I see PAP supports them all, So how do i utilize this? Does windows, android, and ios not support PAP?<br><br><div class="gmail_quote">On Sun, Nov 4, 2012 at 4:20 PM, Ryan Summey <span dir="ltr"><<a href="mailto:ryan.summey@gmail.com" target="_blank">ryan.summey@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">So how do we secure the user accounts in the database?<div class="HOEnZb"><div class="h5"><br><br><div class="gmail_quote">
On Sun, Nov 4, 2012 at 4:11 PM, Blake Covarrubias <span dir="ltr"><<a href="mailto:blake@covarrubi.as" target="_blank">blake@covarrubi.as</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div><span style="font-family:'.HelveticaNeueUI';font-size:15px;line-height:19px;white-space:nowrap"><a href="http://deployingradius.com/documents/protocols/compatibility.html" target="_blank">http://deployingradius.com/documents/protocols/compatibility.html</a></span></div>
<div><font face=".HelveticaNeueUI"><span style="font-size:15px;line-height:19px;white-space:nowrap"><br></span></font></div><div><font face=".HelveticaNeueUI"><span style="font-size:15px;line-height:19px;white-space:nowrap">md5 passwords are not compatible with MS-CHAP.<br>
</span></font><br><span>--</span><div>Blake Covarrubias</div></div><div><div><div><br>On Nov 4, 2012, at 13:56, Ryan Summey <<a href="mailto:ryan.summey@gmail.com" target="_blank">ryan.summey@gmail.com</a>> wrote:<br>
<br></div><blockquote type="cite"><div><div> Below is the log. I am able to connect using clear-text passwords but not encrypted passwords... What is confusing me is if i do a radtest it works fine using the users credentials that are encrypted... But as you can see below ths is me trying to connecting from my phone using the account i created in the databse with the password md5. Again this works when i do a radtest but not in a real world test. Only clear-text pw work in the realworld test. </div>
<div><br></div><div>Thank you for your time.</div><div><br></div><div><br></div><div><br></div><div><br></div><div>freeradius -X</div><div>FreeRADIUS Version 2.1.12, for host i686-pc-linux-gnu, built on Sep 11 2012 at 22:27:08</div>
<div>Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.</div><div>There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A</div><div>PARTICULAR PURPOSE.</div><div>You may redistribute copies of FreeRADIUS under the terms of the</div>
<div>GNU General Public License v2.</div><div>Starting - reading configuration files ...</div><div>including configuration file /etc/freeradius/radiusd.conf</div><div>including configuration file /etc/freeradius/proxy.conf</div>
<div>including configuration file /etc/freeradius/clients.conf</div><div>including files in directory /etc/freeradius/modules/</div><div>including configuration file /etc/freeradius/modules/always</div><div>including configuration file /etc/freeradius/modules/mac2ip</div>
<div>including configuration file /etc/freeradius/modules/sql_log</div><div>including configuration file /etc/freeradius/modules/smbpasswd</div><div>including configuration file /etc/freeradius/modules/detail</div><div>including configuration file /etc/freeradius/modules/smsotp</div>
<div>including configuration file /etc/freeradius/modules/cui</div><div>including configuration file /etc/freeradius/modules/wimax</div><div>including configuration file /etc/freeradius/modules/replicate</div><div>including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login</div>
<div>including configuration file /etc/freeradius/modules/sradutmp</div><div>including configuration file /etc/freeradius/modules/pap</div><div>including configuration file /etc/freeradius/modules/echo</div><div>including configuration file /etc/freeradius/modules/expiration</div>
<div>including configuration file /etc/freeradius/modules/files</div><div>including configuration file /etc/freeradius/modules/mac2vlan</div><div>including configuration file /etc/freeradius/modules/acct_unique</div><div>
including configuration file /etc/freeradius/modules/krb5</div><div>including configuration file /etc/freeradius/modules/mschap</div><div>including configuration file /etc/freeradius/modules/checkval</div><div>including configuration file /etc/freeradius/modules/preprocess</div>
<div>including configuration file /etc/freeradius/modules/logintime</div><div>including configuration file /etc/freeradius/modules/pam</div><div>including configuration file /etc/freeradius/modules/passwd</div><div>including configuration file /etc/freeradius/modules/etc_group</div>
<div>including configuration file /etc/freeradius/modules/opendirectory</div><div>including configuration file /etc/freeradius/modules/attr_filter</div><div>including configuration file /etc/freeradius/modules/linelog</div>
<div>including configuration file /etc/freeradius/modules/soh</div><div>including configuration file /etc/freeradius/modules/attr_rewrite</div><div>including configuration file /etc/freeradius/modules/chap</div><div>including configuration file /etc/freeradius/modules/rediswho</div>
<div>including configuration file /etc/freeradius/modules/counter</div><div>including configuration file /etc/freeradius/modules/digest</div><div>including configuration file /etc/freeradius/modules/policy</div><div>including configuration file /etc/freeradius/modules/unix</div>
<div>including configuration file /etc/freeradius/modules/ldap</div><div>including configuration file /etc/freeradius/modules/otp</div><div>including configuration file /etc/freeradius/modules/radutmp</div><div>including configuration file /etc/freeradius/modules/perl</div>
<div>including configuration file /etc/freeradius/modules/dynamic_clients</div><div>including configuration file /etc/freeradius/modules/<a href="http://detail.example.com" target="_blank">detail.example.com</a></div><div>
including configuration file /etc/freeradius/modules/redis</div>
<div>including configuration file /etc/freeradius/modules/ntlm_auth</div><div>including configuration file /etc/freeradius/modules/inner-eap</div><div>including configuration file /etc/freeradius/modules/ippool</div><div>
including configuration file /etc/freeradius/modules/realm</div><div>including configuration file /etc/freeradius/modules/detail.log</div><div>including configuration file /etc/freeradius/modules/exec</div><div>including configuration file /etc/freeradius/modules/expr</div>
<div>including configuration file /etc/freeradius/eap.conf</div><div>including configuration file /etc/freeradius/sql.conf</div><div>including configuration file /etc/freeradius/sql/mysql/dialup.conf</div><div>including configuration file /etc/freeradius/policy.conf</div>
<div>including files in directory /etc/freeradius/sites-enabled/</div><div>including configuration file /etc/freeradius/sites-enabled/default</div><div>including configuration file /etc/freeradius/sites-enabled/inner-tunnel</div>
<div>main {</div><div> user = "freerad"</div><div> group = "freerad"</div><div> allow_core_dumps = no</div><div>}</div><div>including dictionary file /etc/freeradius/dictionary</div>
<div>main {</div><div> name = "freeradius"</div><div> prefix = "/usr"</div><div> localstatedir = "/var"</div><div> sbindir = "/usr/sbin"</div><div> logdir = "/var/log/freeradius"</div>
<div> run_dir = "/var/run/freeradius"</div><div> libdir = "/usr/lib/freeradius"</div><div> radacctdir = "/var/log/freeradius/radacct"</div><div> hostname_lookups = no</div>
<div> max_request_time = 30</div><div> cleanup_delay = 5</div><div> max_requests = 1024</div><div> pidfile = "/var/run/freeradius/freeradius.pid"</div><div> checkrad = "/usr/sbin/checkrad"</div>
<div> debug_level = 0</div><div> proxy_requests = yes</div><div> log {</div><div> stripped_names = no</div><div> auth = no</div><div> auth_badpass = no</div><div> auth_goodpass = no</div>
<div> }</div><div> security {</div><div> max_attributes = 200</div><div> reject_delay = 1</div><div> status_server = yes</div><div> }</div><div>}</div><div>radiusd: #### Loading Realms and Home Servers ####</div>
<div> proxy server {</div><div> retry_delay = 5</div><div> retry_count = 3</div><div> default_fallback = no</div><div> dead_time = 120</div><div> wake_all_if_all_dead = no</div><div> }</div>
<div> home_server localhost {</div><div> ipaddr = 127.0.0.1</div><div> port = 1812</div><div> type = "auth"</div><div> secret = "testing123"</div><div> response_window = 20</div>
<div> max_outstanding = 65536</div><div> require_message_authenticator = yes</div><div> zombie_period = 40</div><div> status_check = "status-server"</div><div> ping_interval = 30</div>
<div> check_interval = 30</div><div> num_answers_to_alive = 3</div><div> num_pings_to_alive = 3</div><div> revive_interval = 120</div><div> status_check_timeout = 4</div><div> coa {</div>
<div> irt = 2</div><div> mrt = 16</div><div> mrc = 5</div><div> mrd = 30</div><div> }</div><div> }</div><div> home_server_pool my_auth_failover {</div><div> type = fail-over</div><div>
home_server = localhost</div>
<div> }</div><div> realm <a href="http://example.com" target="_blank">example.com</a> {</div><div> auth_pool = my_auth_failover</div><div> }</div><div> realm LOCAL {</div><div> }</div><div>radiusd: #### Loading Clients ####</div>
<div>
client localhost {</div><div> ipaddr = 127.0.0.1</div><div> require_message_authenticator = no</div><div> secret = "testsecret"</div><div> nastype = "other"</div><div> }</div>
<div> client 192.168.2.24 {</div><div> require_message_authenticator = no</div><div> secret = "testsecret"</div><div> shortname = "cvpn-pptp"</div><div> nastype = "other"</div>
<div> }</div><div>radiusd: #### Instantiating modules ####</div><div> instantiate {</div><div> Module: Linked to module rlm_exec</div><div> Module: Instantiating module "exec" from file /etc/freeradius/modules/exec</div>
<div> exec {</div><div> wait = no</div><div> input_pairs = "request"</div><div> shell_escape = yes</div><div> }</div><div> Module: Linked to module rlm_expr</div><div> Module: Instantiating module "expr" from file /etc/freeradius/modules/expr</div>
<div> Module: Linked to module rlm_expiration</div><div> Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration</div><div> expiration {</div><div> reply-message = "Password Has Expired "</div>
<div> }</div><div> Module: Linked to module rlm_logintime</div><div> Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime</div><div> logintime {</div><div> reply-message = "You are calling outside your allowed timespan "</div>
<div> minimum-timeout = 60</div><div> }</div><div> }</div><div>radiusd: #### Loading Virtual Servers ####</div><div>server { # from file /etc/freeradius/radiusd.conf</div><div> modules {</div><div> Module: Creating Auth-Type = digest</div>
<div> Module: Creating Post-Auth-Type = REJECT</div><div> Module: Checking authenticate {...} for more modules to load</div><div> Module: Linked to module rlm_pap</div><div> Module: Instantiating module "pap" from file /etc/freeradius/modules/pap</div>
<div> pap {</div><div> encryption_scheme = "auto"</div><div> auto_header = no</div><div> }</div><div> Module: Linked to module rlm_chap</div><div> Module: Instantiating module "chap" from file /etc/freeradius/modules/chap</div>
<div> Module: Linked to module rlm_mschap</div><div> Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap</div><div> mschap {</div><div> use_mppe = yes</div><div> require_encryption = yes</div>
<div> require_strong = yes</div><div> with_ntdomain_hack = no</div><div> allow_retry = yes</div><div> }</div><div> Module: Linked to module rlm_digest</div><div> Module: Instantiating module "digest" from file /etc/freeradius/modules/digest</div>
<div> Module: Linked to module rlm_unix</div><div> Module: Instantiating module "unix" from file /etc/freeradius/modules/unix</div><div> unix {</div><div> radwtmp = "/var/log/freeradius/radwtmp"</div>
<div> }</div><div> Module: Linked to module rlm_eap</div><div> Module: Instantiating module "eap" from file /etc/freeradius/eap.conf</div><div> eap {</div><div> default_eap_type = "md5"</div>
<div>
timer_expire = 60</div><div> ignore_unknown_eap_types = no</div><div> cisco_accounting_username_bug = no</div><div> max_sessions = 4096</div><div> }</div><div> Module: Linked to sub-module rlm_eap_md5</div>
<div> Module: Instantiating eap-md5</div><div> Module: Linked to sub-module rlm_eap_leap</div><div> Module: Instantiating eap-leap</div><div> Module: Linked to sub-module rlm_eap_gtc</div><div> Module: Instantiating eap-gtc</div>
<div> gtc {</div><div> challenge = "Password: "</div><div> auth_type = "PAP"</div><div> }</div><div> Module: Linked to sub-module rlm_eap_tls</div><div> Module: Instantiating eap-tls</div>
<div> tls {</div><div> rsa_key_exchange = no</div><div> dh_key_exchange = yes</div><div> rsa_key_length = 512</div><div> dh_key_length = 512</div><div> verify_depth = 0</div><div> CA_path = "/etc/freeradius/certs"</div>
<div> pem_file_type = yes</div><div> private_key_file = "/etc/freeradius/certs/server.key"</div><div> certificate_file = "/etc/freeradius/certs/server.pem"</div><div> CA_file = "/etc/freeradius/certs/ca.pem"</div>
<div> private_key_password = "whatever"</div><div> dh_file = "/etc/freeradius/certs/dh"</div><div> random_file = "/dev/urandom"</div><div> fragment_size = 1024</div>
<div> include_length = yes</div><div> check_crl = no</div><div> cipher_list = "DEFAULT"</div><div> make_cert_command = "/etc/freeradius/certs/bootstrap"</div><div> ecdh_curve = "prime256v1"</div>
<div> cache {</div><div> enable = no</div><div> lifetime = 24</div><div> max_entries = 255</div><div> }</div><div> verify {</div><div> }</div><div> ocsp {</div><div> enable = no</div>
<div> override_cert_url = yes</div><div> url = "<a href="http://127.0.0.1/ocsp/" target="_blank">http://127.0.0.1/ocsp/</a>"</div><div> }</div><div> }</div><div> Module: Linked to sub-module rlm_eap_ttls</div>
<div> Module: Instantiating eap-ttls</div><div> ttls {</div><div> default_eap_type = "md5"</div><div> copy_request_to_tunnel = no</div><div> use_tunneled_reply = no</div><div> virtual_server = "inner-tunnel"</div>
<div> include_length = yes</div><div> }</div><div> Module: Linked to sub-module rlm_eap_peap</div><div> Module: Instantiating eap-peap</div><div> peap {</div><div> default_eap_type = "mschapv2"</div>
<div> copy_request_to_tunnel = no</div><div> use_tunneled_reply = no</div><div> proxy_tunneled_request_as_eap = yes</div><div> virtual_server = "inner-tunnel"</div><div> soh = no</div>
<div> }</div><div> Module: Linked to sub-module rlm_eap_mschapv2</div><div> Module: Instantiating eap-mschapv2</div><div> mschapv2 {</div><div> with_ntdomain_hack = no</div><div> send_error = no</div><div>
}</div><div> Module: Checking authorize {...} for more modules to load</div><div> Module: Linked to module rlm_preprocess</div><div> Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess</div>
<div> preprocess {</div><div> huntgroups = "/etc/freeradius/huntgroups"</div><div> hints = "/etc/freeradius/hints"</div><div> with_ascend_hack = no</div><div> ascend_channels_per_line = 23</div>
<div> with_ntdomain_hack = no</div><div> with_specialix_jetstream_hack = no</div><div> with_cisco_vsa_hack = no</div><div> with_alvarion_vsa_hack = no</div><div> }</div><div> Module: Linked to module rlm_realm</div>
<div> Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm</div><div> realm suffix {</div><div> format = "suffix"</div><div> delimiter = "@"</div><div>
ignore_default = no</div><div> ignore_null = no</div><div> }</div><div> Module: Linked to module rlm_files</div><div> Module: Instantiating module "files" from file /etc/freeradius/modules/files</div>
<div> files {</div><div> usersfile = "/etc/freeradius/users"</div><div> acctusersfile = "/etc/freeradius/acct_users"</div><div> preproxy_usersfile = "/etc/freeradius/preproxy_users"</div>
<div> compat = "no"</div><div> }</div><div> Module: Linked to module rlm_sql</div><div> Module: Instantiating module "sql" from file /etc/freeradius/sql.conf</div><div> sql {</div><div> driver = "rlm_sql_mysql"</div>
<div> server = "<a href="http://mysql.claravpn.com" target="_blank">mysql.claravpn.com</a>"</div><div> port = "3306"</div><div> login = "cvpnadmin"</div><div> password = "106westwhiteoakstreet"</div>
<div> radius_db = "cvpnradiusdb"</div><div> read_groups = yes</div><div> sqltrace = no</div><div> sqltracefile = "/var/log/freeradius/sqltrace.sql"</div><div> readclients = no</div>
<div> deletestalesessions = yes</div><div> num_sql_socks = 5</div><div> lifetime = 0</div><div> max_queries = 0</div><div> sql_user_name = "%{User-Name}"</div><div> default_user_profile = ""</div>
<div> nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas"</div><div> authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id"</div>
<div> authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id"</div><div> authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id"</div>
<div> authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id"</div><div>
accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'"</div>
<div> accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'"</div>
<div> accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')"</div>
<div> accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')"</div>
<div> accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'"</div>
<div> accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'"</div>
<div> accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')"</div>
<div> group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority"</div><div> connect_failure_retry_delay = 60</div>
<div> simul_count_query = "SELECT COUNT(*) #FROM radacct #WHERE username = '%{SQL-User-Name}' #AND acctstoptime IS NULL"</div>
<div> simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL"</div>
<div> postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')"</div>
<div> safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"</div><div> }</div><div>rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked</div><div>
rlm_sql (sql): Attempting to connect to <a href="http://cvpnadmin@mysql.claravpn.com:3306/cvpnradiusdb" target="_blank">cvpnadmin@mysql.claravpn.com:3306/cvpnradiusdb</a></div><div>rlm_sql (sql): starting 0</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #0</div>
<div>rlm_sql_mysql: Starting connect to MySQL server for #0</div><div>rlm_sql (sql): Connected new DB handle, #0</div><div>rlm_sql (sql): starting 1</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #1</div><div>
rlm_sql_mysql: Starting connect to MySQL server for #1</div><div>rlm_sql (sql): Connected new DB handle, #1</div><div>rlm_sql (sql): starting 2</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #2</div><div>rlm_sql_mysql: Starting connect to MySQL server for #2</div>
<div>rlm_sql (sql): Connected new DB handle, #2</div><div>rlm_sql (sql): starting 3</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #3</div><div>rlm_sql_mysql: Starting connect to MySQL server for #3</div><div>
rlm_sql (sql): Connected new DB handle, #3</div><div>rlm_sql (sql): starting 4</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #4</div><div>rlm_sql_mysql: Starting connect to MySQL server for #4</div><div>rlm_sql (sql): Connected new DB handle, #4</div>
<div> Module: Checking preacct {...} for more modules to load</div><div> Module: Linked to module rlm_acct_unique</div><div> Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique</div>
<div> acct_unique {</div><div> key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"</div><div> }</div><div> Module: Checking accounting {...} for more modules to load</div><div>
Module: Linked to module rlm_detail</div><div> Module: Instantiating module "detail" from file /etc/freeradius/modules/detail</div><div> detail {</div><div> detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"</div>
<div> header = "%t"</div><div> detailperm = 384</div><div> dirperm = 493</div><div> locking = no</div><div> log_packet_header = no</div><div> }</div><div> Module: Linked to module rlm_radutmp</div>
<div> Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp</div><div> radutmp {</div><div> filename = "/var/log/freeradius/radutmp"</div><div> username = "%{User-Name}"</div>
<div> case_sensitive = yes</div><div> check_with_nas = yes</div><div> perm = 384</div><div> callerid = yes</div><div> }</div><div> Module: Linked to module rlm_attr_filter</div><div> Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter</div>
<div> attr_filter attr_filter.accounting_response {</div><div> attrsfile = "/etc/freeradius/attrs.accounting_response"</div><div> key = "%{User-Name}"</div><div> relaxed = no</div>
<div> }</div><div> Module: Checking session {...} for more modules to load</div><div> Module: Checking post-proxy {...} for more modules to load</div><div> Module: Checking post-auth {...} for more modules to load</div>
<div>
Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter</div><div> attr_filter attr_filter.access_reject {</div><div> attrsfile = "/etc/freeradius/attrs.access_reject"</div>
<div> key = "%{User-Name}"</div><div> relaxed = no</div><div> }</div><div> } # modules</div><div>} # server</div><div>server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel</div>
<div> modules {</div><div> Module: Checking authenticate {...} for more modules to load</div><div> Module: Checking authorize {...} for more modules to load</div><div> Module: Checking session {...} for more modules to load</div>
<div> Module: Checking post-proxy {...} for more modules to load</div><div> Module: Checking post-auth {...} for more modules to load</div><div> } # modules</div><div>} # server</div><div>radiusd: #### Opening IP addresses and Ports ####</div>
<div>listen {</div><div> type = "auth"</div><div> ipaddr = *</div><div> port = 0</div><div>}</div><div>listen {</div><div> type = "acct"</div><div> ipaddr = *</div><div>
port = 0</div><div>}</div><div>listen {</div><div> type = "auth"</div><div> ipaddr = 127.0.0.1</div><div> port = 18120</div><div>}</div><div> ... adding new socket proxy address * port 48747</div>
<div>Listening on authentication address * port 1812</div><div>Listening on accounting address * port 1813</div><div>Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel</div><div>Listening on proxy address * port 1814</div>
<div>Ready to process requests.</div><div><div>rad_recv: Access-Request packet from host 192.168.2.24 port 37360, id=33, length=151</div><div> Service-Type = Framed-User</div><div> Framed-Protocol = PPP</div>
<div> User-Name = "md5sonder"</div><div> MS-CHAP-Challenge = 0x0450cfc169281de4596f775878e83202</div><div> MS-CHAP2-Response = 0x50002036d573a3f3f443f0adaaf52b1557b300000000000000004fab1da0b14e7e7827768b24019d9c9e41dec2d11872bbad</div>
<div> Calling-Station-Id = "97.218.49.75"</div><div> NAS-IP-Address = 127.0.0.1</div><div> NAS-Port = 0</div><div># Executing section authorize from file /etc/freeradius/sites-enabled/default</div>
<div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>++[chap] returns noop</div><div>[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'</div><div>++[mschap] returns ok</div>
<div>++[digest] returns noop</div><div>[suffix] No '@' in User-Name = "md5sonder", looking up realm NULL</div><div>[suffix] No such realm "NULL"</div><div>++[suffix] returns noop</div><div>[eap] No EAP-Message, not doing EAP</div>
<div>++[eap] returns noop</div><div>[files] users: Matched entry DEFAULT at line 172</div><div>++[files] returns ok</div><div>[sql] expand: %{User-Name} -> md5sonder</div><div>[sql] sql_set_user escaped user --> 'md5sonder'</div>
<div>rlm_sql (sql): Reserving sql socket id: 4</div><div>[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'md5sonder' ORDER BY id</div>
<div>[sql] User found in radcheck table</div><div>[sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'md5sonder' ORDER BY id</div>
<div>[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'md5sonder' ORDER BY priority</div>
<div>rlm_sql (sql): Released sql socket id: 4</div><div>++[sql] returns ok</div><div>++[expiration] returns noop</div><div>++[logintime] returns noop</div><div>[pap] Normalizing MD5-Password from hex encoding</div><div>[pap] WARNING: Auth-Type already set. Not setting to PAP</div>
<div>++[pap] returns noop</div><div>Found Auth-Type = MSCHAP</div><div># Executing group from file /etc/freeradius/sites-enabled/default</div><div>+- entering group MS-CHAP {...}</div><div>[mschap] No Cleartext-Password configured. Cannot create LM-Password.</div>
<div>[mschap] No Cleartext-Password configured. Cannot create NT-Password.</div><div>[mschap] Creating challenge hash with username: md5sonder</div><div>[mschap] Told to do MS-CHAPv2 for md5sonder with NT-Password</div>
<div>
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.</div><div>[mschap] FAILED: MS-CHAP2-Response is incorrect</div><div>++[mschap] returns reject</div><div>Failed to authenticate the user.</div><div>Using Post-Auth-Type Reject</div>
<div># Executing group from file /etc/freeradius/sites-enabled/default</div><div>+- entering group REJECT {...}</div><div>[attr_filter.access_reject] expand: %{User-Name} -> md5sonder</div><div>attr_filter: Matched entry DEFAULT at line 11</div>
<div>++[attr_filter.access_reject] returns updated</div><div>Delaying reject of request 0 for 1 seconds</div><div>Going to the next request</div><div>Waking up in 0.6 seconds.</div><div>Sending delayed reject for request 0</div>
<div>Sending Access-Reject of id 33 to 192.168.2.24 port 37360</div><div> MS-CHAP-Error = "PE=691 R=1"</div><div>Waking up in 4.9 seconds.</div><div>Cleaning up request 0 ID 33 with timestamp +121</div><div>
Ready to process requests.</div></div><div><br></div>
</div></blockquote></div></div><blockquote type="cite"><div><span>-</span><br><span>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a></span></div>
</blockquote></div><br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br>
</div></div></blockquote></div><br>