May 2014 - Freeradius-Users - lists.freeradius.org

New RHEL and Fedora package maintainer
by Nikolai Kondrashov 23 May '14

23 May '14

Hi everyone, My name is Nikolai Kondrashov (Nick for short, aka spbnick) and I'm the new maintainer of FreeRADIUS packages for RHEL and Fedora, replacing John Dennis. I have actually started about mid-February, but was mostly learning and then had a string of colds, which kept me from working. John was and hopefully will be assisting me in learning further. In addition to being the package maintainer, I'll also participate in SSSD [1] development and will continue maintaining my DIGImend [2] project, when time allows. You can find my working background on LinkedIn [3]. I'd like to ask both users and the development team what you would like to see from Fedora and RHEL packaging of FreeRADIUS and from me as a maintainer. Please voice any concerns or suggestions you have and I will try to address them. Thank you. Nick [1] https://fedorahosted.org/sssd/ [2] http://digimend.sourceforge.net/ [3] https://www.linkedin.com/in/spbnick

7 16

User-Name case insensitive, spaces - freeradius 2.1.12
by Bruno Correia 23 May '14

23 May '14

Hi all, Usage freeradius 2.1.2 and i'm with problems about username authentication. Simply authentication accept any variations of the same username. Example: Register user: "var" Is accept: "Var" "vAr" "vaR" VaR" "VAr" "vAR" "var " ... This ends "bypassing" the blockage i do for multiple sessions with the same user. ( attribute Simultaneous-Use ) I noticed that the file */**path/freeradius/policy.conf* have the function with filters if to solve problem, but not function. The unique that works is filter space start. filter_username { # spaces at the start: reject if (User-Name =~ /^ /) { reject } * # spaces at the end: reject** ** if (User-Name =~ / $$/) {** ** reject** ** }* *# Mixed case: reject** ** if (User-Name != "%{tolower:%{User-Name}}") {** ** reject** ** }* } Appreciate the help. -- * * **Bruno G Correia** Analista de Redes <http://br.linkedin.com/in/brunocorr> (83) 8812-2235 (83) 9862-0224

2 3

RE: Subject: Package availability question
by Mike Poole 23 May '14

23 May '14

Debian Wheezy would be greatly appreciated if possible. We are stuck at 2.1.12 unless we can get an enterprise change to Ubuntu. Message: 1 Date: Fri, 23 May 2014 12:35:02 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Package availability question Message-ID: <537F78B6.2030803(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Nikolai Kondrashov wrote: > Unfortunately, I'm not able to provide builds outside the standard > channels, i.e. RHEL and Fedora repos. For everyone else, there is interest in packages, please let us know. We may be able to start an official "freeradius" repository. It could have packages for pretty much all common distributions. Alan DeKok. ------------------------------

1 0

Using FreeRadius to coordinate access to cisco routers based on time
by Frank Cui 23 May '14

23 May '14

Hi Radius People, I'm a new user on FreeRadius and recently considering using FreeRadius version 2 in our environment. Basically we are an education/training environment where we have some students accessing the routers and switches for practise, terminal server are used to consolidate the console access, and these terminal servers authenticate the users through a Radius server (as shown in the following figure). Additionally, the students are categorized into few groups. We want to implement policy on the radius server so that only a certain group can access the pod in a given duration of time (the user should be dropped from the terminal when the subscribed time is reached and cannot access thereafter .) +++++++++++++++ +++++++++++++++ ++++++++++++++ User +++++++++++++++++++++ Cisco 2600 +++++++++++++++++++ Network ++ + + Terminal Serv + + Devices ++++++++++++++++ +++++++++++++++ +++++++++++++ (NAS) + + +++++++++++++++ + FreeRadius + +++++++++++++++ Right now I'm able to do the "hello-world" setup with the following users and clients.conf. On the terminal server side, aaa new-model is enabled on the cisco terminal server to communicate with this radius server. users=============cisco Auth-Type := System Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" clients.conf==============client 192.168.1.1 { secret = SECRET_KEY shortname = termserver nastype = cisco} A typical transaction would be : Access-Request======= NAS-IP-Address = 192.168.1.1 NAS-Port = 35 NAS-Port-Type = Async User-Name = "cisco" Calling-Station-Id = "1.1.1.1" User-Password = "cisco" Access-Accept======= Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" However, this doesn't really provide any timing or grouping policy. Could you please provide some hints on how typically the timing limits are enforced with the freeradius and cisco terminal server? Thanks a lot in advance. ThanksFrank

2 5

FreeRADIUS 3.0.3: radtest with eap-md5
by Axel Luttgens 23 May '14

23 May '14

Hello, IIRC, I've seen somewhere some recent changes in FR 3's code due to bring back a working radeapclient. I thus tried: $ ./radtest -x -t eap-md5 bob hello 127.0.0.1 0 testing123 with FR 3.0.3, and just got following output: including dictionary file /Tests/freeradius-3.0.3-p1/share/freeradius/dictionary including dictionary file /Tests/etc/raddb/dictionary No single attempt to connect to the server seems to occur, since the output of radiusd -X remains desperately silent... On the other hand, eapol_test works as expected: $ ./eapol_test -c /Tests/etc/eap-md5.conf -s testing123 -n [...] MPPE keys OK: 0 mismatch: 0 SUCCESS with corresponding debugging info written by radiusd. Could it be that I'm doing something wrong? (hint: I often do) TIA, Axel

2 2

Wild Card GoDaddy cert
by Ryan De Kock 23 May '14

23 May '14

Hi, I have a wildcard cert from godaddy.com. I have tested the cert on Microsoft NPS & IAS and it works fine. I'm sure it will work in freeradius too, however I can't figure it out. I have godaddy.crt bundl.e.crt & godaddy.key. I have added these to freeradius however it does work. This is what windows does when I don't validate certificates [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 37 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied [peap] WARNING: No data inside of the tunnel. [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state ? [peap] FAILED processing PEAP: Tunneled data is invalid. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. } # server Cerebus This is a successfull auth on my linux client [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/godaddy.key certificate_file = ${certdir}/godaddy.crt dh_file = ${certdir}/dh random_file = ${certdir}/random } So Im not sure if its got to do with no using the cert chain or what I'm doing wrong but would appreciate any guidance

3 2

EAP, Cleartext-Password & rlm_perl
by Ryan De Kock 23 May '14

23 May '14

Hi, I'm trying to get the cleartext-password so that I can authenticate PEAP users via sql using my schema and run the current checks etc that I do. Current config is like this peap { default_eap_type = gtc copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } gtc { auth_type = PAP } default_eap_type = peap authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } eap dot1x #Perl script } when I run radius in debug i see this ++[pap] returns noop rlm_perl: PERL USERNAME bob rlm_perl: PERL PASSWORD rlm_perl: Added pair User-Name = bob rlm_perl: Added pair EAP-Message = 0x0209003e1a0209003931530ee491420e92dc30f422120c9b847d0000000000000000ce9f9b75dd8a20d8099c9e4458d6e8ffcd192f39189c1ed900626f62 rlm_perl: Added pair EAP-Type = MS-CHAP-V2 rlm_perl: Added pair State = 0x644e622a654778ceff71975630b5ff5d rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair Cleartext-Password = hello rlm_perl: Added pair Auth-Type = EAP rlm_perl: Added pair Proxy-To-Realm = LOCAL So the perl script has access to "Cleartext-Password" thanks to GTC I think but I cant log it in perl. The script literally only does this currently &radiusd::radlog(1,"PERL USERNAME " . $RAD_REQUEST{'User-Name'}); &radiusd::radlog(1,"PERL PASSWORD " . $RAD_REQUEST{'Cleartext-Password'}); How can I get the Cleartext-Password in rlm_perl?

4 5

FreeRADIUS, OpenLDAP and F5 VSAs
by Ajinkya Fotedar 23 May '14

23 May '14

Hi, I am trying to send F5 vendor-specific attributes in the Access-Accept packet. When freeradius (ldap module) searches and finds a specific user in openldap, It processes the user's attributes and adds them to the control list. One of the attributes specifies the group that user account belongs to. The next step is to find that user in the specified group, which is successful. Only this time, there are some F5 VSAs that are not getting added to the reply list. When I pass those VSAs in the Access-Accept packet, I see them as Attr-26 = 0x00000d2f I have read the rlm_ldap and related documentation on the wiki. I am not sure why I don't see the value of F5 VSAs in the reply as I can definitely process the attributes defined for a user account under the People subtree. Below is the debug output and some configuration. Can anyone point me to the right direction. Thank you. *RADIUS debug* Ready to process requests. rad_recv: Access-Request packet from host 198.82.169.55 port 52634, id=78, length=132 User-Name = 'dawson' NAS-IP-Address = 198.82.169.55 NAS-Port = 234234 Message-Authenticator = 0x9552e405f519c05100b3510ad97bcec0 MS-CHAP-Challenge = 0x9dcbb5409eb06d58 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000dcc9a916ce5fc5419b592ba3be3e116831d411dc6e454c81 (0) # Executing section authorize from file /apps/home/radius/freeradius/load-balancing/etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) ? if (User-Name != "%{tolower:%{User-Name}}") (0) expand: "%{tolower:%{User-Name}}" -> 'dawson' (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE (0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE (0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) ? if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE (0) ? if (User-Name =~ /(a)\\./) (0) ? if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) auth_log : expand: "/apps/home/radius/freeradius/load-balancing/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" -> '/apps/home/radius/freeradius/load-balancing/var/log/radius/radacct/ 198.82.169.55/auth-detail-20140519' (0) auth_log : /apps/home/radius/freeradius/load-balancing/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /apps/home/radius/freeradius/load-balancing/var/log/radius/radacct/ 198.82.169.55/auth-detail-20140519 (0) auth_log : expand: "%t" -> 'Mon May 19 14:55:25 2014' (0) [auth_log] = ok (0) update control { (0) expand: "uid=%{User-Name},ou=People,ou=NIS,o=vt" -> 'uid=dawson,ou=People,ou=NIS,o=vt' (0) Ldap-UserDn := "uid=dawson,ou=People,ou=NIS,o=vt" (0) } # update control = noop rlm_ldap (ldap): Reserved connection (4) (0) ldap : expand: "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}}))" -> '(&(uid=dawson))' (0) ldap : expand: "ou=People,ou=NIS,o=vt" -> 'ou=People,ou=NIS,o=vt' (0) ldap : Performing search in 'ou=People,ou=NIS,o=vt' with filter '(&(uid=dawson))' (0) ldap : Waiting for search result... (0) ldap : User object found at DN "uid=dawson,ou=People,ou=NIS,o=vt" (0) ldap : Processing user attributes (0) ldap : control:Password-With-Header += '{nt}D3055AE4C0D68D8BA71C538D1518B5CD' (0) ldap : control:Password-With-Header += '{SSHA}omkfyFmnMrEq1jWG9T86Gh+XlpR87z11' (0) ldap : control:Prohibited := FALSE (0) ldap : control:Group-Membership := 'cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt' (0) ldap : control:Group-Membership := 'cn=TLOS,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt' rlm_ldap (ldap): Released connection (4) (0) [-ldap] = ok (0) pap : Normalizing NT-Password from hex encoding (0) pap : Normalizing SSHA1-Password from base64 encoding (0) pap : No clear-text password in the request. Not performing PAP. (0) [pap] = noop (0) mschap : Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (0) [mschap] = ok (0) ? if (!(control:NT-Password) || control:Prohibited == TRUE) (0) ? if (!(control:NT-Password) || control:Prohibited == TRUE) -> FALSE (0) ? if (Ldap-Group != "%{control:Group-Membership}") (0) expand: "%{control:Group-Membership}" -> 'cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt' (0) Searching for user in group "cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt" rlm_ldap (ldap): Reserved connection (4) (0) Using user DN from request "uid=dawson,ou=People,ou=NIS,o=vt" (0) Checking for user in group objects (0) expand: "(&(objectClass=f5Group)(member=%{control:Ldap-UserDn}))" -> '(&(objectClass=f5Group)(member=uid\3ddawson\2cou\3dPeople\2cou\3dNIS\2co\3dvt))' (0) Performing search in 'cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt' with filter '(&(objectClass=f5Group)(member=uid\3ddawson\2cou\3dPeople\2cou\3dNIS\2co\3dvt))' (0) Waiting for search result... (0) User found in group object rlm_ldap (ldap): Released connection (4) (0) ? if (Ldap-Group != "%{control:Group-Membership}") -> FALSE (0) else else { (0) update reply { (0) expand: "%{reply:F5-LTM-User-Info-1}" -> '' (0) F5-LTM-User-Info-1 := "" (0) expand: "%{reply:F5-LTM-User-Role}" -> '' (0) F5-LTM-User-Role := Administrator (0) expand: "%{reply:F5-LTM-User-Partition}" -> '' (0) F5-LTM-User-Partition := "" (0) expand: "%{reply:F5-LTM-User-Shell}" -> '' (0) F5-LTM-User-Shell := "" (0) } # update reply = noop (0) } # else else = noop (0) ? if ("%{reply:F5-LTM-User-Info-1}") (0) expand: "%{reply:F5-LTM-User-Info-1}" -> '' (0) ? if ("%{reply:F5-LTM-User-Info-1}") -> FALSE (0) } # authorize = ok (0) Found Auth-Type = MSCHAP (0) # Executing group from file /apps/home/radius/freeradius/load-balancing/etc/raddb/sites-enabled/default (0) authenticate { (0) mschap : No Cleartext-Password configured. Cannot create LM-Password (0) mschap : Found NT-Password (0) mschap : Client is using MS-CHAPv1 with NT-Password (0) mschap : adding MS-CHAPv1 MPPE keys (0) [mschap] = ok (0) } # authenticate = ok (0) WARNING: Empty post-auth section. Using default return values. (0) # Executing section post-auth from file /apps/home/radius/freeradius/load-balancing/etc/raddb/sites-enabled/default Sending Access-Accept of id 78 from 198.82.169.55 port 1830 to 198.82.169.55 port 52634 F5-LTM-User-Info-1 = '' F5-LTM-User-Role = Administrator F5-LTM-User-Partition = '' F5-LTM-User-Shell = '' MS-CHAP-MPPE-Keys = 0x0000000000000000122d083be857e0cf1f5c975f5efd01cc0000000000000000 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (0) Finished request 0. Waking up in 0.3 seconds. Waking up in 4.6 seconds. *radtest* $ radtest -t mschap -x dawson wakkawakka 198.82.169.55:1830 234234 testing123 /apps/radius/freeradius-3.0.1/bin/radclient: /usr/local/samba/lib/libtalloc.so.2: no version information available (required by /apps/radius/freeradius-3.0.1/bin/radclient) /apps/radius/freeradius-3.0.1/bin/radclient: /usr/local/samba/lib/libtalloc.so.2: no version information available (required by /apps/radius/freeradius-3.0.1/lib/libfreeradius-radius.so) Sending Access-Request of id 78 from 0.0.0.0 port 52634 to 198.82.169.55 port 1830 User-Name = 'dawson' NAS-IP-Address = 198.82.169.55 NAS-Port = 234234 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x9dcbb5409eb06d58 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000dcc9a916ce5fc5419b592ba3be3e116831d411dc6e454c81 Code: 1 Id: 78 Length: 132 Vector: 1e35220367d4329bdebec2d38afe7fd6 Data: 01 08 64 61 77 73 6f 6e 04 06 c6 52 a9 37 05 06 00 03 92 fa 50 12 95 52 e4 05 f5 19 c0 51 00 b3 51 0a d9 7b ce c0 1a 10 00 00 01 37 0b 0a 9d cb b5 40 9e b0 6d 58 1a 3a 00 00 01 37 01 34 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc c9 a9 16 ce 5f c5 41 9b 59 2b a3 be 3e 11 68 31 d4 11 dc 6e 45 4c 81 rad_recv: Access-Accept packet from host 198.82.169.55 port 1830, id=78, length=114 Code: 2 Id: 78 Length: 114 Vector: e1389574bdb00555d937ba3d5fac91d7 Data: 1a 06 00 00 0d 2f 1a 0c 00 00 0d 2f 01 06 00 00 00 00 1a 06 00 00 0d 2f 1a 06 00 00 0d 2f 1a 28 00 00 01 37 0c 22 1d 16 9c ca 93 1c 0f eb 35 cd 73 0b ac 58 5c 61 81 2a d8 a6 81 3e bb 70 4a ce 98 0e d8 d5 d9 d3 1a 0c 00 00 01 37 07 06 00 00 00 01 1a 0c 00 00 01 37 08 06 00 00 00 06 Attr-26 = 0x00000d2f F5-LTM-User-Role = Administrator Attr-26 = 0x00000d2f Attr-26 = 0x00000d2f MS-CHAP-MPPE-Keys = 0x MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed *LDAP module* user { base_dn = "ou=People,${..base_dn}" filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}}))" scope = 'sub' } group { base_dn = "ou=Groups,ou=F5,ou=Configuration,${..base_dn}" filter = "(objectClass=f5Group)" scope = 'base' name_attribute = cn membership_filter = "(member=%{control:Ldap-UserDn})" } *Default server* authorize { filter_username preprocess auth_log update control{ Ldap-UserDn := "uid=%{User-Name},ou=People,ou=NIS,o=vt" } -ldap pap mschap #Invalid People if(!(control:NT-Password) || control:Prohibited == TRUE){ update control{ Auth-Type := Reject } } #"%{control:Group-Membership}" if(Ldap-Group != "%{control:Group-Membership}"){ update control{ Auth-Type:=Reject } } else{ update reply{ F5-LTM-User-Info-1 := "%{reply:F5-LTM-User-Info-1}" F5-LTM-User-Role := "%{reply:F5-LTM-User-Role}" F5-LTM-User-Partition := "%{reply:F5-LTM-User-Partition}" F5-LTM-User-Shell := "%{reply:F5-LTM-User-Shell}" } } } authenticate { mschap pap } *OpenLDAP Entries* # dawson, People, NIS, vt dn: uid=dawson,ou=People,ou=NIS,o=vt cn: Jacob M. Dawson uid: dawson sn: Dawson givenName: Jacob groupMembership: cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt prohibited: FALSE objectClass: inetOrgPerson objectClass: nisUserAccount # R&D, Groups, F5, Configuration, NIS, vt dn: cn=R&D,ou=Groups,ou=F5,ou=Configuration,ou=NIS,o=vt cn: R&D description: Entiries for the R&D group user accounts userInfo: R&D userPartition: RnD userRole: 100 userShell: tmsh member: uid=dawson,ou=People,ou=NIS,o=vt objectClass: f5Group objectClass: groupOfNames

3 7

radiusReplyItem attribute
by free.aaa 23 May '14

23 May '14

Hi all! In some documentations there are references to radiusReplyItem ldap attribute. However freeradius schema file does not contain it. I wonder do I have to add it manually or the docs are outdated and I need to use something else? freeradius-3.0.3 Thanks!

2 2

Framed-IP-Address not sent to ASA/NAS in proxy mode
by Aleksander Roer Olsen 22 May '14

22 May '14

Hi Setup: Cisco ASA (NAS) -> FRAD -> MS-NPS -> Active Directory I having some issues with one aspect of this setup. I am trying to make the Framed-IP-Address received back from the NPS be forwarded back to the ASA in the same Access-Accept packet as the Class value (Group Policy name) is being sent. Based on the debug below, we see that the static IP defined in a users object is returned to FR, but it is not being taken into account and added to the next part. If I remove the static IP from the Active Directory user object, the Framed-IP-Address is not returned to the FR by the NPS as expected. If i define in sites-enabled/default update reply { Framed-IP-Address = "10.42.7.150" } the Access-Accept packet is updated and the ASA hands out the IP to the VPN client. I also tried to define a update reply like this without success: update reply { Framed-IP-Address = "%{ Framed-IP-Address }" } No matter in what section I placed this in the sites-enabled/default file, it had a null value and returned the error: "ERROR: Failed parsing value "" for attribute Framed-IP-Address: Failed to find IP address for". I know too little about running querys / variables like this, so I'm clueless. The the other aspect, the dynamic ip pool which is setup on the ASA, works as a fallback when the Framed-IP-Address is not sent in the Access-Accept packet. In other words, this works as expected and is OK. I've spent good few days (read weeks) trying to find the solution myself, with several clean setups, but I simply can't get it to work. I hope some of you have done this and know what my issue might be with my configuration. I've touched very little of the default config, apart from adding the config below. There has been no change to any dictionary files either. Thank you very much in advance Regards Aleksander =============== freeradius -v freeradius: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Dec 16 2012 at 13:28:43 =============== freeradius/proxy.conf =============== home_server domain.dco1 { type = auth ipaddr = 192.168.1.10 port = 1812 secret = pass require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 } home_server_pool domain_pool { type = fail-over home_server = domain.dco1 } realm "domain.com" { strip auth_pool = domain_pool # acct_pool = LOCAL } =============== freeradius/users: default config =============== freeradius/sites-enabled/default: Uncommented attr_filter.post-proxy in the post-proxy section to get freeradius/attrs to work. =============== freeradius/attrs: =============== domain.com Class := "ou=domain.com-GP" DEFAULT Service-Type == Framed-User, Service-Type == Login-User, Login-Service == Telnet, Login-Service == Rlogin, Login-Service == TCP-Clear, Login-TCP-Port <= 65536, Framed-IP-Address == 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Protocol == PPP, Framed-Protocol == SLIP, Framed-Compression == Van-Jacobson-TCP-IP, Framed-MTU >= 576, Framed-Filter-ID =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, MS-CHAP-MPPE-Keys =* ANY, State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Port-Limit <= 2 =============== DEBUG ON CONN (let me know if this output doesn't cover the needed insight) =============== 3.3.3.3 = ASA 192.168.1.10 = NPS [.....] WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 74 to 192.168.1.10 port 1812 User-Name = "test" User-Password = "test" NAS-Port = 200704 Called-Station-Id = "1.1.1.1" Calling-Station-Id = "2.2.2.2" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "2.2.2.2" NAS-IP-Address = 3.3.3.3 Cisco-AVPair = "ip:source-ip=2.2.2.2" Vendor-3076-Attr-146 = 0x44656661756c7457454256504e47726f7570 Vendor-3076-Attr-150 = 0x00000002 Proxy-State = 0x3534 Proxying request 0 to home server 192.168.1.10 port 1812 Sending Access-Request of id 74 to 192.168.1.10 port 1812 User-Name = "test" User-Password = "test" NAS-Port = 200704 Called-Station-Id = "1.1.1.1" Calling-Station-Id = "2.2.2.2" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "2.2.2.2" NAS-IP-Address = 3.3.3.3 Cisco-AVPair = "ip:source-ip=2.2.2.2" Vendor-3076-Attr-146 = 0x44656661756c7457454256504e47726f7570 Vendor-3076-Attr-150 = 0x00000002 Proxy-State = 0x3534 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 192.168.1.10 port 1812, id=74, length=88 Proxy-State = 0x3534 Framed-Protocol = PPP Service-Type = Framed-User Framed-IP-Address = 10.42.7.150 Class = 0xacf7099d0000013700010200ac12e01a0000000058e653601a8d0a8101cf70306d8babb900000000000000bc # Executing section post-proxy from file /etc/freeradius/sites-enabled/default +- entering group post-proxy {...} [attr_filter.post-proxy] expand: %{Realm} -> domain.com attr_filter: Matched entry domain.com at line 103 ++[attr_filter.post-proxy] returns updated [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 54 to 3.3.3.3 port 48206 Class := 0x6f753d566f6963652e6e6f2d4755 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 54 with timestamp +18 Ready to process requests.

4 6