Hello everyone,<div><br></div><div>i have a strange situation where a user found in the ldap query and matched with a group statement is not stopping. Below is output from the debug, other users in other groups are working just fine.</div>
<div><br></div><div><div>FreeRADIUS Version 2.1.12, for host i686-pc-linux-gnu, built on Jun 18 2012 at 11:30:12</div><div>Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. </div><div>There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A </div>
<div>PARTICULAR PURPOSE. </div><div>You may redistribute copies of FreeRADIUS under the terms of the </div><div>GNU General Public License v2. </div><div>Starting - reading configuration files ...</div><div>including configuration file /etc/raddb/radiusd.conf</div>
<div>including configuration file /etc/raddb/proxy.conf</div><div>including configuration file /etc/raddb/clients.conf</div><div>including files in directory /etc/raddb/modules/</div><div>including configuration file /etc/raddb/modules/sqlcounter_expire_on_login</div>
<div>including configuration file /etc/raddb/modules/passwd</div><div>including configuration file /etc/raddb/modules/digest</div><div>including configuration file /etc/raddb/modules/counter</div><div>including configuration file /etc/raddb/modules/dynamic_clients</div>
<div>including configuration file /etc/raddb/modules/linelog</div><div>including configuration file /etc/raddb/modules/attr_filter</div><div>including configuration file /etc/raddb/modules/mschap</div><div>including configuration file /etc/raddb/modules/perl</div>
<div>including configuration file /etc/raddb/modules/mac2ip</div><div>including configuration file /etc/raddb/modules/detail</div><div>including configuration file /etc/raddb/modules/soh</div><div>including configuration file /etc/raddb/modules/etc_group</div>
<div>including configuration file /etc/raddb/modules/realm</div><div>including configuration file /etc/raddb/modules/checkval</div><div>including configuration file /etc/raddb/modules/ldap-working</div><div>including configuration file /etc/raddb/modules/replicate</div>
<div>including configuration file /etc/raddb/modules/inner-eap</div><div>including configuration file /etc/raddb/modules/smbpasswd</div><div>including configuration file /etc/raddb/modules/opendirectory</div><div>including configuration file /etc/raddb/modules/rediswho</div>
<div>including configuration file /etc/raddb/modules/echo</div><div>including configuration file /etc/raddb/modules/expiration</div><div>including configuration file /etc/raddb/modules/preprocess</div><div>including configuration file /etc/raddb/modules/mac2vlan</div>
<div>including configuration file /etc/raddb/modules/acct_unique</div><div>including configuration file /etc/raddb/modules/redis</div><div>including configuration file /etc/raddb/modules/attr_rewrite</div><div>including configuration file /etc/raddb/modules/wimax</div>
<div>including configuration file /etc/raddb/modules/detail.log</div><div>including configuration file /etc/raddb/modules/<a href="http://detail.example.com">detail.example.com</a></div><div>including configuration file /etc/raddb/modules/radutmp</div>
<div>including configuration file /etc/raddb/modules/logintime</div><div>including configuration file /etc/raddb/modules/pam</div><div>including configuration file /etc/raddb/modules/files</div><div>including configuration file /etc/raddb/modules/ntlm_auth</div>
<div>including configuration file /etc/raddb/modules/cui</div><div>including configuration file /etc/raddb/modules/ldap</div><div>including configuration file /etc/raddb/modules/smsotp</div><div>including configuration file /etc/raddb/modules/unix</div>
<div>including configuration file /etc/raddb/modules/policy</div><div>including configuration file /etc/raddb/modules/always</div><div>including configuration file /etc/raddb/modules/exec</div><div>including configuration file /etc/raddb/modules/sradutmp</div>
<div>including configuration file /etc/raddb/modules/pap</div><div>including configuration file /etc/raddb/modules/otp</div><div>including configuration file /etc/raddb/modules/sql_log</div><div>including configuration file /etc/raddb/modules/ippool</div>
<div>including configuration file /etc/raddb/modules/expr</div><div>including configuration file /etc/raddb/modules/chap</div><div>including configuration file /etc/raddb/eap.conf</div><div>including configuration file /etc/raddb/policy.conf</div>
<div>including files in directory /etc/raddb/sites-enabled/</div><div>including configuration file /etc/raddb/sites-enabled/default</div><div>including configuration file /etc/raddb/sites-enabled/control-socket</div><div>
including configuration file /etc/raddb/sites-enabled/inner-tunnel</div><div>main {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>user = "radiusd"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>group = "radiusd"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>allow_core_dumps = no</div><div>}</div><div>including dictionary file /etc/raddb/dictionary</div><div>main {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>name = "radiusd"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>prefix = "/usr"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>localstatedir = "/var"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>sbindir = "/usr/sbin"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>logdir = "/var/log/radius"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>run_dir = "/var/run/radiusd"</div><div>
<span class="Apple-tab-span" style="white-space:pre"> </span>libdir = "/usr/lib/freeradius"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>radacctdir = "/var/log/radius/radacct"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>hostname_lookups = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>max_request_time = 30</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>cleanup_delay = 5</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>max_requests = 1024</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>pidfile = "/var/run/radiusd/radiusd.pid"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>checkrad = "/usr/sbin/checkrad"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>debug_level = 0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>proxy_requests = yes</div><div> log {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>stripped_names = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>auth = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auth_badpass = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auth_goodpass = no</div>
<div> }</div><div> security {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>max_attributes = 200</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>reject_delay = 1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>status_server = yes</div>
<div> }</div><div>}</div><div>radiusd: #### Loading Realms and Home Servers ####</div><div> proxy server {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>retry_delay = 5</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>retry_count = 3</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>default_fallback = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dead_time = 120</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>wake_all_if_all_dead = no</div>
<div> }</div><div> home_server localhost {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ipaddr = 127.0.0.1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>port = 1812</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>type = "auth"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>secret = "testing123"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>response_window = 20</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>max_outstanding = 65536</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>require_message_authenticator = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>zombie_period = 40</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>status_check = "status-server"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ping_interval = 30</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>check_interval = 30</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>num_answers_to_alive = 3</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>num_pings_to_alive = 3</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>revive_interval = 120</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>status_check_timeout = 4</div><div> coa {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>irt = 2</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mrt = 16</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>mrc = 5</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mrd = 30</div><div> }</div><div> }</div><div> home_server_pool my_auth_failover {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>type = fail-over</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>home_server = localhost</div><div> }</div><div> realm <a href="http://example.com">example.com</a> {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>auth_pool = my_auth_failover</div><div> }</div><div> realm LOCAL {</div><div> }</div><div>radiusd: #### Loading Clients ####</div><div> client localhost {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>ipaddr = 127.0.0.1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>require_message_authenticator = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>secret = "testing123"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>nastype = "other"</div><div> }</div><div> client <a href="http://11.1.0.0/16">11.1.0.0/16</a> {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>require_message_authenticator = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>secret = "testing123"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>shortname = "tdlte-net"</div><div> }</div>
<div>radiusd: #### Instantiating modules ####</div><div> instantiate {</div><div> Module: Linked to module rlm_exec</div><div> Module: Instantiating module "exec" from file /etc/raddb/modules/exec</div><div> exec {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>wait = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>input_pairs = "request"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>shell_escape = yes</div>
<div> }</div><div> Module: Linked to module rlm_expr</div><div> Module: Instantiating module "expr" from file /etc/raddb/modules/expr</div><div> Module: Linked to module rlm_expiration</div><div> Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration</div>
<div> expiration {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>reply-message = "Password Has Expired "</div><div> }</div><div> Module: Linked to module rlm_logintime</div><div> Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime</div>
<div> logintime {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>reply-message = "You are calling outside your allowed timespan "</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>minimum-timeout = 60</div>
<div> }</div><div> }</div><div>radiusd: #### Loading Virtual Servers ####</div><div>server { # from file /etc/raddb/radiusd.conf</div><div> modules {</div><div> Module: Creating Auth-Type = digest</div><div> Module: Creating Auth-Type = LDAP</div>
<div> Module: Creating Post-Auth-Type = REJECT</div><div> Module: Checking authenticate {...} for more modules to load</div><div> Module: Linked to module rlm_pap</div><div> Module: Instantiating module "pap" from file /etc/raddb/modules/pap</div>
<div> pap {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>encryption_scheme = "auto"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auto_header = yes</div><div> }</div>
<div> Module: Linked to module rlm_chap</div><div> Module: Instantiating module "chap" from file /etc/raddb/modules/chap</div><div> Module: Linked to module rlm_mschap</div><div> Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap</div>
<div> mschap {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>use_mppe = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>require_encryption = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>require_strong = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>with_ntdomain_hack = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>allow_retry = yes</div><div> }</div><div> Module: Linked to module rlm_digest</div>
<div> Module: Instantiating module "digest" from file /etc/raddb/modules/digest</div><div> Module: Linked to module rlm_unix</div><div> Module: Instantiating module "unix" from file /etc/raddb/modules/unix</div>
<div> unix {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>radwtmp = "/var/log/radius/radwtmp"</div><div> }</div><div> Module: Linked to module rlm_ldap</div><div> Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap-working</div>
<div> ldap {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>server = "11.1.200.53"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>port = 389</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>password = "w!max123"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>identity = "cn=Manager,dc=td4g,dc=net"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>net_timeout = 1</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>timeout = 4</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>timelimit = 3</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>tls_mode = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>start_tls = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>tls_require_cert = "allow"</div><div> tls {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>start_tls = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>require_cert = "allow"</div>
<div> }</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>basedn = "ou=People,dc=td4g,dc=net"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>base_filter = "(objectclass=radiusprofile)"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auto_header = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>access_attr_used_for_allow = yes</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>groupname_attribute = "cn"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>groupmembership_attribute = "tdcore"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dictionary_mapping = "/etc/raddb/ldap.attrmap"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>ldap_debug = 0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ldap_connections_number = 5</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>compare_check_items = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>do_xlat = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>set_auth_type = yes</div><div> keepalive {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>idle = 60</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>probes = 3</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>interval = 3</div><div> }</div><div> }</div><div>rlm_ldap: Registering ldap_groupcmp for Ldap-Group</div>
<div>rlm_ldap: Registering ldap_xlat with xlat_name ldap</div><div>rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap</div><div>rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$</div>
<div>rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$</div><div>rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type</div><div>rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use</div><div>
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id</div><div>rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id</div><div>rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password</div>
<div>rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password</div><div>rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password</div><div>rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password</div><div>rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password</div>
<div>rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header</div><div>rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT</div><div>rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration</div><div>
rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address</div><div>rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type</div><div>rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol</div>
<div>rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address</div><div>rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask</div><div>rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route</div>
<div>rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing</div><div>rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id</div><div>rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU</div><div>rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression</div>
<div>rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host</div><div>rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service</div><div>rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port</div>
<div>rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number</div><div>rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id</div><div>rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network</div>
<div>rlm_ldap: LDAP radiusClass mapped to RADIUS Class</div><div>rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout</div><div>rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout</div><div>rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action</div>
<div>rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service</div><div>rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node</div><div>rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group</div>
<div>rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link</div><div>rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network</div><div>rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone</div>
<div>rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit</div><div>rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port</div><div>rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message</div><div>
rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type</div><div>rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type</div><div>rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id</div>
<div>conns: 0x999aaa0</div><div> Module: Linked to module rlm_eap</div><div> Module: Instantiating module "eap" from file /etc/raddb/eap.conf</div><div> eap {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>default_eap_type = "md5"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>timer_expire = 60</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ignore_unknown_eap_types = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>cisco_accounting_username_bug = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>max_sessions = 4096</div><div> }</div><div> Module: Linked to sub-module rlm_eap_md5</div><div> Module: Instantiating eap-md5</div><div> Module: Linked to sub-module rlm_eap_leap</div>
<div> Module: Instantiating eap-leap</div><div> Module: Linked to sub-module rlm_eap_gtc</div><div> Module: Instantiating eap-gtc</div><div> gtc {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>challenge = "Password: "</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>auth_type = "PAP"</div><div> }</div><div> Module: Linked to sub-module rlm_eap_tls</div><div> Module: Instantiating eap-tls</div><div> tls {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>rsa_key_exchange = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dh_key_exchange = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rsa_key_length = 512</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>dh_key_length = 512</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>verify_depth = 0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>CA_path = "/etc/raddb/certs"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>pem_file_type = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>private_key_file = "/etc/raddb/certs/server.pem"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>certificate_file = "/etc/raddb/certs/server.pem"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>CA_file = "/etc/raddb/certs/ca.pem"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>private_key_password = "whatever"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dh_file = "/etc/raddb/certs/dh"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>random_file = "/etc/raddb/certs/random"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>fragment_size = 1024</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>include_length = yes</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>check_crl = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>cipher_list = "DEFAULT"</div><div> cache {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>enable = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>lifetime = 24</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>max_entries = 255</div><div> }</div><div> verify {</div><div> }</div>
<div> ocsp {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>enable = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>override_cert_url = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>url = "<a href="http://127.0.0.1/ocsp/">http://127.0.0.1/ocsp/</a>"</div>
<div> }</div><div> }</div><div> Module: Linked to sub-module rlm_eap_ttls</div><div> Module: Instantiating eap-ttls</div><div> ttls {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>default_eap_type = "md5"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>copy_request_to_tunnel = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>use_tunneled_reply = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>virtual_server = "inner-tunnel"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>include_length = yes</div><div> }</div><div> Module: Linked to sub-module rlm_eap_peap</div><div> Module: Instantiating eap-peap</div><div> peap {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>default_eap_type = "mschapv2"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>copy_request_to_tunnel = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>use_tunneled_reply = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>proxy_tunneled_request_as_eap = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>virtual_server = "inner-tunnel"</div><div>
<span class="Apple-tab-span" style="white-space:pre"> </span>soh = no</div><div> }</div><div> Module: Linked to sub-module rlm_eap_mschapv2</div><div> Module: Instantiating eap-mschapv2</div><div> mschapv2 {</div><div>
<span class="Apple-tab-span" style="white-space:pre"> </span>with_ntdomain_hack = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>send_error = no</div><div> }</div><div> Module: Checking authorize {...} for more modules to load</div>
<div> Module: Linked to module rlm_preprocess</div><div> Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess</div><div> preprocess {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>huntgroups = "/etc/raddb/huntgroups"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>hints = "/etc/raddb/hints"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>with_ascend_hack = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ascend_channels_per_line = 23</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>with_ntdomain_hack = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>with_specialix_jetstream_hack = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>with_cisco_vsa_hack = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>with_alvarion_vsa_hack = no</div><div> }</div><div> Module: Linked to module rlm_files</div><div> Module: Instantiating module "files" from file /etc/raddb/modules/files</div>
<div> files {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>usersfile = "/etc/raddb/users"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>acctusersfile = "/etc/raddb/acct_users"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>preproxy_usersfile = "/etc/raddb/preproxy_users"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>compat = "no"</div>
<div> }</div><div> Module: Linked to module rlm_always</div><div> Module: Instantiating module "reject" from file /etc/raddb/modules/always</div><div> always reject {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rcode = "reject"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>simulcount = 0</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>mpp = no</div><div> }</div><div> Module: Checking preacct {...} for more modules to load</div>
<div> Module: Linked to module rlm_acct_unique</div><div> Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique</div><div> acct_unique {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"</div>
<div> }</div><div> Module: Linked to module rlm_realm</div><div> Module: Instantiating module "suffix" from file /etc/raddb/modules/realm</div><div> realm suffix {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>format = "suffix"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>delimiter = "@"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ignore_default = no</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ignore_null = no</div>
<div> }</div><div> Module: Checking accounting {...} for more modules to load</div><div> Module: Linked to module rlm_detail</div><div> Module: Instantiating module "detail" from file /etc/raddb/modules/detail</div>
<div> detail {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>header = "%t"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>detailperm = 384</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>dirperm = 493</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>locking = no</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>log_packet_header = no</div><div> }</div><div> Module: Linked to module rlm_radutmp</div><div> Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp</div>
<div> radutmp {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>filename = "/var/log/radius/radutmp"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>username = "%{User-Name}"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>case_sensitive = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>check_with_nas = yes</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>perm = 384</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>callerid = yes</div><div> }</div><div> Module: Linked to module rlm_attr_filter</div><div> Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter</div>
<div> attr_filter attr_filter.accounting_response {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>attrsfile = "/etc/raddb/attrs.accounting_response"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>key = "%{User-Name}"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>relaxed = no</div><div> }</div><div> Module: Checking session {...} for more modules to load</div><div> Module: Checking post-proxy {...} for more modules to load</div>
<div> Module: Checking post-auth {...} for more modules to load</div><div> Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter</div><div> attr_filter attr_filter.access_reject {</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>attrsfile = "/etc/raddb/attrs.access_reject"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>key = "%{User-Name}"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>relaxed = no</div><div> }</div><div> } # modules</div><div>} # server</div><div>server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel</div>
<div> modules {</div><div> Module: Checking authenticate {...} for more modules to load</div><div> Module: Checking authorize {...} for more modules to load</div><div> Module: Checking session {...} for more modules to load</div>
<div> Module: Checking post-proxy {...} for more modules to load</div><div> Module: Checking post-auth {...} for more modules to load</div><div> } # modules</div><div>} # server</div><div>radiusd: #### Opening IP addresses and Ports ####</div>
<div>listen {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>type = "auth"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ipaddr = *</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>port = 0</div>
<div>}</div><div>listen {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>type = "acct"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ipaddr = *</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>port = 0</div>
<div>}</div><div>listen {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>type = "control"</div><div> listen {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>socket = "/var/run/radiusd/radiusd.sock"</div>
<div> }</div><div>}</div><div>listen {</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>type = "auth"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ipaddr = 127.0.0.1</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>port = 18120</div><div>}</div><div> ... adding new socket proxy address * port 51971</div><div>Listening on authentication address * port 1812</div><div>Listening on accounting address * port 1813</div>
<div>Listening on command file /var/run/radiusd/radiusd.sock</div><div>Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel</div><div>Listening on proxy address * port 1814</div><div>Ready to process requests.</div>
<div>rad_recv: Access-Request packet from host 11.1.200.49 port 1645, id=244, length=78</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-IP-Address = 11.1.200.49</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port = 4</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>NAS-Port-Type = Virtual</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Name = "jbeck"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>Calling-Station-Id = "172.27.126.54"</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>User-Password = "XXXXXXX"</div><div># Executing section authorize from file /etc/raddb/sites-enabled/default</div><div>+- entering group authorize {...}</div>
<div>++[preprocess] returns ok</div><div>[eap] No EAP-Message, not doing EAP</div><div>++[eap] returns noop</div><div> [ldap] Entering ldap_groupcmp()</div><div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: ou=People,dc=td4g,dc=net -> ou=People,dc=td4g,dc=net</div>
<div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{Stripped-User-Name} -> </div><div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>... expanding second conditional</div>
<div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> jbeck</div><div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jbeck)</div>
<div> [ldap] ldap_get_conn: Checking Id: 0</div><div> [ldap] ldap_get_conn: Got Id: 0</div><div> [ldap] attempting LDAP reconnection</div><div> [ldap] (re)connect to <a href="http://11.1.200.53:389">11.1.200.53:389</a>, authentication 0</div>
<div> [ldap] bind as cn=Manager,dc=td4g,dc=net/w!max123 to <a href="http://11.1.200.53:389">11.1.200.53:389</a></div><div> [ldap] waiting for bind result ...</div><div> [ldap] Bind was successful</div><div> [ldap] performing search in ou=People,dc=td4g,dc=net, with filter (uid=jbeck)</div>
<div> [ldap] ldap_release_conn: Release Id: 0</div><div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet)))</div>
<div> [ldap] ldap_get_conn: Checking Id: 0</div><div> [ldap] ldap_get_conn: Got Id: 0</div><div> [ldap] performing search in cn=tdcore,ou=people,dc=td4g,dc=net, with filter (|(&(objectClass=GroupOfNames)(member=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet)))</div>
<div> [ldap] object not found</div><div> [ldap] ldap_release_conn: Release Id: 0</div><div> [ldap] ldap_get_conn: Checking Id: 0</div><div> [ldap] ldap_get_conn: Got Id: 0</div><div> [ldap] performing search in uid=jbeck,ou=people,dc=td4g,dc=net, with filter (objectclass=*)</div>
<div>rlm_ldap::ldap_groupcmp: ldap_get_values() failed</div><div> [ldap] ldap_release_conn: Release Id: 0</div><div> [ldap] Entering ldap_groupcmp()</div><div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: ou=People,dc=td4g,dc=net -> ou=People,dc=td4g,dc=net</div>
<div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet)))</div>
<div> [ldap] ldap_get_conn: Checking Id: 0</div><div> [ldap] ldap_get_conn: Got Id: 0</div><div> [ldap] performing search in cn=ota,ou=people,dc=td4g,dc=net, with filter (|(&(objectClass=GroupOfNames)(member=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet)))</div>
<div> [ldap] object not found</div><div> [ldap] ldap_release_conn: Release Id: 0</div><div> [ldap] ldap_get_conn: Checking Id: 0</div><div> [ldap] ldap_get_conn: Got Id: 0</div><div> [ldap] performing search in uid=jbeck,ou=people,dc=td4g,dc=net, with filter (objectclass=*)</div>
<div>rlm_ldap::ldap_groupcmp: ldap_get_values() failed</div><div> [ldap] ldap_release_conn: Release Id: 0</div><div> [ldap] Entering ldap_groupcmp()</div><div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: ou=People,dc=td4g,dc=net -> ou=People,dc=td4g,dc=net</div>
<div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet)))</div>
<div> [ldap] ldap_get_conn: Checking Id: 0</div><div> [ldap] ldap_get_conn: Got Id: 0</div><div> [ldap] performing search in cn=device,ou=people,dc=td4g,dc=net, with filter (|(&(objectClass=GroupOfNames)(member=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet)))</div>
<div><b>rlm_ldap::ldap_groupcmp: User found in group cn=device,ou=people,dc=td4g,dc=net</b></div><div> [ldap] ldap_release_conn: Release Id: 0</div><div> [ldap] Entering ldap_groupcmp()</div><div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: ou=People,dc=td4g,dc=net -> ou=People,dc=td4g,dc=net</div>
<div>[files] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet)))</div>
<div> [ldap] ldap_get_conn: Checking Id: 0</div><div> [ldap] ldap_get_conn: Got Id: 0</div><div> [ldap] performing search in cn=netart,ou=people,dc=td4g,dc=net, with filter (|(&(objectClass=GroupOfNames)(member=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3djbeck\2cou\3dpeople\2cdc\3dtd4g\2cdc\3dnet)))</div>
<div> [ldap] object not found</div><div> [ldap] ldap_release_conn: Release Id: 0</div><div> [ldap] ldap_get_conn: Checking Id: 0</div><div> [ldap] ldap_get_conn: Got Id: 0</div><div> [ldap] performing search in uid=jbeck,ou=people,dc=td4g,dc=net, with filter (objectclass=*)</div>
<div>rlm_ldap::ldap_groupcmp: ldap_get_values() failed</div><div> [ldap] ldap_release_conn: Release Id: 0</div><div>[files] users: Matched entry DEFAULT at line 230</div><div>++[files] returns ok</div><div>[ldap] performing user authorization for jbeck</div>
<div>[ldap] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{Stripped-User-Name} -> </div><div>[ldap] <span class="Apple-tab-span" style="white-space:pre"> </span>... expanding second conditional</div>
<div>[ldap] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> jbeck</div><div>[ldap] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jbeck)</div>
<div>[ldap] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: ou=People,dc=td4g,dc=net -> ou=People,dc=td4g,dc=net</div><div> [ldap] ldap_get_conn: Checking Id: 0</div><div> [ldap] ldap_get_conn: Got Id: 0</div>
<div> [ldap] performing search in ou=People,dc=td4g,dc=net, with filter (uid=jbeck)</div><div>[ldap] looking for check items in directory...</div><div> [ldap] userPassword -> Password-With-Header == "XXXXXXX"</div>
<div>[ldap] looking for reply items in directory...</div><div>[ldap] user jbeck authorized to use remote access</div><div> [ldap] ldap_release_conn: Release Id: 0</div><div>++[ldap] returns ok</div><div>++? if (fail)</div>
<div>? Evaluating (fail) -> FALSE</div><div>++? if (fail) -> FALSE</div><div>++? elsif (notfound)</div><div>? Evaluating (notfound) -> FALSE</div><div>++? elsif (notfound) -> FALSE</div><div>++[expiration] returns noop</div>
<div>++[logintime] returns noop</div><div>[pap] Failed to decode Password-With-Header = "XXXXXXX"</div><div>[pap] WARNING: Auth-Type already set. Not setting to PAP</div><div>++[pap] returns noop</div><div>Found Auth-Type = Reject</div>
<div>Auth-Type = Reject, rejecting user</div><div>Failed to authenticate the user.</div><div>Using Post-Auth-Type Reject</div><div># Executing group from file /etc/raddb/sites-enabled/default</div><div>+- entering group REJECT {...}</div>
<div>[attr_filter.access_reject] <span class="Apple-tab-span" style="white-space:pre"> </span>expand: %{User-Name} -> jbeck</div><div>attr_filter: Matched entry DEFAULT at line 11</div><div>++[attr_filter.access_reject] returns updated</div>
<div>Delaying reject of request 0 for 1 seconds</div><div>Going to the next request</div><div>Waking up in 0.9 seconds.</div><div>Sending delayed reject for request 0</div><div>Sending Access-Reject of id 244 to 11.1.200.49 port 1645</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span>Reply-Message := "Access Denied. Your attemp has been logged."</div><div>Waking up in 4.9 seconds.</div></div><div><br></div><div>Any suggestions?</div>