August 2016 - Freeradius-Users - lists.freeradius.org

Logs Help.
by Periko Support 23 Aug '16

23 Aug '16

Hi. We are running freeradius 2.2.x, very stable. We are a small WISP, our network is Mikrotik, Ubiquiti and FreeRADIUS under Centos 6.x. This post is related to FreeRADIUS, I want to understand some logs, I already enable some settings on radius.conf. stripped_names = yes auth = yes auth_badpass = yes a uth_goodpass = yes Radius is connected to MySQL. The other are default settings. I would like to get more debug info to troubleshoot but the log doesn't tell me to much. I have this log that Im trying to understand the meaning? Mon Aug 22 17:39:09 2016 : Auth: Login OK: [3988672839/<CHAP-Password>] (from client [RB951]-Torre port 2154824621 cli MAC-ADDRES) Mon Aug 22 17:39:09 2016 : Info: No Pool-Name defined (did hs-server1 cli MAC-ADDRES port 2154824621 user 3988672839) Mon Aug 22 18:06:43 2016 : Info: Released IP 10.10.10.26 (did hs-server1 cli MAC-ADDRES user 3988672839) Mon Aug 22 21:29:51 2016 : Auth: Login OK: [3988672839/<CHAP-Password>] (from client [RB951]-Torre port 2154824634 cli MAC-ADDRES) Mon Aug 22 21:29:51 2016 : Info: No Pool-Name defined (did hs-server1 cli MAC-ADDRES port 2154824634 user 3988672839) Mon Aug 22 21:44:50 2016 : Info: Released IP 10.10.10.26 (did hs-server1 cli MAC-ADDRES user 3988672839) Mon Aug 22 21:44:50 2016 : Info: Released IP 10.10.10.26 (did hs-server1 cli MAC-ADDRES user 34234234234) I understand that at 17:39:09 the user logins OK. But latter at 18:06:43 Release the IP??? What is the meaning of that log Released IP? How can I increase debug level without running radius in console? Our network is: Ubiquity Rocket M5 <----> NanoLOCOM5. On each client the dhcp is manage by each NanoLOCOM5, our NanoLOCO have static IP. I have around 20 users will be a lot of info. Thanks, any comment will be appreciated.

3 4

Freeradius + Ldap - Authorise OK but NO dynamic VLANs
by Matthew Pulis 23 Aug '16

23 Aug '16

Hi all, I am trying to have dynamic VLAN assignment on Freeradius based on LDAP. The connection between Freeradius and LDAP works fine. If I test with a user I get the Authorise packet but not the dynamic VLAN assignment. We will be testing using this LDAP user: # ttester, SeminaryAdmin, SeminaryOU, seminary.local dn: cn=ttester,cn=SeminaryAdmin,ou=SeminaryOU,dc=seminary,dc=local cn: ttester givenName: Test gidNumber: 505 homeDirectory: /home/users/ttester sn: Tester objectClass: inetOrgPerson objectClass: posixAccount objectClass: top uidNumber: 1002 uid: ttester This is the received reply: radius@daloradius:~$ radtest -x ttester openldap localhost 1812 testing456 Sending Access-Request of id 30 to 127.0.0.1 port 1812 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=30, length=20 Freeradius version: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Feb 27 2015 at 12:38:34 This is an extract of the Freeradius debug: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 38281, id=59, length=77 User-Name = "ttester" User-Password = "openldap" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0xbe303901f2b855fb146f2f1fda9cd3fd # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ttester", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for ttester [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> ttester [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ttester) [ldap] expand: ou=SeminaryOU,dc=seminary,dc=local -> ou=SeminaryOU,dc=seminary,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to seminary.local:389, authentication 0 [ldap] bind as cn=admin,dc=seminary,dc=local/FalseBINDINGPASS to seminary.local:389 [ldap] waiting for bind result ... [ldap] Bind was successful * [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester)* [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}T4sU9zSLN/Auop+ImthH4nLyLG/rPU0R" [ldap] looking for reply items in directory... [ldap] user ttester authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "openldap" [pap] Using SSHA encryption. [pap] Normalizing SSHA1-Password from base64 encoding [pap] User authenticated successfully ++[pap] returns ok Login OK: [ttester] (from client localhost port 1812) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 59 to 127.0.0.1 port 38281 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 59 with timestamp +5 Ready to process requests. In any tutorials I am following this line: [ldap] performing search in ou=SeminaryOU,dc=seminary,dc=local, with filter (uid=ttester) .... should have the filter but in mine this is not coming. I am following this tutorial mainly: https://system-eng.blogspot.com.mt/2015/12/setting-up-freeradius-in-debian-… My config files: /etc/freeradius/modules/ldap : http://paste.ubuntu.com/23060929/ /etc/freeradius/sites-available/inner-tunnel : http://paste.ubuntu.com/23060930/ /etc/freeradius/sites-available/default : http://paste.ubuntu.com/23060931/ /etc/freeradius/users : http://paste.ubuntu.com/23060935/ Any idea where I should start looking at the problem please? Thanks and best regards Matthew Matthew Pulis web: www.matthewpulis.info mob: +356 79539404

4 32

Child is hung for request # in component session module
by Roman 23 Aug '16

23 Aug '16

Hi, Thanks for freeradius! I was googling and fight with this issue for the last 23 hours. My setup is: Mikrotik as PPPoE server and Debian Jessie 8.5 with Freeradius 2.2.5. Also tested with Debian Wheezy 7.11 and Freeradius 2.1.12. I use radutmp for Simultaneous-Use = 1 control and store users in users file. Don't plan to switch to SQL, as this setup won't grow that large. checkrad working fine on both setups (I use mikrotik_snmp method) So it asks Mikrotik by SNMP if there are virtual interfaces with usernames and reports if user allowed to login. The problem starts with stale sessions. We know, that accounting runs over udp and we could lose some logoff packets, but it should not be an issue, when checkrad does it's job. So if there is a session in radius server (radwho shows loged in user) and no session on PPPoE server, Freeradius just hangs and shows it in logs pretty honestly: ed Jul 13 01:41:02 2016 : Info: WARNING: Child is hung for request 17 in component session module . Wed Jul 13 01:41:02 2016 : Debug: Waking up in 0.1 seconds. Wed Jul 13 01:41:02 2016 : Info: WARNING: Child is hung for request 16 in component session module . Wed Jul 13 01:41:02 2016 : Debug: Waking up in 0.9 seconds. Wed Jul 13 01:41:03 2016 : Error: Discarding duplicate request from client cli-ter1-lo0 port 38676 - ID: 115 due to unfinished request 18 Wed Jul 13 01:41:03 2016 : Debug: Waking up in 0.3 seconds. Wed Jul 13 01:41:03 2016 : Info: WARNING: Child is hung for request 15 in component session module . Wed Jul 13 01:41:03 2016 : Debug: Waking up in 0.3 seconds. Nothing more interesting in logs. If I run server in debug mode, it just freezes on this step: Wed Jul 13 01:54:44 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Wed Jul 13 01:54:44 2016 : Info: +group authorize { Wed Jul 13 01:54:44 2016 : Info: ++[preprocess] = ok Wed Jul 13 01:54:44 2016 : Info: [chap] Setting 'Auth-Type := CHAP' Wed Jul 13 01:54:44 2016 : Info: ++[chap] = ok Wed Jul 13 01:54:44 2016 : Info: ++[mschap] = noop Wed Jul 13 01:54:44 2016 : Info: [suffix] No '@' in User-Name = "tt23kswp17", looking up realm NULL Wed Jul 13 01:54:44 2016 : Info: [suffix] No such realm "NULL" Wed Jul 13 01:54:44 2016 : Info: ++[suffix] = noop Wed Jul 13 01:54:44 2016 : Info: [files] users: Matched entry tt23kswp17 at line 106 Wed Jul 13 01:54:44 2016 : Info: ++[files] = ok Wed Jul 13 01:54:44 2016 : Info: ++[expiration] = noop Wed Jul 13 01:54:44 2016 : Info: ++[logintime] = noop Wed Jul 13 01:54:44 2016 : Info: +} # group authorize = ok Wed Jul 13 01:54:44 2016 : Info: Found Auth-Type = CHAP Wed Jul 13 01:54:44 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Wed Jul 13 01:54:44 2016 : Info: +group CHAP { Wed Jul 13 01:54:44 2016 : Info: [chap] login attempt by "tt23kswp17" with CHAP password Wed Jul 13 01:54:44 2016 : Info: [chap] Using clear text password "secret" for user tt23kswp17 authentication. Wed Jul 13 01:54:44 2016 : Info: [chap] chap user tt23kswp17 authenticated succesfully Wed Jul 13 01:54:44 2016 : Info: ++[chap] = ok Wed Jul 13 01:54:44 2016 : Info: +} # group CHAP = ok Wed Jul 13 01:54:44 2016 : Info: # Executing section session from file /etc/freeradius/sites-enabled/default Wed Jul 13 01:54:44 2016 : Info: +group session { Wed Jul 13 01:54:44 2016 : Info: [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp Wed Jul 13 01:54:44 2016 : Info: [radutmp] expand: %{User-Name} -> tt23kswp17 Wed Jul 13 01:54:44 2016 : Info: # Executing section preacct from file /etc/freeradius/sites-enabled/default Wed Jul 13 01:54:44 2016 : Info: +group preacct { Wed Jul 13 01:54:44 2016 : Info: ++[preprocess] = ok Wed Jul 13 01:54:44 2016 : Info: [acct_unique] WARNING: Attribute NAS-Identifier was not found in request, unique ID MAY be inconsistent Wed Jul 13 01:54:44 2016 : Info: [acct_unique] Hashing 'NAS-Port = 15728739,,NAS-IP-Address = my.ip,Acct-Session-Id = "81300063",User-Name = "tt23kswp17"' Wed Jul 13 01:54:44 2016 : Info: [acct_unique] Acct-Unique-Session-ID = "5cddac4e2d445dcf". Wed Jul 13 01:54:44 2016 : Info: ++[acct_unique] = ok Wed Jul 13 01:54:44 2016 : Info: [suffix] No '@' in User-Name = "tt23kswp17", looking up realm NULL Wed Jul 13 01:54:44 2016 : Info: [suffix] No such realm "NULL" Wed Jul 13 01:54:44 2016 : Info: ++[suffix] = noop Wed Jul 13 01:54:44 2016 : Info: ++[files] = noop Wed Jul 13 01:54:44 2016 : Info: +} # group preacct = ok Wed Jul 13 01:54:44 2016 : Info: # Executing section accounting from file /etc/freeradius/sites-enabled/default Wed Jul 13 01:54:44 2016 : Info: +group accounting { Wed Jul 13 01:54:44 2016 : Info: [detail] expand: %{Packet-Src-IP-Address} -> my.ip Wed Jul 13 01:54:44 2016 : Info: [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/my.ip/detail-20160713 Wed Jul 13 01:54:44 2016 : Info: [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/my.ip/detail-20160713 Wed Jul 13 01:54:44 2016 : Info: [detail] expand: %t -> Wed Jul 13 01:54:44 2016 Wed Jul 13 01:54:44 2016 : Info: ++[detail] = ok and if i look at logs after some time, I get this: Wed Jul 13 01:42:29 2016 : Info: [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp Wed Jul 13 01:42:29 2016 : Info: [radutmp] expand: %{User-Name} -> tt23kswp17 Wed Jul 13 01:42:29 2016 : Info: ++[radutmp] = ok Wed Jul 13 01:42:29 2016 : Info: [sradutmp] expand: /var/log/freeradius/sradutmp -> /var/log/freeradius/sradutmp Wed Jul 13 01:42:29 2016 : Info: [sradutmp] expand: %{User-Name} -> tt23kswp17 Wed Jul 13 01:42:29 2016 : Info: ++[sradutmp] = ok Wed Jul 13 01:42:29 2016 : Info: ++[exec] = noop Wed Jul 13 01:42:29 2016 : Info: [attr_filter.accounting_response] expand: %{User-Name} -> tt23kswp17 Wed Jul 13 01:42:29 2016 : Debug: attr_filter: Matched entry DEFAULT at line 12 Wed Jul 13 01:42:29 2016 : Info: ++[attr_filter.accounting_response] = updated Wed Jul 13 01:42:29 2016 : Info: +} # group accounting = updated Wed Jul 13 01:42:29 2016 : Info: Finished request 1. Wed Jul 13 01:42:29 2016 : Debug: Going to the next request Wed Jul 13 01:42:29 2016 : Debug: Thread 7 waiting to be assigned a request Wed Jul 13 01:42:30 2016 : Info: Cleaning up request 1 ID 137 with timestamp +2 Wed Jul 13 01:42:30 2016 : Debug: Waking up in 3.9 seconds. Wed Jul 13 01:42:34 2016 : Info: Cleaning up request 0 ID 136 with timestamp +2 Wed Jul 13 01:42:34 2016 : Info: Ready to process requests. Wed Jul 13 01:54:21 2016 : Info: Ready to process requests. Wed Jul 13 01:54:21 2016 : Info: Signalled to terminate Wed Jul 13 01:54:21 2016 : Info: Exiting normally. Wed Jul 13 01:54:21 2016 : Debug: Thread 9 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 9 exiting... Wed Jul 13 01:54:21 2016 : Debug: Thread 10 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 10 exiting... Wed Jul 13 01:54:21 2016 : Debug: Thread 6 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 6 exiting... Wed Jul 13 01:54:21 2016 : Debug: Thread 5 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 5 exiting... Wed Jul 13 01:54:21 2016 : Debug: Thread 4 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 4 exiting... Wed Jul 13 01:54:21 2016 : Debug: Thread 3 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 3 exiting... Wed Jul 13 01:54:21 2016 : Debug: Thread 2 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 2 exiting... Wed Jul 13 01:54:21 2016 : Debug: Thread 1 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 1 exiting... Wed Jul 13 01:54:21 2016 : Debug: Thread 8 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 8 exiting... Wed Jul 13 01:54:21 2016 : Debug: Thread 7 got semaphore Wed Jul 13 01:54:21 2016 : Debug: Thread 7 exiting... Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 1 Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 2 Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 3 Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 4 Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 5 Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 6 Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 7 Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 8 Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 9 Wed Jul 13 01:54:21 2016 : Debug: Deleting thread 10 And none of users are able to login, I even can't radzap session. I have to delete the radutmp file and radacc directory and start Freeradius over to get ovet this. Any ideas? I've ran out of them. -- Best regards, Roman.

4 11

help with getting freeradius working with ldap..
by Jason Welsh 23 Aug '16

23 Aug '16

Im trying to migrate freeradius from an older server running freeradius 2.1.6. The new server is running from rpms installed on my centos 7 server. freeradius-3.0.4-6.el7.x86_64 freeradius-ldap-3.0.4-6.el7.x86_64 and Im trying to start up the freeradius server and in the logs i see Sun Aug 21 16:05:55 2016 : Info: Loaded virtual server <default> Sun Aug 21 16:05:55 2016 : Error: /etc/raddb/sites-enabled/default[489]: Failed to find "ldap" in the "modules" section. Sun Aug 21 16:05:55 2016 : Error: /etc/raddb/sites-enabled/default[489]: Failed to parse "ldap" entry. Sun Aug 21 16:05:55 2016 : Error: Failed to load virtual server default [root@newjed mods-enabled]$pwd /etc/raddb/mods-enabled [root@newjed mods-enabled]$ls -al ldap lrwxrwxrwx 1 root root 22 Aug 21 21:28 ldap -> ../mods-available/ldap [root@newjed mods-enabled]$ what else to check? Jason --

3 4

FreeRADIUS - The authentication server is unresponsive.
by NavinS Luthor 22 Aug '16

22 Aug '16

Hello FreeRADIUS experts, hope you are all well! Not sure where or what did i configure wrong, most thing are in default but still facing "The authentication server is unresponsive" error. I've complied step by step what i did in below docs, please help advice me where im wrong. Step by step: https://docs.google.com/document/d/1FE0Db4OacQjbCk_2ba QQ9WsOEDChDK6uomW3kJGgxtA/edit?usp=sharing Any and all help is much appreciated.

3 7

Problem with dailycounter
by Frederic Fichter 21 Aug '16

21 Aug '16

Hello all, Can't understand why my dailycounter is always empty ? See message below "dailycounter: No integer found in result string """ The radacct table in MySQL is correctly updated. My freeradius is : radiusd: FreeRADIUS Version 3.0.11, for host armv7l-unknown-linux-gnu, built on Jul 15 2016 at 22:02:47 What additional information should I give here ? Here's an extract of freeradius debug : (5) dailycounter: EXPAND %{User-Name} (5) dailycounter: --> test01 (5) dailycounter: SQL-User-Name set to 'test01' rlm_sql (sql): Reserved connection (11) (5) dailycounter: Executing select query: SELECT SUM(acctsessiontime - GREATEST((1471730400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = 'test01' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1471730400' (5) dailycounter: NULL value in first column of result rlm_sql (sql): Released connection (11) (5) dailycounter: EXPAND %{sql:SELECT SUM(acctsessiontime - GREATEST((1471730400 - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '1471730400'} (5) dailycounter: --> (5) dailycounter: No integer found in result string "". May be first session, setting counter to 0 (5) dailycounter: Allowing user, &control:Max-Daily-Session value (3600) is greater than counter value (0) (5) dailycounter: Setting &reply:Session-Timeout value to 3600 (5) [dailycounter] = ok (5) [expiration] = noop Thanks much for your help ;) Best, Fred

2 4

RadPerf running in another server.
by Jim 19 Aug '16

19 Aug '16

Hello, I'm currently running FreeRADIUS 3.0.4 on a CentOS server and I wanted to use RadPerf for testing. Since I cannot install RadPerf in CentOS, I installed RadPerf in a separate Ubuntu 14.04 server, my question is: which is better for RadPerf installation? on the same server where FreeRADIUS was installed or different server?

4 4

Allowing clients with dynamic IP address
by Anuruddha Premalal 19 Aug '16

19 Aug '16

Hi All, Is it possible to host free-radius in Amazon cloud with a static DNS and connect clients (access points) who doesn't have a static IP address only with the secret?. I went through the clients.conf file and wasn't able to find information on that. If this doesn't support out of the box, is there any extension point which could validate some thing like below and allow any ip address with the proper secret to get authenticate.(something similar to the extensions of python module) client myexternalclient { ipaddr = 0.0.0.0 secret = testing123 } I understand this is going to allow a huge security whole. Do you guys have any better suggestions to use an externally hosted radius server without a static ip address assigned to the access point? Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>Sri Lanka.*

2 1

Unexpected termination signal
by Scott McLane Gardner 19 Aug '16

19 Aug '16

FreeRadius version 3.0.4 installed from rhel repos. RedHat Enterprise Linux 7.2 OpenSSL 1.0.1e-fips 11 Feb 2013 When I run radiusd -X from the command line, it runs as expected without issue. If I run radiusd as a service, I get the following messages in my radius.log after about a minute of working normally: > Thu Aug 18 18:23:41 2016 : Info: rlm_ldap (ldap): 0 of 3 connections in use. Need more spares > Thu Aug 18 18:23:41 2016 : Info: rlm_ldap (ldap): Opening additional connection (7) > Thu Aug 18 18:24:25 2016 : Info: Signalled to terminate > Thu Aug 18 18:24:25 2016 : Info: Exiting normally I have been searching the list and banging my head on this all day, so please forgive me if I have overlooked the previously posted solution. My radiusd -X output is below, although I'm not sure how helpful it will be since it runs normally under that circumstance. radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Dec 28 2014 at 07:00:16 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ldap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "redrad01" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/redrad01" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/redrad01/redrad01.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client red8510.fake.com { ipaddr = 10.250.0.19 require_message_authenticator = no secret = <<< secret >>> nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } client blue8510.fake.com { ipaddr = 10.250.0.18 require_message_authenticator = no secret = <<< secret >>> nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Instantiating module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/redrad01.fake.com.key" certificate_file = "/etc/raddb/certs/redrad01.fake.com.cer" ca_file = "/etc/raddb/certs/ca.pem" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_exec # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" passchange { } allow_retry = yes } # Instantiating module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Instantiating module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Instantiating module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_ldap # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap ldap { server = "ds.fake.com" port = 636 password = <<< secret >>> identity = "netoc(a)fake.com" user { filter = "(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})" scope = "sub" base_dn = "dc=fake,dc=com" access_positive = yes } group { filter = "(objectClass=posixGroup)" scope = "sub" base_dn = "dc=fake,dc=com" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=frClient)" scope = "sub" base_dn = "dc=fake,dc=com" attribute { identifier = "radiusClientIdentifier" shortname = "cn" secret = "radiusClientSecret" } } profile { filter = "(&)" } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 20 srv_timelimit = 20 idle = 60 probes = 3 interval = 3 } tls { start_tls = no require_cert = "never" } } rlm_ldap: Falling back to build time libldap version info. Query for LDAP_OPT_API_INFO returned: -1 rlm_ldap: libldap vendor: OpenLDAP version: 20439 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 4 max = 32 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 1 spread = no } rlm_ldap (ldap): Opening additional connection (0) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4) rlm_ldap (ldap): Connecting to ds.fake.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address :: port 1812 as server default Listening on acct address :: port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests

3 5

non ascii characters in exec output
by Oleg Palij 19 Aug '16

19 Aug '16

I am using freeradius 3.0.12 on debian jessie. I have custom 'control' variable mapped to user distinguishedName attribute (it is in UTF-8) in Active Directory: ldap { update { control:ms-distinguishedName := 'distinguishedName' } I want to convert it to custom format and log to postauth table: authorize { update control { &ms-publishedAt := "%{exec:/etc/freeradius/dn2ou.py %{control:ms-distinguishedName}}" } In script I got UTF-8 string from freeradius, but I can't understand in what encoding I should return result. I tried different variants without success. Simple bash script like: echo $@ shows following debug: (2) update control { (2) Executing: /etc/freeradius/test.sh CN\=Сотрудник\ ХХХ,OU\=ОК\ $Р-1$,OU\=орг,DC\=xx,DC\=xx,DC\=xx,DC\=xx: (2) Program returned code (0) and output 'CN\=Сотрудник ХХХ,OU\=ОК $Р-1$,OU\=орг,DC\=xx,DC\=xx,DC\=xx,DC\=xx' (2) EXPAND %{exec:/etc/freeradius/ivc/test.sh %{control:ms-distinguishedName}} (2) --> CN\= ,OU\= $ -1$,OU\= ,DC\=xx,DC\=xx,DC\=xx,DC\=xx (2) &ms-publishedAt := CN\= ,OU\= $ -1$,OU\= ,DC\=xx,DC\=xx,DC\=xx,DC\=xx (2) } # update control = noop So it get output as UTF-8 string, but next EXPAND vanishes non-ascii symbols to spaces. Is it possible to get 'exec' module output with non ascii characters?

2 2