25, 2015 at 4:29 PM, Alan DeKok <aland@deployingradius.com> wrote:

On Jul 25, 2015, at 1:03 PM, Mohamed Lrhazi <Mohamed.Lrhazi@georgetown.edu> wrote:

...

Any idea why 3.0.9 would reject an ldap user with the above error, while 3.0.8 would successfully authenticate them? The two servers have the same config files.

No idea.

Which supplicant are you using?

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Supplicant is a term that describes the application that is used to create
the wired/wireless network connection.

Some examples are:

1. Native Windows 7 or 8 Wireless Supplicant
2. Intel Proset Wireless Supplicant
3. Aruba Networks has a Windows supplicant specifically for creating
PEAP-GTC connections for Windows clients.

I think you get the idea.


On Sat, Jul 25, 2015 at 2:09 PM, Mohamed Lrhazi-2 [via FreeRADIUS] <
ml-node+s1045715n5735568h18@n5.nabble.com> wrote:

> Sorry Alan,  I don't know! How do I find out? The clients are Cisco
> wireless controllers.
>
> On Sat, Jul 25, 2015 at 4:29 PM, Alan DeKok <[hidden email]
> <http:///user/SendEmail.jtp?type=node&node=5735568&i=0>>
> wrote:
>
> > On Jul 25, 2015, at 1:03 PM, Mohamed Lrhazi <[hidden email]
> <http:///user/SendEmail.jtp?type=node&node=5735568&i=1>>
> > wrote:
> > > Any idea why 3.0.9 would reject an ldap user with the above error,
> while
> > > 3.0.8 would successfully authenticate them? The two servers have the
> same
> > > config files.
> >
> >   No idea.
> >
> >   Which supplicant are you using?
> >
> >   Alan DeKok.
> >
> >
> > -
> > List info/subscribe/unsubscribe? See
> > http://www.freeradius.org/list/users.html
> -
> List info/subscribe/unsubscribe? See
> http://www.freeradius.org/list/users.html
>
> ------------------------------
>  If you reply to this email, your message will be added to the discussion
> below:
>
> http://freeradius.1045715.n5.nabble.com/3-0-9-eap-Failed-continuing-EAP-MD5-4-session-EAP-sub-module-failed-tp5735562p5735568.html
>  To unsubscribe from FreeRADIUS, click here
> <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=2740692&code=am1pbGxzNTkwMUBnbWFpbC5jb218Mjc0MDY5MnwtMTQwNTk1MjU1MQ==>
> .
> NAML
> <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>
>

And are you absolutely sure there is no configuration difference between the two servers?

From the log you posted, it appears the 3.0.9 server is attempting an EAP-MD5 instead of MSCHAPv2 where they are likely configured in their supplicant.

3.0.9 Sat Jul 25 12:47:51 2015 : Debug: (1088) eap: Calling submodule eap_md5 to process data vs 3.0.8 Sat Jul 25 12:52:12 2015 : Debug: (2534) eap: Calling eap_mschapv2 to process EAP data I would double-check all the configs, it appears that there is a difference between the 2 boxes. On Sat, Jul 25, 2015 at 2:51 PM, Mohamed Lrhazi-2 [via FreeRADIUS] < ml-node+s1045715n5735571h11@n5.nabble.com> wrote:

On Sat, Jul 25, 2015 at 5:31 PM, Josh Miller <[hidden email] <http:///user/SendEmail.jtp?type=node&node=5735571&i=0>> wrote:

...

Supplicant is a term that describes the application that is used to create the wired/wireless network connection.

Some examples are:

1. Native Windows 7 or 8 Wireless Supplicant 2. Intel Proset Wireless Supplicant 3. Aruba Networks has a Windows supplicant specifically for creating PEAP-GTC connections for Windows clients.

I think you get the idea.

Thanks Josh, Alan.

I do not know much about the users... I just noticed that when I started sending traffic to 3.0.9 instances, these rejections started showing up in the log... so I tested further and found that indeed, the same user would fail on 3.0.9, then I would remove 3.0.9 from the pool, and baam, their next attempt would be routed to 3.0.8 instance, and would succeed right away!

Mohamed. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

------------------------------ If you reply to this email, your message will be added to the discussion below:

http://freeradius.1045715.n5.nabble.com/3-0-9-eap-Failed-continuing-EAP-MD5-... To unsubscribe from FreeRADIUS, click here <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=2740692&code=am1pbGxzNTkwMUBnbWFpbC5jb218Mjc0MDY5MnwtMTQwNTk1MjU1MQ==> . NAML <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>

Just drop your 3.0.8 config onto the 3.0.9 box? alan

I am now pretty confident my 3.0.9 config is the same as 3.0.8.. but the issue is still happening. A user is accepted on 3.0.8, but rejected on 3.0.9 with the error: eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed To make it harder to debug, not all users are failing to authenticate on 3.0.9... just some! I assume the issue is with the config and the supplicants... but how can I track this down? Thanks, Mohamed. On Sun, Jul 26, 2015 at 5:25 AM, Mohamed Lrhazi < Mohamed.Lrhazi@georgetown.edu> wrote:

Yeah, that's what I thought I had done! turns out I made too many mistakes.. getting stressed trying to figure out a problem, causing so many more in the process.

Thanks a lot, Mohamed.

On Sun, Jul 26, 2015 at 4:47 AM, Alan Buxey <A.L.M.Buxey@lboro.ac.uk> wrote:

...

Just drop your 3.0.8 config onto the 3.0.9 box?

alan

Thanks Alan. I will do that. the users seem to be consistent, meaning, if user fails, they always fail.. and for many, I did confirm in historic log, they used to succeed.. Also, my 3.0.8 is in docker container, on redhat 6, while 3.0.9 on redhat 7, no docker. To be user, I just removed 3.0.9 from one redhat 7 VM, and installed 3.0.8. and managed to reproduce the issue: user axa3 fails on 3.0.9, I disable that instance, axa3 tries again, this time goes to 3.0.8 and is accepted. I will send you full debug of both sessions off list. Thanks a lot, Mohamed, On Sun, Jul 26, 2015 at 7:50 AM, Alan DeKok <aland@deployingradius.com> wrote:

On Jul 26, 2015, at 7:44 AM, Mohamed Lrhazi <Mohamed.Lrhazi@georgetown.edu> wrote:

...

I am now pretty confident my 3.0.9 config is the same as 3.0.8.. but the issue is still happening. A user is accepted on 3.0.8, but rejected on 3.0.9 with the error:

Is it only a few users? Or is it random?

...

To make it harder to debug, not all users are failing to authenticate on 3.0.9... just some! I assume the issue is with the config and the supplicants... but how can I track this down?

Send me a PCAP file of the RADIUS traffic, off-list. I may be able to reproduce it from that.

Alan DeKok.

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Looks like mods-enabled/eap is the same, except that in debug mode, 3.0.8 logs lots of warning about unused lines in it, while 3.0.9 does not. otherwise it is the same: Sun Jul 26 07:53:30 2015 : Debug: eap { Sun Jul 26 07:53:30 2015 : Debug: default_eap_type = "md5" Sun Jul 26 07:53:30 2015 : Debug: timer_expire = 60 Sun Jul 26 07:53:30 2015 : Debug: ignore_unknown_eap_types = no Sun Jul 26 07:53:30 2015 : Debug: mod_accounting_username_bug = no Sun Jul 26 07:53:30 2015 : Debug: max_sessions = 16384 Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[59]: The item 'cisco_accounting_username_bug' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[142]: The item 'auth_type' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[176]: The item 'private_key_password' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[177]: The item 'private_key_file' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[189]: The item 'certificate_file' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[206]: The item 'ca_file' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[238]: The item 'dh_file' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[280]: The item 'ca_path' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[317]: The item 'cipher_list' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[326]: The item 'ecdh_curve' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[370]: The item 'enable' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[377]: The item 'lifetime' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[386]: The item 'max_entries' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[468]: The item 'enable' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[476]: The item 'override_cert_url' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[490]: The item 'url' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[539]: The item 'tls' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[569]: The item 'tls' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[578]: The item 'default_eap_type' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[594]: The item 'copy_request_to_tunnel' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[606]: The item 'use_tunneled_reply' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[618]: The item 'virtual_server' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[693]: The item 'tls' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[703]: The item 'default_eap_type' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[709]: The item 'copy_request_to_tunnel' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[710]: The item 'use_tunneled_reply' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Warning: /etc/raddb/mods-enabled/eap[729]: The item 'virtual_server' is defined, but is unused by the configuration Sun Jul 26 07:53:30 2015 : Debug: } ➜ ~ salt "radius-prod-*" cmd.shell "radiusd -v|head -1;md5sum /etc/raddb/mods-enabled/eap" radius-prod-1.uis.georgetown.edu: radiusd: FreeRADIUS Version 3.0.9, for host x86_64-redhat-linux-gnu, built on Jul 24 2015 at 19:41:18 c214bbc0b465c7fbf96a3f81c71200e9 /etc/raddb/mods-enabled/eap radius-prod-2.uis.georgetown.edu: radiusd: FreeRADIUS Version 3.0.8, for host x86_64-redhat-linux-gnu, built on Jul 25 2015 at 00:56:22 c214bbc0b465c7fbf96a3f81c71200e9 /etc/raddb/mods-enabled/eap ➜ ~ On Mon, Jul 27, 2015 at 4:14 AM, <A.L.M.Buxey@lboro.ac.uk> wrote:

Hi,

...

eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed

but you 3.0.8 doesnt show that line...which means your configs are likely not the same (have you checked what the default EAP type in mods-enabled/eap is?

alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Oh, OK. I did notice a SELinux issue while debugging before... fixing all and trying again.. : [root@radius-prod-1 ~]# restorecon -Rv /etc/raddb/ On Mon, Jul 27, 2015 at 11:46 AM, <A.L.M.Buxey@lboro.ac.uk> wrote:

Hi,

...

Looks like mods-enabled/eap is the same, except that in debug mode, 3.0.8 logs lots of warning about unused lines in it, while 3.0.9 does not. otherwise it is the same:

<snip> either really broken....as most of those options are essential...or the server is unable to read certain files/directories.

alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html