May 2015 - Freeradius-Users - lists.freeradius.org

Accounting for cisco aironet
by Sautron Nick 06 May '15

06 May '15

Hello everyone, I have a problem with the accounting of HotSpots aironet cisco. The problem is that the data is fitted into the table "radpostauth" therefore I do not have all the information of accounting. Normally given should be inserted into the table "radacct" I have configured the sql.conf file, and well create the database. Have you ever encountered this problem? How to solve it? Best regards S.Nick

2 1

Getting Simultaneous-Use users to share bandwidth
by Joshua Ocero 05 May '15

05 May '15

Hello, I am using freeradius-server-2.1.0 and have an issue that I need help with. I have a Simultaneous-Use attribute set in radcheck table to 5 to allow for that number of users sharing one username. I have also set WISPr-Bandwidth-Max-Down and WISPr-Bandwidth-Max-Up to 2048000 to cap data usage to that much. However I note is that each simultaneous user is allowed the entire 2048000 bandwidth. How can I configure the server to have all simultaneous users with the same username limited to the same WISPr-Bandwidth-Max-Up/Down value (2048000 in my case)? Thanks.

2 1

Re: Integrate Freeradius with DHCP (Alan DeKok)
by Rui Ribeiro 05 May '15

05 May '15

Hi, As Alan said not simple. It could be very well possible to work it out with unlang, MySql and/or an external script to talk via OMAPI to an ISC BIND. It would be a very ugly hack. Besides that, abandoning immediately an IP in a wireless infra-structure might not be a very good idea for several reasons IMO. Regards, > 1. Re: Integrate Freeradius with DHCP (Alan DeKok) > > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 4 May 2015 08:02:25 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Integrate Freeradius with DHCP > Message-ID: <53EF4299-FB51-4B23-8CBA-E202ED817C8B(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On May 4, 2015, at 12:20 AM, Mohd Alkhaldi <alwaadalhaq(a)gmail.com> wrote: > > We have multiple Radius servers, How can we get Framed-Ip-Address from > > central DHCP server, and release the IP when receive Accounting Stop. > > There's no simple way to do this right now. > > Alan DeKok. > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

3 2

Access-Reject based on internet usage?
by Bacsó Márton Károly 05 May '15

05 May '15

Dear FreeRadius users! I work in a secondary school in Hungary. We are trying to achieve complete WiFi coverage in the building with several TP-LINK WA901ND APs (running OpenWRT 14.07). I have successfully installed Freeradius 2.1.12 and Daloradius 0.9-9 on a Raspberry Pi B+. The system works great with many freeradius check attributes, but I have failed to implement any kind of usage limit based on downloads or uploads. The AP sends the neccessary information to the server, because I can see daily/weekly/monthly/total internet usage statistics , but even if a user is over their quota the system gives them Access-Accept message. I know that without any captive portals, I won't be able to work with most of the reply attributes, but that is not I want to achieve. All I want is an Access-Reject message to the AP. (and to make my wish even more simple the 4Gb limit is enough for me) I am really newbie with Linux, so forgive me if I write anything stupid. What I already tried is to follow the way I did with time based logins and add the following lines to these files. ****************************************** *** modules/Counter *** counter maxmonthlydownload { filename = ${db_dir}/db.maxmonthlydownload key = User-Name count-attribute = Acct-Output-Octets reset = monthly counter-name = Monthly-Output-Octets check-name = CS-Output-Octets-Monthly cache-size = 5000 } counter maxmonthlyupload { filename = ${db_dir}/db.maxmonthlyupload key = User-Name count-attribute = Acct-Input-Octets reset = monthly counter-name = Monthly-Input-Octets check-name = CS-Input-Octets-Monthly cache-size = 5000 } *** sql/mysql/counter.conf *** sqlcounter maxmonthlydownloadcounter { counter-name = Monthly-Output-Octets check-name = CS-Output-Octets-Monthly sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT IFNULL(SUM(AcctOutputOctets),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter maxmonthlyuploadcounter { counter-name = Monthly-Input-Octets check-name = CS-Input-Octets-Monthly sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT IFNULL(SUM(AcctInputOctets),0) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } *** sites-available/default *** maxmonthlydownload maxmonthlyupload ****************************************** Unfortunately it doesn't work. When I test the user name in the terminal window it gives Access-Accept, no matter what. What is interesting is that when I add any session time attributes I can see that in the terminal under Access-Accept message, but with Octets there is nothing. Any help would be appreciated! Márton Bacsó Bacsó Márton Károly bacsom(a)hotmail.com M.: +36 20 3315753 http://digilecke.com http://www.bacsomarton.com

1 0

accounting data to syslog
by Munroe Sollog 04 May '15

04 May '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 radiusd: FreeRADIUS Version 2.1.12, for host x86_64-redhat-linux-gnu, built on Oct 15 2014 at 05:01: 25 I have configured the linelog module to use syslog, however accounting data is still being directed to the files /var/radact/<ipaddress>/detail-<date>. Any help would be appreciated. Thanks. I have included my linelog file for reference: linelog { filename = syslog permissions = 0644 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" Access-Request = "Requested access: %{User-Name}" Access-Reject = "Rejected access: %{User-Name}" Access-Challenge = "Sent challenge: %{User-Name}" foo { bar = "Example log. Please ignore" } Accounting-Request { Start = "Connect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address})" Stop = "Disconnect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address}) %{Acct-Session-Time} seconds" Alive = "" Accounting-On = "NAS %C (%{NAS-IP-Address}) just came online" Accounting-Off = "NAS %C (%{NAS-IP-Address}) just went offline" unknown = "" } } - -- Munroe Sollog LTS - Network Analyst x85002 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJVR7LeAAoJEPbbZiWCKDVCvEIH/jdMWSBN9TCtMNzi6JdgmDb2 H/8eDa+FbQEqcwwqoo92gCGNTqHjRBLWTDjfsjCigeJkXfiwGCdiYHXs7CYpzbpf ViqHmSviEnn8n/q06DKxznuhqppNmzsZrujwUu3Ih5GSXri7qWFFa4O1qZ3dXZLx K7k4zP12LRcsjIhtXtlWv+g5VIN+QEsxZ6p/UKydM5DhNuSpgwfysvPtyAuil0pL UTc4CJtO6hxiytx/YYDdD5AjuNhjs+JDK5o0eARaASR8bcrjWPiQiBPobluEdz+N LwrML7mfPki3UuMM3di+ZLU19n3u1zrtDako1kBKCdfFLIcsrK9I+w43snSVNao= =2GjL -----END PGP SIGNATURE-----

3 6

Dynamic Realms (3.07)
by Evan Greco 04 May '15

04 May '15

Hi, I am trying to configure a FreeRADIUS server (version 3.07) to "create" dynamic realms on-the-fly. For example, upon receiving an Access-Request, I would like to be able look up the user in a database and proxy the user to another RADIUS server based on what the query returns, but NOT have the proxy server be defined in proxy.conf. From what I can tell, this doesn't currently seem to be possible as I can't run any type of unlang in proxy.conf, since it gets read during server initialization, but I've been wrong before. Has anybody managed to get a similar system up and running? Thanks! -Evan

2 1

Security issues with EAP-PWD
by Alan DeKok 04 May '15

04 May '15

The EAP-PWD module performed insufficient validation on packets received from an EAP peer. This module is not enabled in the default configuration. Administrators must manually enable it for their server to be vulnerable. Only versions 3.0 up to 3.0.8 are affected. These issues were found by Jouni Malinen as part of investigating 2015-4 for HostAP. • The EAP-PWD packet length is not checked before the first byte is dereferenced. A zero-length EAP-PWD packet will cause the module to dereference a NULL pointer, and will cause the server to crash. • The commit message payload length is not validated before the packet is decoded. This can result in a read overflow in the server. • The confirm message payload length is not validated before the packet is decoded. This can result in a read overflow in the server. • A strcpy() was used to pack a C string into an EAP-PWD packet. This would result in an over-run of the destination buffer by one byte.

3 3

Re: Freeradius-Users Digest, Vol 121, Issue 10
by Rui Ribeiro 04 May '15

04 May '15

Obviously I meant ISC DHCP in the previous message. > > > On May 4, 2015, at 12:05 PM, Rui Ribeiro <ruyrybeyro(a)gmail.com> wrote: > > > > Hi, > > > > As Alan said not simple. It could be very well possible to work it out > with > > unlang, MySql and/or an external script to talk via OMAPI to an ISC BIND. > > It would be a very ugly hack. Besides that, abandoning immediately an IP > in > > a wireless infra-structure might not be a very good idea for several > > reasons IMO. > > There is this... > > https://github.com/Feh/rlm_omapi <https://github.com/Feh/rlm_omapi> > > Code doesn't look awful. > > Might be an idea to bring it into the server. > > -Arran > > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0

Dynamic Realms (3.07)
by Evan Greco 04 May '15

04 May '15

>You're welcome to sponsor development via NetworkRADIUS if you'd like to see it included within a set time frame. Otherwise there's only two core developers (me and Alan DeKok) and it's somewhere in the long list of features we'd like to see implemented. Fair enough. I had assumed as much, but just wanted to hear it from the horse's mouth. I'll consider sponsoring the feature, but for now I think I'll just come up with a hacky way of generating proxy.conf periodically or something to match what is in the database. Thanks for the timely response! -Evan

2 1

Spoofed Reply Message on Proxy Request from FreeRADIUS Server
by Steinhagen, Tom 04 May '15

04 May '15

I am attempting to set up RADIUS proxy to a McAfee (nee NordicEdge) One-time Password server. Any assistance would be appreciated. This is new installation, and I am new to FreeRADIUS. In command-line testing, debug shows the message "Ignoring spoofed proxy reply. Signature is invalid." Testing command: 'radtest -t pap -x tsteinhagen "<PASSWORD>" 127.0.0.1 1812 testing123' PAP is a limitation of the McAfee product. Debug output below. [root@ilrocnoc03 tsteinhagen]# radiusd -X radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Jan 19 2015 at 19:42:17 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/utf8 including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/accounting including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server FLJAXINF20 { ipaddr = <HOME-SERVER-IP-ADDDRESS> port = 1645 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 0 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } WARNING: Ignoring "revive_interval = 0", forcing to "revive_interval = 60" home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server_pool McAfeeOTP { type = fail-over home_server = FLJAXINF20 } realm DEFAULT { auth_pool = McAfeeOTP } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client ROCACCRT02 { ipaddr = <CLIENT-IP-ADDDRESS> require_message_authenticator = no secret = <<< secret >>> nas_type = "cisco" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_unix # Instantiating module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_exec # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_digest # Instantiating module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_soh # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Instantiating module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address :: port 1812 as server default Listening on acct address :: port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 40486 Ready to process requests Received Access-Request Id 4 from 127.0.0.1:36425 to 127.0.0.1:1812 length 81 User-Name = 'tsteinhagen' User-Password = '<PASSWORD>' NAS-IP-Address = <NAS-IP-ADDDRESS> NAS-Port = 1812 Message-Authenticator = 0x84e4b15145e8e04196f35d4e10f64967 (0) Received Access-Request packet from host 127.0.0.1 port 36425, id=4, length=81 (0) User-Name = 'tsteinhagen' (0) User-Password = '<PASSWORD>' (0) NAS-IP-Address = <NAS-IP-ADDDRESS> (0) NAS-Port = 1812 (0) Message-Authenticator = 0x84e4b15145e8e04196f35d4e10f64967 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "tsteinhagen", looking up realm NULL (0) suffix : Found realm "DEFAULT" (0) suffix : Adding Stripped-User-Name = "tsteinhagen" (0) suffix : Adding Realm = "DEFAULT" (0) suffix : Proxying request from user tsteinhagen to realm DEFAULT (0) suffix : Preparing to proxy authentication request to realm "DEFAULT" (0) [suffix] = updated (0) eap : No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 58950 (0) Proxying request to home server <HOME-SERVER-IP-ADDDRESS> port 1645 timeout 20.000000 (0) Sending Access-Request packet to host <HOME-SERVER-IP-ADDDRESS> port 1645, id=188, length=0 (0) User-Name = 'tsteinhagen' (0) User-Password = '<PASSWORD>' (0) NAS-IP-Address = <NAS-IP-ADDDRESS> (0) NAS-Port = 1812 (0) Message-Authenticator = 0x84e4b15145e8e04196f35d4e10f64967 (0) Event-Timestamp = 'Apr 30 2015 14:58:02 EDT' (0) Stripped-User-Name = 'tsteinhagen' (0) Realm = 'DEFAULT' (0) Proxy-State = 0x34 Sending Access-Request Id 188 from 0.0.0.0:58950 to <HOME-SERVER-IP-ADDDRESS>:1645 User-Name = 'tsteinhagen' User-Password = '<PASSWORD>' NAS-IP-Address = <NAS-IP-ADDDRESS> NAS-Port = 1812 Message-Authenticator = 0x84e4b15145e8e04196f35d4e10f64967 Event-Timestamp = 'Apr 30 2015 14:58:02 EDT' Proxy-State = 0x34 Waking up in 0.3 seconds. Waking up in 0.1 seconds. (0) Expecting proxy response no later than 19.499801 seconds from now Waking up in 19.4 seconds. Received Access-Challenge Id 188 from <HOME-SERVER-IP-ADDDRESS>:1645 to <NAS-IP-ADDDRESS>:58950 length 104 Ignoring spoofed proxy reply. Signature is invalid Waking up in 19.1 seconds. Tom Steinhagen Sr. Network Security Engineer, Network Operations Center Landstar System Holdings, Inc. (815) 972-6954, tsteinhagen(a)landstar.com

2 5