Authentication issues
David le Roux
david.leroux at miller.co.uk
Fri Jun 24 12:56:46 UTC 2022
So I used the scriptlet below to remove the host/ section and now no longer get the error message.
if (&User-Name =~ /^host\/(.*)$/) {
update request {
&Cert-CN := "%{1}"
}
}
As I was getting this error:
(8) eap_tls: --> host/hostname.domain.com
(8) eap_tls: checking certificate CN (hostname.domain.com) with xlat'ed value (host/hostname.domain.com)
tls: Certificate CN (hostname.domain.com) does not match specified value (host/hostname.domain.com)!
(8) eap_tls: >>> send TLS 1.2 [length 0002]
(8) eap_tls: ERROR: TLS Alert write:fatal:internal error
tls: TLS_accept: Error in error
However I now get the following error:
(2) Received Access-Request Id 15 from 10.37.80.11:1812 to 10.10.251.2:1812 length 547
(2) Framed-MTU = 1480
(2) NAS-IP-Address = 10.37.80.11
(2) NAS-Identifier = "de-sw01"
(2) User-Name = "host/hostname.domain.com"
(2) Service-Type = Framed-User
(2) Framed-Protocol = PPP
(2) NAS-Port = 26
(2) NAS-Port-Type = Ethernet
(2) NAS-Port-Id = "26"
(2) Called-Station-Id = "ec-9a-74-19-ad-00"
(2) Calling-Station-Id = "e4-54-e8-54-4a-de"
(2) Connect-Info = "CONNECT Ethernet 100Mbps Full duplex"
(2) Tunnel-Type:0 = VLAN
(2) Tunnel-Medium-Type:0 = IEEE-802
(2) Tunnel-Private-Group-Id:0 = "2"
(2) State = 0x0c28a8740c27a50f9f6de32a28f2c7f2
(2) EAP-Message = 0x020f00a60d800000009c160303009701000093030362b4ac3d2994f113ce5e3bd59fbac73691749a9495b7fbc7539910760601aea700002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000040000500050100000000000a00080006001d00170018000b00020100000d001400120401050102010403050302030202060106030023000000170000ff01000100
(2) Message-Authenticator = 0xc559daf1fcab5e9b102c581c18f3c4c0
(2) MS-RAS-Vendor = 11
(2) HP-Capability-Advert = 0x011a0000000b28
(2) HP-Capability-Advert = 0x011a0000000b2e
(2) HP-Capability-Advert = 0x011a0000000b30
(2) HP-Capability-Advert = 0x011a0000000b3d
(2) HP-Capability-Advert = 0x011a0000000b18
(2) HP-Capability-Advert = 0x011a0000000b19
(2) HP-Capability-Advert = 0x0138
(2) HP-Capability-Advert = 0x013a
(2) HP-Capability-Advert = 0x0140
(2) HP-Capability-Advert = 0x0141
(2) HP-Capability-Advert = 0x0151
(2) Restoring &session-state
(2) &session-state:Framed-MTU = 994
(2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/mh-site
(2) authorize {
(2) policy filter_username {
(2) if (&User-Name) {
(2) if (&User-Name) -> TRUE
(2) if (&User-Name) {
(2) if (&User-Name =~ / /) {
(2) if (&User-Name =~ / /) -> FALSE
(2) if (&User-Name =~ /@[^@]*@/ ) {
(2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(2) if (&User-Name =~ /\.\./ ) {
(2) if (&User-Name =~ /\.\./ ) -> FALSE
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE
(2) if (&User-Name =~ /\.$/) {
(2) if (&User-Name =~ /\.$/) -> FALSE
(2) if (&User-Name =~ /@\./) {
(2) if (&User-Name =~ /@\./) -> FALSE
(2) } # if (&User-Name) = notfound
(2) } # policy filter_username = notfound
(2) [preprocess] = ok
(2) [chap] = noop
(2) eap: Peer sent EAP Response (code 2) ID 15 length 166
(2) eap: No EAP Start, assuming it's an on-going EAP conversation
(2) [eap] = updated
(2) files: users: Matched entry DEFAULT at line 167
(2) [files] = ok
(2) [expiration] = noop
(2) [logintime] = noop
(2) policy rewrite_calling_station_id {
(2) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {
(2) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE
(2) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) {
(2) update request {
(2) EXPAND %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
(2) --> e4-54-e8-54-4a-de
(2) &Calling-Station-Id := e4-54-e8-54-4a-de
(2) } # update request = noop
(2) [updated] = updated
(2) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated
(2) ... skipping else: Preceding "if" was taken
(2) } # policy rewrite_calling_station_id = updated
(2) if (&User-Name =~ /^host\/(.*)$/) {
(2) if (&User-Name =~ /^host\/(.*)$/) -> TRUE
(2) if (&User-Name =~ /^host\/(.*)$/) {
(2) update request {
(2) EXPAND %{1}
(2) --> hostname.domain.com
(2) &User-Name := hostname.domain.com
(2) } # update request = noop
(2) } # if (&User-Name =~ /^host\/(.*)$/) = noop
(2) if (!EAP-Message) {
(2) if (!EAP-Message) -> FALSE
(2) else {
(2) eap: Peer sent EAP Response (code 2) ID 15 length 166
(2) eap: No EAP Start, assuming it's an on-going EAP conversation
(2) [eap] = updated
(2) } # else = updated
(2) } # authorize = updated
(2) Found Auth-Type = eap
(2) Found Auth-Type = eap
(2) ERROR: Warning: Found 2 auth-types on request for user 'hostname.domain.com'
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/mh-site
(2) Auth-Type EAP {
(2) eap: Expiring EAP session with state 0xf81b3429f8f739ad
(2) eap: Finished EAP session with state 0x0c28a8740c27a50f
(2) eap: Previous EAP request found for state 0x0c28a8740c27a50f, released from the list
(2) eap: Identity does not match User-Name. Authentication failed
(2) eap: Failed in handler
(2) [eap] = invalid
(2) } # Auth-Type EAP = invalid
(2) Failed to authenticate the user
(2) Using Post-Auth-Type Reject
(2) Post-Auth-Type sub-section not found. Ignoring.
(2) Login incorrect (Warning: Found 2 auth-types on request for user 'hostname.domain.com'): [hostname.domain.com] (from client de-sw01 port 26 cli e4-54-e8-54-4a-de)
(2) Delaying response for 1.000000 seconds
I imagine that having now modified the username it no longer matches its identity. I'm not sure how to remediate that.
________________________________
Miller Homes Limited Registered in Scotland - SC255429
2 Lochside View, Edinburgh Park, Edinburgh, EH12 9DH
Disclaimer: The Information in this e-mail is confidential and for use by the addressee(s) only. It may also be privileged. If you are not the intended recipient please notify us immediately on +44 (0) 870 336 5000 and delete the message from your computer: you may not copy or forward it, or use or disclose its contents to any other person. We do not accept any liability or responsibility for: (1) changes made to this email after it was sent, or (2) viruses transmitted through this email or any attachment.
Miller Homes Limited <https://www.millerhomes.co.uk>
More information about the Freeradius-Users
mailing list