June 2016 - Freeradius-Users - lists.freeradius.org

Re-Cisco-NAS-Port or Quintum-NAS-Port ignored
by Nelson Naranjo - PLOTCOM 09 Jun '16

09 Jun '16

>> Alan, it worked for Quintum but I also receive from Cisco (Cisco-NAS Port="Serial:xxxxx)" and it's not saved. The server also detect and save for "NAS-Port = 23" but I need to save the full string not just the ISDN channel. >> >> I've tried unsuccessfully several ways to configure Cisco for sending NAS-Port = "Full string" but none works. >> >> Any idea? >> >> Thanks, >> Nelson > >> I have Freeradius Version 2.1.10 (from Daloradius) only for accounting from a Cisco and Quintum NAS. I need to storage at MySQL the attribute NAS-Port.I do not need authentication. Freeradius receive an string like Quintum-NAS-port= "2 2/1/20" (or Cisco-NAS-Port) but it says "NAS-Port not seen" > > Yes... because Quantum-NAS-Port is not NAS-Port. They're different. > >> How can I do for Server recognize the vendor prefix.? > > Edit the SQL queries to use %{%{NAS-Port}:-%{Quintum-NAS-Port}} > > Alan DeKok.

2 1

Authenticate with both Certificate and password
by jan hugo prins 09 Jun '16

09 Jun '16

Hello, I have a freeradius server running for several realms and this works all very nice. I can do both user-name / password authentication from the users file. I can do user-name / password authentication with MS-Chapv2 from OpenLDAP. I can do certificate based authentication with a certificate signed by the same CA and the radius servers. But now I want to have something special in one realm, in this one realm I want to do a combination for certificate authentication and MsChapv2 authentication. This to make sure the user has a valid certificate and also knows a valid user-name / password. Is this possible to configure in FreeRadius? Is this possible in the variety of of WPA-Supplicants used (Apple, Linux and Windows) Is it possible to do this in just one realm? If this is possible, could someone point me to some documentations that describes this setup? Thanks a lot, Jan Hugo Prins

3 6

Freeradius3 radtest with test user steve not working.
by Michael Pugliese 09 Jun '16

09 Jun '16

Hi, I've cross-compiled freeradius3 for an OpenWRT based platform. Trying to use run radtest with the test user steve fails stating "(5) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject" Here's the log output: root@home:/# /etc/init.d/radiusd start & root@home:/# Server was built with: accounting : yes authentication : yes ascend-binary-attributes : yes coa : yes control-socket : yes detail : yes dhcp : yes dynamic-clients : yes osfc2 : no proxy : yes regex-pcre : no regex-posix : yes regex-posix-extended : yes session-management : yes stats : yes tcp : yes threads : yes tls : yes unlang : yes vmps : yes developer : no Server core libs: freeradius-server : 3.0.11 talloc : 2.0.* ssl : 1.0.2h release Endianness: little libs : -lcrypto -lssl -ltalloc -lnsl -lresolv -ldl -lpthread Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file //share/freeradius/dictionary including dictionary file //share/freeradius/dictionary.dhcp including dictionary file //share/freeradius/dictionary.vqp including dictionary file //etc/raddb/dictionary including configuration file //etc/raddb/radiusd.conf including configuration file //etc/raddb/proxy.conf including configuration file //etc/raddb/clients.conf including files in directory //etc/raddb/mods-enabled/ including configuration file //etc/raddb/mods-enabled/always including configuration file //etc/raddb/mods-enabled/attr_filter including configuration file //etc/raddb/mods-enabled/cache_eap including configuration file //etc/raddb/mods-enabled/chap including configuration file //etc/raddb/mods-enabled/detail including configuration file //etc/raddb/mods-enabled/detail.log including configuration file //etc/raddb/mods-enabled/dhcp including configuration file //etc/raddb/mods-enabled/digest including configuration file //etc/raddb/mods-enabled/dynamic_clients including configuration file //etc/raddb/mods-enabled/eap including configuration file //etc/raddb/mods-enabled/echo including configuration file //etc/raddb/mods-enabled/exec including configuration file //etc/raddb/mods-enabled/expiration including configuration file //etc/raddb/mods-enabled/expr including configuration file //etc/raddb/mods-enabled/files including configuration file //etc/raddb/mods-enabled/linelog including configuration file //etc/raddb/mods-enabled/logintime including configuration file //etc/raddb/mods-enabled/mschap including configuration file //etc/raddb/mods-enabled/ntlm_auth including configuration file //etc/raddb/mods-enabled/pap including configuration file //etc/raddb/mods-enabled/passwd including configuration file //etc/raddb/mods-enabled/preprocess including configuration file //etc/raddb/mods-enabled/radutmp including configuration file //etc/raddb/mods-enabled/realm including configuration file //etc/raddb/mods-enabled/replicate including configuration file //etc/raddb/mods-enabled/soh including configuration file //etc/raddb/mods-enabled/sradutmp including configuration file //etc/raddb/mods-enabled/unix including configuration file //etc/raddb/mods-enabled/unpack including configuration file //etc/raddb/mods-enabled/utf8 including files in directory //etc/raddb/policy.d/ including configuration file //etc/raddb/policy.d/abfab-tr including configuration file //etc/raddb/policy.d/accounting including configuration file //etc/raddb/policy.d/canonicalization including configuration file //etc/raddb/policy.d/control including configuration file //etc/raddb/policy.d/cui including configuration file //etc/raddb/policy.d/debug including configuration file //etc/raddb/policy.d/dhcp including configuration file //etc/raddb/policy.d/eap including configuration file //etc/raddb/policy.d/filter including configuration file //etc/raddb/policy.d/operator-name including files in directory //etc/raddb/sites-enabled/ including configuration file //etc/raddb/sites-enabled/default including configuration file //etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/" localstatedir = "//var" logdir = "//var/log/radius" run_dir = "//var/run/radiusd" } main { name = "radiusd" prefix = "/" localstatedir = "//var" sbindir = "//sbin" logdir = "//var/log/radius" run_dir = "//var/run/radiusd" libdir = "//lib" radacctdir = "//var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "//var/run/radiusd/radiusd.pid" checkrad = "//sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest # Creating Auth-Type = eap radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file //etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file //etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file //etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file //etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file //etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file //etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file //etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file //etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file //etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file //etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "//etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file //etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "//etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file //etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "//etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file //etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "//etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file //etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "//etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file //etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file //etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Loading module "detail" from file //etc/raddb/mods-enabled/detail detail { filename = "//var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail- %Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file //etc/raddb/mods-enabled/detail.log detail auth_log { filename = "//var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-de tail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file //etc/raddb/mods-enabled/detail.log detail reply_log { filename = "//var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-d etail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file //etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "//var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-pro xy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file //etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "//var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-pr oxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file //etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file //etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file //etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file //etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file //etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file //etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file //etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file //etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /�ä�é�ö�ü�à â �æ�ç�è�é�ê�ë�î�ï�ô�œ�ù�û�üa�ÿ�Ä�É�Ö�Ü�ß�À�Â�Æ�Ç�È�É�Ê�Ë�Î�Ï�Ô�Œ�Ù�Ü�Ÿ" } # Loaded module rlm_files # Loading module "files" from file //etc/raddb/mods-enabled/files files { filename = "//etc/raddb/mods-config/files/authorize" acctusersfile = "//etc/raddb/mods-config/files/accounting" preproxy_usersfile = "//etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file //etc/raddb/mods-enabled/linelog linelog { filename = "//var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file //etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "//var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file //etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file //etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loading module "ntlm_auth" from file //etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --pa ssword=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file //etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file //etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file //etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "//etc/raddb/mods-config/preprocess/huntgroups" hints = "//etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file //etc/raddb/mods-enabled/radutmp radutmp { filename = "//var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file //etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file //etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file //etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file //etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file //etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file //etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file //etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "//var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file //etc/raddb/mods-enabled/unix unix { radwtmp = "//var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file //etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file //etc/raddb/mods-enabled/utf8 instantiate { } # Instantiating module "reject" from file //etc/raddb/mods-enabled/always # Instantiating module "fail" from file //etc/raddb/mods-enabled/always # Instantiating module "ok" from file //etc/raddb/mods-enabled/always # Instantiating module "handled" from file //etc/raddb/mods-enabled/always # Instantiating module "invalid" from file //etc/raddb/mods-enabled/always # Instantiating module "userlock" from file //etc/raddb/mods-enabled/always # Instantiating module "notfound" from file //etc/raddb/mods-enabled/always # Instantiating module "noop" from file //etc/raddb/mods-enabled/always # Instantiating module "updated" from file //etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file //etc/raddb/mods-enabled/attr_filter reading pairlist file //etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file //etc/raddb/mods-enabled/attr_filter reading pairlist file //etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file //etc/raddb/mods-enabled/attr_filter reading pairlist file //etc/raddb/mods-config/attr_filter/access_reject [//etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in fil ter list for realm "DEFAULT". [//etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" foun d in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file //etc/raddb/mods-enabled/attr_filter reading pairlist file //etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file //etc/raddb/mods-enabled/attr_filter reading pairlist file //etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file //etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file //etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file //etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file //etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file //etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file //etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file //etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "//etc/raddb/certs" pem_file_type = yes private_key_file = "//etc/raddb/certs/server.pem" certificate_file = "//etc/raddb/certs/server.pem" ca_file = "//etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "//etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file //etc/raddb/mods-enabled/expiration # Instantiating module "files" from file //etc/raddb/mods-enabled/files reading pairlist file //etc/raddb/mods-config/files/authorize reading pairlist file //etc/raddb/mods-config/files/accounting reading pairlist file //etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file //etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file //etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file //etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file //etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file //etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file //etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file //etc/raddb/mods-enabled/preprocess reading pairlist file //etc/raddb/mods-config/preprocess/huntgroups reading pairlist file //etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file //etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file //etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file //etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file //etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file //etc/raddb/radiusd.conf } # server server default { # from file //etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file //etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # steve Cleartext-Password := "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP root@home:/# radtest steve testing Usage: radtest [OPTIONS] user passwd radius-server[:port] nas-port-number secret [ppphint] [nasname] -d RADIUS_DIR Set radius directory -t <type> Set authentication method type can be pap, chap, mschap, or eap-md5 -P protocol Select udp (default) or tcp -x Enable debug output -4 Use IPv4 for the NAS address (default) -6 Use IPv6 for the NAS address root@home:/# radtest steve testing localhost 100 testing123 "" localhost (0) Received Access-Request Id 248 from 127.0.0.1:55389 to 127.0.0.1:1812 length 75 (0) User-Name = "steve" (0) User-Password = "testing" (0) NAS-IP-Address = 127.0.0.1 (0) NAS-Port = 100 (0) Message-Authenticator = 0xf4fad4774b114a25a546a884cf53e04b (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) Post-Auth-Type sub-section not found. Ignoring. (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Sent Access-Request Id 248 from 0.0.0.0:55389 to 127.0.0.1:1812 length 75 User-Name = "steve" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 100 Message-Authenticator = 0x00 Cleartext-Password = "testing" Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 248 from 127.0.0.1:1812 to 127.0.0.1:55389 length 20 Waking up in 3.9 seconds. Received Access-Reject Id 248 from 127.0.0.1:1812 to 0.0.0.0:0 length 20 (0) -: Expected Access-Accept got Access-Reject root@home:/# (0) Cleaning up request packet ID 248 with timestamp +32 Ready to process requests Any help would be greatly appreciated. Thank you!

3 3

FreeRADIUS on a tun interface?
by Michael Schwartzkopff 08 Jun '16

08 Jun '16

Hi, is it possible to run FreeRADIUS on a tun interface? The problem is to answer incomming DHCP requests inside a IPsec tunnel. ISC- DHCP and dnsmasq do not like the type of the tun interface. We need a DHCP server that passes DHCP attributes to the client that cannot be sent in the configuration data of the IKEv2. Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Schleißheimer Straße 26/MG, 80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

2 3

radius authentication query not rejecting AUTH
by Amardeep Singh 08 Jun '16

08 Jun '16

Hi, Greetings. Hope you all are doing great! Following is the authentication query that I am using :- if ("%{Called-Station-Id}" =~ /^00-50-E8-/) { update request { Tmp-String-0 = "%{sql: SELECT radius_group_name from raduserzone where \ site_id='%{NAS-Identifier}' and \ mac_address='%{Calling-Station-Id}' \ and vlan_id regexp '[[:<:]]%{NAS-Port}[[:>:]]'}" } if (&Tmp-String-0) { update request { Tmp-String-1 := "%{sql:update radusergroup set \ groupname='%{Tmp-String-0}' \ where username='%{Calling-Station-Id}'}"; } } } Also tried if (&Tmp-String-0 != "") { in the above query. The initial record that we have in the table is a follows :- mysql> select * from raduserzone; +----+---------+-------------------+---------+-------------------+ | id | site_id | mac_address | vlan_id | radius_group_name | +----+---------+-------------------+---------+-------------------+ | 1 | 100051 | 78-9E-D0-31-29-7E | 77,678 | 78-9E-D0-31-29-7E | +----+---------+-------------------+---------+-------------------+ Now when we try to switch the SSID to Guest space (VLAN_ID = 93) , the authentication query(above) did not seem to work as expected and it returns true every time we switch irrespective of the record in the raduserzone table. I have attached the debug logs file. On line 267 it says 'SQL query did not return any results' but still it updates the radusergroup table with a null value resulting in successfull AUTH on radius. It is not rejecting the AUTH somehow. Please suggest! I have already checked the mysql logs and the queries are working fine, if ran manually. Thanks

2 5

Config hints for providing list of groups in post-auth?
by Mike Ely 07 Jun '16

07 Jun '16

Hello list: I have a 3.0.4 machine successfully authenticating against Active Directory. For the use case I have in mind I'd like to have the Freeradius server add into post-auth something like: Group-Name:= "Domain Users", Group-Name+= "All Staff", etc. The idea here is that the NAS will be able to make its own decisions about what to grant based on group membership once radius has authenticated the user. I can parse the group list easily enough from the shell, but don't know how to get this into post-auth. Also, is Group-Name the best choice here or should I be using another attribute? Thanks greatly, Mike

2 9

Non-ascii username and linelog
by Jean-Marc TÊTU 07 Jun '16

07 Jun '16

Hello, First : sorry for my very bad English... We run a Freeradius 3.0.11 on an ubuntu 14.04. And il seems that one of our students find the way to put KO our server. He tries to authenticate with a user-name in non ASCII and freeradius crash on the write ( in linelog module ) of %{User-Name} linelog { .... messages { default = "Unknown packet type %{Packet-Type}" Access-Accept = "%D:%H:%G : Accept : %{User-Name} : %{Calling-Station-Id} : %{NAS-IP-Address} : %{Called-Station-Id}" Access-Reject = "%D:%H:%G : Reject : %{User-Name} : %{Calling-Station-Id} : %{NAS-IP-Address} : %{Called-Station-Id}" } ... } The user-name seem to be a UTF-8 Unicode text. I isolate the guilty string in a file (wke) : hexdump -C wke 00000000 ef bd 97 ef bd 8b ef bd 85 0a |..........| 0000000a cat wke ｗｋｅ I reproduce the problem with the initial example of configuration for freeradius modified for use of linelog (in post-auth section) , the (partial) result of radiusd -X : Ready to process requests (1) Received Access-Request Id 34 from 127.0.0.1:43956 to 127.0.0.1:1812 length 79 (1) User-Name = "ｗｋｅ" (1) User-Password = "hello" (1) NAS-IP-Address = 127.0.1.1 (1) NAS-Port = 0 (1) Message-Authenticator = 0x6bbba1a108aee843ee5c78a8efcf4788 (1) # Executing section authorize from file /usr/local/FR3011/etc/raddb//sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (!&User-Name) { (1) if (!&User-Name) -> FALSE (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@.*@/ ) { (1) if (&User-Name =~ /@.*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "ｗｋｅ", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/FR3011/etc/raddb//sites-enabled/default (1) Post-Auth-Type REJECT { (1) linelog: EXPAND messages.%{%{reply:Packet-Type}:-default} (1) linelog: --> messages.Access-Reject (1) linelog: EXPAND /usr/local/FR3011/var/log/radius/linelog (1) linelog: --> /usr/local/FR3011/var/log/radius/linelog with this configuration : # Loading module "linelog" from file /usr/local/FR3011/etc/raddb//mods-enabled/linelog linelog { filename = "/usr/local/FR3011/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } If somebody have an idea.... And thanks to have read this very long text (in an incorrect english)..... -- -- Cordialement, Jean-Marc Têtu -------------------------------------------------------------- Jean-Marc Têtu, Direction Informatique et Système d'Information Tel : 02 29 00 10 87, Email: jm.tetu(a)telecom-bretagne.eu Institut Mines-Télécom - TELECOM Bretagne Pointe du Diable CS 83818 29238 BREST CEDEX 3 --------------------------------------------------------------

2 2

compile pam_radius_auth on AIX 6.1
by Rupesh Basnet 07 Jun '16

07 Jun '16

Hi All, I am trying to compile pam_radius_auth on AIX 6.1 but I am unknown where to start with. And I am not able to relevant document of AIX to configure PAM as well. Please help me to proceed further. Regards, Rupesh Basnet

2 1

RE: Freeradius-Users Digest, Vol 134, Issue 11
by Shawn Wilson 06 Jun '16

06 Jun '16

Hi Alan, thanks for replying. I will try to provide some clarification: >> Then I can pass the domain to the ntlm_auth command by using the "-domain=%{realm}" parameter. Everything works fine as long User->Name is in the format <username>@<my.domain.name>. >> >> HOWEVER, the big problem I'm encountering is that we need users to authenticate via alternate UPN suffixes. It turns out Ntlm_auth will not authenticate against these suffixes, only the actual domain names. >> > What does that mean? "actual domain name" ? The "actual domain name" is the active directory domain name that was used when the AD domain was originally created. Microsoft allows you to create "alternate UPN suffixes" which are like aliases for the domain (e.g. like this http://www.tutorialspoint.com/articles/adding-alternate-upn-suffix-to-activ…) The ntlm_auth command will not authenticate against alternate active directory UPN You must use the original active directory domain name. I realize this is not a freeradius problem but a Samba problem. Still, I was wondering if there was an elegant way to configure freeradius to work around this limitation. For the time being, I did a brutal hack to get it to work: >From /etc/freeradius/modules/mschap: ---- SNIP ---- # Choose the right AD domain to authenticate against. ntlm_auth = "/usr/local/bin/ntlm_auth_UPN %{%{Stripped-User-Name}:-%{%{User-Name}:-None}} %{realm} %{%{mschap:Challenge}:-00} %%{mschap:NT-Response}:-00}" ---- SNIP ---- Contents of /usr/local/bin/ntlm_auth_UPN: -------- #!/bin/sh # This script is a workaround to deal w/ the fact that the ntlm_auth # command does not authenticate properly using alternate UPN suffixes # in active directory domains. It is hardcoded to fix the domain. # USERNAME=$1 DOMAIN=$2 CHALLENGE=$3 NT_RESPONSE=$4 # Rewrite the suffix for office employees. if [ "${DOMAIN}" = "boguscorp.org" ] ; then # Set the AD domain we need to login to. DOMAIN="office.users.big-ugly-domain.local" Fi # Rewrite the suffix for students. if [ "${DOMAIN}" = "bcstudents.org" ] ; then # Set the AD domain we need to login to. DOMAIN="student.users.big-ugly-domain.local" Fi exec /usr/bin/ntlm_auth --request-nt-key --username=${USERNAME} --domain=${DOMAIN} --challenge=${CHALLENGE} --nt-response=${NT_RESPONSE} --------

3 2

upgrade from v1 to v3 L2TP issues
by Andy Smith 06 Jun '16

06 Jun '16

Hi list, I've just upgraded a freeradius v1.1.8 server with MySQL DB to 3.0.11. I didn't install or configure the original and haven't used freeradius previously so its been a steep learning curve. I've now got the server to a point where it seems to all work on the server side, we are testing via NTRadPing and we get a successful authentication logged on the server and in NTRadPing. However when we try and use Radius for real with a Cisco device doing authentication for L2TP something is failing. This is what my colleague who runs the network told me having looking at the debug info on the router side: "PPP comes up and then the router tries to get an IP address. This messages 0.0.0.0 there is no address and request the local router to provide it. So basically it's not getting an address from the radius server" When we test with NTRadPing we noticed that the output is slightly different if we authenticate against the v1 or v3 radius server: radius 1 - not working Framed-IP-Address=93.10.10.10 vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback 2003\0x0a Service-Type=Framed Tunnel-Medium-Type=IP Tunnel-Type=L2TP Tunnel-Password=\0x00\0x85K\0x97\0xd5jk\0x0b\0xefbN\0xac\0x12y\0x80.\0xda\0xb3\0xb1 Tunnel-Server-Endpoint=178.248.104.124 Tunnel-Client-Auth-ID=broadband-3 radius 2 - working (differences in red) Framed-IP-Address=93.10.10.10 vendor Cisco cisco-avpair=lcp:interface-config=ip unnumbered loopback 2003\n Service-Type=Framed Tunnel-Medium-Type=IP Tunnel-Type=L2TP Tunnel-Password=\0x00\0xb0}=G\0xe7\0xe4\0x08\0xd1\\0xe4\0xax;\0x0d?\0x15\0xe4\0x8f\0xfe Tunnel-Server-Endpoint=178.248.104.124 Tunnel-Client-Auth-ID=broadband-3 could this be related to our issue? Noticing the line return is different on the avpair line and the password is different, its stored in clear text in the DB. Currently a bit stumped. Can pass on the output of radiusd -X if the above isn't the key to the problem, thanks, Andy.

3 6