July 2012 - Freeradius-Users - lists.freeradius.org

sql returns fail for some stop requests
by Amir Tal 11 Jul '12

11 Jul '12

Freeradius ver 2.1.12, configured to use ldap for auth, sql for acct. Sometimes users' sessions get stuck and have to be closed manualy (simultaneous use is turned on for all users). After extensive debugging I have found the following in the logs (radius -X) [<thread>] # Executing section preacct from file /etc/raddb/sites-enabled/default [<thread>] +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 14117776,Client-IP-Address = xx.xx.xx.xx,NAS-IP-Address = xx.xx.xx.xx,Acct-Session-Id = "erx ip:109.226.0.9:147.235.234.115:1e47:6248:14c2:8b6a:5dac845:0060992452",Use r-Name = "xxxxxxxxx@ccc"' [acct_unique] Acct-Unique-Session-ID = "d49ba42fa077f5f0". ++[acct_unique] returns ok [suffix] Looking up realm "ccc" for User-Name = "xxxxxxxxx@ccc" [suffix] Found realm "ccc" [suffix] Adding Stripped-User-Name = "xxxxxxxxx" [suffix] Adding Realm = "ccc" [suffix] Accounting realm is LOCAL. ++[suffix] returns ok ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> xx.xx.xx.xx [detail] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/xx.xx.xx.xx/detail-20120711 [detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/xx.xx.xx.xx/detail-20120711 [detail] expand: %t -> Wed Jul 11 02:03:45 2012 Cleaning up request 12612249 ID 93 with timestamp +729235 ++[detail] returns ok [detail.moreshet] expand: /var/log/radius/radacct/moreshet.relay -> /var/log/radius/radacct/moreshet.relay [detail.moreshet] /var/log/radius/radacct/moreshet.relay expands to /var/log/radius/radacct/moreshet.relay [detail.moreshet] expand: %t -> Wed Jul 11 02:03:45 2012 ++[detail.moreshet] returns ok ++[unix] returns ok [sql] expand: %{Stripped-User-Name} -> xxxxxxxxx [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> xxxxxxxxx [sql] sql_set_user escaped user --> 'xxxxxxxxx' [sql] expand: %{Acct-Input-Gigawords} -> 0 [sql] expand: %{Acct-Input-Octets} -> 4001 [sql] expand: %{Acct-Output-Gigawords} -> 0 [sql] expand: %{Acct-Output-Octets} -> 8134 [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}' -> UPDATE radacct SET acctstoptime = '2012-07-11 02:03:45', acctsessiontime = '517', acctinputoctets = '0' << 32 | '4001', acctoutputoctets = '0' << 32 | [sql] expand: /var/log/radius/sqltrace.sql -> /var/log/radius/sqltrace.sql Cleaning up request 12612250 ID 95 with timestamp +729235 ++[sql] returns fail Thread 20 got semaphore Thread 19 got semaphore It seems the last SQL query line is cut off for some reason, this only happens on some connections, while others are stopped correctly. Not specific to users or time of day. Versions information: cat /etc/issue : CentOS release 5.6 (Final) Kernel \r on an \m rpm -qa | grep radius : freeradius2-python-2.1.12-7 freeradius2-ldap-2.1.12-7 freeradius2-2.1.12-7 freeradius2-krb5-2.1.12-7 freeradius2-mysql-2.1.12-7 freeradius2-utils-2.1.12-7 freeradius2-postgresql-2.1.12-7 freeradius2-perl-2.1.12-7 freeradius2-unixODBC-2.1.12-7 additional logs and/or information can be provided if required. Help would be appreciated. The Cloud has no limit ! [cid:image001.jpg@01CD5F84.25487600]<http://www.ccc.co.il/> Amir Tal Systems Automation Expert Cloud Services Direct: 972-(0)3-9201471 Fax: 972-(0)-3-9201442 www.ccc.co.il<http://www.ccc.co.il/> [cid:image002.png@01CD5F84.25487600] <http://www.facebook.com/triplec.il>

2 1

Re: Secure Storage and Transport of User Credentials
by Marco Macala 11 Jul '12

11 Jul '12

Hello, is there a way to securely transport and store the Username/Password with freeradius? If I am informed correctly, you can use PEAP to ensure that the data is encrypted but the most supported PEAP mode is with MSCHAPv2 which implies that the passwords are stored in clear text or NT-Hash. Did I get something wrong here? I am fairly new to RADIUS and therefore I don't know that much about it... Thanks in advance! Best regards, Marco Macala

4 8

dalo(free)radius authentication problem
by Soul - 11 Jul '12

11 Jul '12

Dear ALL i was follow the guide from the following page with the command, but when testing, the Radius server is not responding. For the setup on the Ubuntu newest server.. -sudo apt-get update -sudo apt-get upgrade -sudo apt-get install mysql-server -sudo apt-get install php5-gd php-pear php-db -sudo apt-get install freeradius freeradius-mysql -sudo apt-get install phpmyadmin On the DaloRadius Setup -wget ...... 9-9.tar.gz -tar -zxvf daloradius-0.9-9.tar.gz -mv daloradius-0.9-9 daloradius -sudo cp daloradius/ /var/www -R -sudo chown www-data:www-data /var/www/daloradius -R -sudo chmod 644 /var/www/daloradius/library/daloradius.conf.php Database setup: -cd /var/www/daloradius/contrib/db/ - Ignored: -mysql -u root -p Enter 'mySqlPassword' mysql> CREATE DATABASE radius; mysql> quit - Ignored: -mysql -u root -p radius < fr2-mysql-daloradius-and-freeradius.sql Database connection setup: -cd /var/www/daloradius/library/ -sudo nano -w daloradius.conf.php $configValues['FREERADIUS_VERSION'] = '2'; $configValues['CONFIG_DB_PASS'] = 'mySqlPassword'; $configValues['CONFIG_DB_TBL_RADUSERGROUP'] = 'radusergroup'; Installation completed and login page to create user: -http://your ip address/daloradius username: administrator password: radius When i test it shown not respond from the server.. the NAS setting is matched, refer to the log file from the Daloradius, it shown "Error: Ignoring request to authentication address" could it be due to the setup error or? as refer to the guidance from the web, the setup everything is run well, using the freeradius -x, it shown.. ~Listening on authentication interface eth0 *port 1812 ~Listening on accounting *port 1813 ~Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel ~Ready to process request. what could be wrong and which part should i check on it? router debugging exsist: R1# *Mar 1 00:03:05.639: AAA/BIND(00000003): Bind i/f *Mar 1 00:03:05.643: AAA/AUTHEN/LOGIN (00000003): Pick method list 'default' *Mar 1 00:03:05.651: RADIUS/ENCODE(00000003): ask "Username: " *Mar 1 00:03:05.651: RADIUS/ENCODE(00000003): send packet; GET_USER R1# *Mar 1 00:03:07.359: RADIUS/ENCODE(00000003): ask "Password: " *Mar 1 00:03:07.363: RADIUS/ENCODE(00000003): send packet; GET_PASSWORD *Mar 1 00:03:08.795: RADIUS/ENCODE(00000003):Orig. component type = EXEC *Mar 1 00:03:08.799: RADIUS: AAA Unsupported Attr: interface [174] 5 *Mar 1 00:03:08.799: RADIUS: 74 74 79 [tty] *Mar 1 00:03:08.799: RADIUS/ENCODE(00000003): dropping service type, "radius-server attribute 6 on-for-login-auth" is off *Mar 1 00:03:08.803: RADIUS(00000003): Config NAS IP: 0.0.0.0 *Mar 1 00:03:08.803: RADIUS/ENCODE(00000003): acct_session_id: 1 *Mar 1 00:03:08.803: RADIUS(00000003): sending *Mar 1 00:03:08.807: RADIUS/ENCODE: Best Local IP-Address 192.168.44.1 for Radius-Server 192.168.44.129 *Mar 1 00:03:08.811: RADIUS(00000003): Send Access-Request to 192.168.44.129:1645 id 1645/1, len 84 *Mar 1 00:03:08.811: RADIUS: authenticator 7D F1 9D 12 60 81 DE 8C - FC 0B A4 96 E1 CD 71 E8 *Mar 1 00:03:08.811: RADIUS: User-Name [1] 6 "test" *Mar 1 00:03:08.815: RADIUS: User-Password [2] 18 * *Mar 1 00:03:08.815: RADIUS: NAS-Port [5] 6 98 *Mar 1 00:03:08.815: RADIUS: NAS-Port-Id [87] 7 "tty98" *Mar 1 00:03:08.815: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Mar 1 00:03:08.819: RADIUS: Calling-Station-Id [31] 15 "192.168.44.10" *Mar 1 00:03:08.819: RADIUS: NAS-IP-Address [4] 6 192.168.44.1 R1# R1# *Mar 1 00:03:13.559: RADIUS: Retransmit to (192.168.44.129:1645,1646) for id 1645/1 R1# *Mar 1 00:03:18.551: RADIUS: Retransmit to (192.168.44.129:1645,1646) for id 1645/1 R1# *Mar 1 00:03:23.223: RADIUS: Retransmit to (192.168.44.129:1645,1646) for id 1645/1 R1# *Mar 1 00:03:27.895: RADIUS: No response from (192.168.44.129:1645,1646) for id 1645/1 *Mar 1 00:03:27.895: RADIUS/DECODE: No response from radius-server; parse response; FAIL *Mar 1 00:03:27.895: RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL thanks and appreciate it..

2 1

ldap attribute
by sandmann＠uni-greifswald.de 11 Jul '12

11 Jul '12

Hello, i want to get different attribute from ldap. Something like "cn". Is this possible and where must be set it? Mit freundlichen Grüßen David Sandmann *************************************** Fachinformatiker für Systemintegration Ernst-Moritz-Arndt-Universität Rechenzentrum Felix-Hausdorff-Straße 12 17489 Greifswald www.rz.uni-greifswald.de +49 3834 86 1424 +49 3834 86791424 sandmann(a)uni-greifswald.de ***************************************

1 0

Not responding when a user is unknown
by perl-list 10 Jul '12

10 Jul '12

We have a couple customers whose FreeRADIUS servers do not respond if a user does not exist on their FreeRADIUS system. If a user authenticates using username: idontexist and password: notarealpass the FreeRADIUS server does NOT send an access denied response, and indeed sends no response at all. I vaguely remember that this may have been an available setting on FreeRADIUS, but can find no information about it on the internet. I have been unable to recreate this problem in our lab and the customers who administer these servers seem to be unable to find any explanation. Please note I have no access to the servers that this happens on. The servers are owned by customers of ours. So basically, is there a setting that causes the FreeRADIUS server to not respond to Access-Request packets if the username contained there-in is not found in whatever database it is using?

4 5

Active Directory Authentication problem with ppp
by madal 30 10 Jul '12

10 Jul '12

hello all, I am always getting this error, when I am trying to authenticate user against Active Directory ad_recv: Access-Request packet from host 127.0.0.1 port 54512, id=249, length=151 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "harry" MS-CHAP-Challenge = 0x7437d73ff6b61e500d046b77a88ecf34 MS-CHAP2-Response = 0x3f0098a0a16cb193cbb58c495977aa125765000000000000000073a5f468c08966d100e3963f8763bcb764d450f23800cade Calling-Station-Id = "192.168.1.1" NAS-IP-Address = 192.168.2.3 NAS-Port = 0# Executing section authorize from file /etc/raddb/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'++[mschap] returns ok++[digest] returns noop[suffix] No '@' in User-Name = "harry", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] No EAP-Message, not doing EAP++[eap] returns noop[files] users: Matched entry DEFAULT at line 172++[files] returns ok++[expiration] returns noop++[logintime] returns noop[mschap] No Cleartext-Password configured. Cannot create LM-Password.[mschap] No Cleartext-Password configured. Cannot create NT-Password.[mschap] Creating challenge hash with username: harry[mschap] Told to do MS-CHAPv2 for harry with NT-Password[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.[mschap] FAILED: MS-CHAP2-Response is incorrect Pacakages I have installed.samba.x86_64samba-client.x86_64samba-common.x86_64 samba-winbind.x86_64 samba-winbind-clients.x86_64 freeradius.x86_64radiusclient-ng-0.5.6-5.el6.x86_64 My /etc/pptp/option.pptpd is : name pptpdrefuse-paprefuse-chaprefuse-mschaprequire-mschap-v2require-mppe-128ms-dns 10.1.1.1proxyarpdebuglocknobsdcompnovjnovjccompnologfdauthnodefaultrouteplugin winbind.so#ntlm_auth-helper "/usr/bin/ntlm_auth --helper-protocol=ntlm-server-1"plugin radius.soplugin radattr.so And in /etc/radd/modules/mschap i have following mschap { use_mppe = yes require_encryption =yes require_strong = yes #with_ntdomain_hack = yesntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-none}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"} AD connection is working well, if I do wbinfo -u it returns users from the AD. Both samba, nmb and winbind services are running. If I use only winbind without radius plugin it work but when I try to use radius plugin it complains the error I mentioned above. I have following this :http://wiki.freeradius.org/PopTop#Setting-up-the-Poptop-server and this one :http://www.members.optushome.com.au/~wskwok/poptop_ads_howto_8.htm All I am doing here is have a pptp server use radius and Active directory for authentication. I use freeraius so that I can do IP pool and other stuff. Any help or right direction would be great.

2 2

working with vouchers
by anmeyer＠anup.de 10 Jul '12

10 Jul '12

Hello! Without considering any security is it possible to hand out a voucher to a client with just the ESSID, the username and the password written down and this client can authenticate to the radiusserver over the authenticator? Please be patient with me! Andreas

5 7

(no subject)
by Stephane Brodeur 09 Jul '12

09 Jul '12

http://testfartu.yoyo.pl/pscda.html?utkk=qqapeu

1 0

Re: working with vouchers
by Alan Buxey 09 Jul '12

09 Jul '12

Yrs, if you don't care about security and verification of server cert, then just username and password will work with PEAP. Some clients will throw up warning messages (that users ignore)..messages can be reduced by using a CA that is known by the clients. The above is not best practice under any security front alan

3 2

Debug/Freeradius help
by Justin Huckabay 09 Jul '12

09 Jul '12

Hello, I'm setting up freeradius for the first time and I am having an issue with the "radtest testing password localhost 0 testing123" I am getting "radclient: no response from server for ID 2 socket 3" I have ran the freeradius debugging output and below are the 2 highlighted errors it shows as well as the full debug, I'm unsure on how to fix these 2 errors so we can move forward.... and yes I know next to nothing so if i'm doing anything obviously wrong feel free to bash me about it! "reject_delay = 1" is what is showing as the error the rest is for context. } security { max_attributes = 200 reject_delay = 1 status_server = yes } Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" root@localhost administrator]# radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jul 19 2011 at 10:16:18 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/filesroot@localhost administrator]# radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jul 19 2011 at 10:16:18 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 1645 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address 127.0.0.1 port 1645 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1313 Ready to process requests. including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 1645 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address 127.0.0.1 port 1645 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1313 Ready to process requests.

2 1