March 2017 - Freeradius-Users - lists.freeradius.org

Logging off MS Chapp error messages
by Arnab Roy 29 Mar '17

29 Mar '17

Hi All, I am just trying to figure out if its possible to log the following MS-Chap error messages via linelog mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' (8) mschap: External script failed (8) mschap: ERROR: External script says: Logon failure (0xc000006d) (8) mschap: ERROR: MS-CHAP2-Response is incorrect By using %{reply:MS-CHAP-Error}, I get something like this E=691 R=1 C=3c30753bced696c552fc3c78aeb953b0 V=3 M=Authentication failed But that is not as descriptive of the issue as above. Any suggestions would be great. Many Thanks Arnab

2 2

FreeRadius and multiotp
by Alex Sharaz 29 Mar '17

29 Mar '17

Hi, Anyone using multiotp with freeradius to implement two-factor auth? Their test VM has freeradius 2.x installed, which is fine for testing. I've set this up and have successfully "checked" my userid using an OTP and prefix. However can't find any reference to what to do when trying to pass credentials into multiotp via freeradius. Am I just concatenating normal password with prefix and OTP value? A

2 1

Unstructured Attr-26 in unlang
by Brian Candler 29 Mar '17

29 Mar '17

(FreeRADIUS 3.0.13 under CentOS) I am trying to deal with a broken device (Aten) which requires an unstructured attribute 26 [^1]. Using the 'files' module this works [^2]: bob Cleartext-Password := "hello" # Vendor-Specific = "su/administrator" Attr-26 = 0x73752f61646d696e6973747261746f72 But in unlang, this is not accepted: update reply { # Vendor-Specific = "su/administrator" &Attr-26 = 0x73752f61646d696e6973747261746f72 } Tue Mar 28 14:01:27 2017 : Error: /etc/raddb/policy.d/localpolicy[155]: Invalid vendor name in attribute name "0x73752f61646d696e6973747261746f72" Here's the only bit of source I can find which generates that error message: if (strncasecmp(p, "Attr-", 5) != 0) { if (strncasecmp(p, "Vendor-", 7) == 0) { ... /* must be vendor name */ } else { char buffer[256]; q = strchr(p, '-'); if (!q) { fr_strerror_printf("Invalid vendor name in attribute name \"%s\"", name); return -1; } I don't understand why it thinks the attribute *name* is "0x73752f61"... rather than "Attr-26" And if I try this: update reply { &Attr-26 = "su/administrator" } Tue Mar 28 14:25:56 2017 : Error: /etc/raddb/policy.d/localpolicy[154]: Must use 'Attr-26 = ...' instead of 'Vendor-Specific = ...' That's an even stranger error: I *am* using Attr-26 like it says!! Any suggestions how I can get this to work, other than switching from unlang to files module? Thanks, Brian. [^1] It is so broken that it doesn't even use a vendor ID in the first four bytes. But I am happy to define a fake vendor which has the correct four bytes. And RFC 2865 *does* permit unstructured data after the 4 bytes of vendor ID. [^2] tcpdump confirms it's as expected: 0x0050: .... 1a12 7375 2f61 646d 696e 6973 7472 ....su/administr 0x0060: 6174 6f72 ator

3 4

3.0.13 crash
by Stefan Winter 28 Mar '17

28 Mar '17

Hi, updating from 3.0.12 to 3.0.13, I see that the servers starts up fine, starts processing packets for a few seconds, and then: Wed Mar 15 09:27:55 2017 : ERROR: (579) eap: ERROR: rlm_eap (EAP): No EAP session matching state 0xecf67dfde9f1649a Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value CAUGHT SIGNAL: Aborted Backtrace of last 23 frames: /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(fr_fault+0x115)[0x7f63d355e461] /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(+0xd79c)[0x7f63d355e79c] /lib64/libtalloc.so.2(_talloc_get_type_abort+0xea)[0x7f63d2ae214a] /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(fr_pair_verify+0x85)[0x7f63d356f84b] /usr/local/freeradius/3.0.13/lib/libfreeradius-radius.so(fr_cursor_init+0x6f)[0x7f63d355d028] /usr/local/freeradius/3.0.13/lib/libfreeradius-eap.so(eaptls_process+0x4c3)[0x7f63d334a1ca] /usr/local/freeradius/3.0.13/lib/rlm_eap_peap.so(+0x1f9c)[0x7f63cd089f9c] /usr/local/freeradius/3.0.13/lib/rlm_eap.so(+0x40f5)[0x7f63cdec00f5] /usr/local/freeradius/3.0.13/lib/rlm_eap.so(eap_method_select+0x431)[0x7f63cdec0add] /usr/local/freeradius/3.0.13/lib/rlm_eap.so(+0x2d01)[0x7f63cdebed01] /usr/local/freeradius/current/sbin/radiusd[0x428c82] /usr/local/freeradius/current/sbin/radiusd[0x42932f] /usr/local/freeradius/current/sbin/radiusd[0x428e43] /usr/local/freeradius/current/sbin/radiusd[0x429d63] /usr/local/freeradius/current/sbin/radiusd(modcall+0xa2)[0x42aaa8] /usr/local/freeradius/current/sbin/radiusd(indexed_modcall+0x363)[0x4262ba] /usr/local/freeradius/current/sbin/radiusd(process_authenticate+0x22)[0x42857f] /usr/local/freeradius/current/sbin/radiusd[0x40f74d] /usr/local/freeradius/current/sbin/radiusd(rad_authenticate+0x51e)[0x410078] /usr/local/freeradius/current/sbin/radiusd[0x43d692] /usr/local/freeradius/current/sbin/radiusd[0x4392c8] /lib64/libpthread.so.0(+0x7dc5)[0x7f63d1e28dc5] /lib64/libc.so.6(clone+0x6d)[0x7f63d192073d] Calling: gdb -silent -x /usr/local/freeradius/config/raddb/panic.gdb /usr/local/freeradius/current/sbin/radiusd 11265 2>&1 | tee /var/log/radius/gdb-radiusd-11265.log Panic action exited with 0 _EXIT(0) CALLED src/lib/debug.c[743] The initial error is fine; it was restarted and lost state on its EAP sessions, so it's confused when half a session comes in. Its reaction to crash on that is not quite so fine :-/ Anyone with ideas? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 2

shared secret (general question)
by Janis Heller 28 Mar '17

28 Mar '17

Because I prepare a small presentation about freeradius, how exactly is the process of sending passwords from a station to the radius server itself? All I know is the shared secret is used and md5 algo, but how exactly is this kind of sensitive data obfuscated? For my example /presentation I use default radius setup (no radsec). All the best;

4 4

Problems with "virtual_server" for EAP-pwd
by Christian Strauf 27 Mar '17

27 Mar '17

Hi all! For our eduroam setup we use FreeRADIUS to authenticate EAP-TTLS, PEAP as well as EAP-pwd requests. For each of these EAP types you have to configure the "virtual_server" which deals with the tunneled authentication (which is a little odd with respect to EAP-pwd because it isn't a tunneled method). Within the "inner-tunnel*" virtual servers we connect to an LDAP server to get the user credentials and RADIUS attributes that are associated with a specific user. Furthermore, we call a policy in the authorize section that is defined in policy.d/ that simply checks whether a certain attribute is set to "yes" or "no". The check basically looks like this: if ( ...<some check>... ) { reject } This works nicely with the inner-tunnel virtual servers that are used for EAP-TTLS and PEAP. It basically looks like this if the check yields a reject: 11) if (...<some check>...) { (11) [reject] = reject (11) } # if (...<some check>...) = reject (11) } # policy XXXX = reject (11) } # authorize = reject (11) Using Post-Auth-Type Reject (11) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (11) Post-Auth-Type REJECT { ... (11) } # Post-Auth-Type REJECT = updated (11) } # server inner-tunnel (11) Virtual server sending reply This reject is forwarded to the outer session and this works as expected. However, it doesn't work with the inner-tunnel virtual server that we use for EAP-pwd. Please note that the configuration is virtually identical (except that you obviously don't need inner authentications methods for EAP-pwd). You basically get debugging output that looks like this: (2) if (...<some check>...) { (2) [reject] = reject (2) } # if (...<some check>...) = reject (2) } # policy XXXX = reject (2) } # authorize = reject (2) eap_pwd: } # server inner-tunnel-eap-pwd (2) eap_pwd: Got tunneled reply code 0 It looks like the eap_pwd module doesn't receive the reject generated within the authorize section of the inner-tunnel virtual server. Please note that EAP-pwd authentication per se works without any problems. Furthermore, I perfectly understand that only the authorize section of the inner-tunnel virtual server is used by EAP-pwd anyhow (it's simply used to retrieve credentials). However, it's not clear to me why the exact same configuration works for EAP-TTLS / PEAP but not for EAP-pwd because other things that we do within the authorize section (like setting RADIUS attributes that are used in the outer session etc.) work. I was thinking about working around the problem by doing something like update outer.session-state { ... } to generate a reject within the outer session. Do you have any suggestions what the right way would be to work around this? Apart from a workaround, do you think this could be a bug in the EAP-pwd module? I tried to read the source code but I'm not a programmer and I couldn't figure out how the EAP-pwd module works differently from the EAP-TTLS and PEAP modules with respect to how it works with inner-tunnel virtual servers. Any help would be highly appreciated. Kind regards, Christian Strauf -- Dipl.-Math. Christian Strauf Clausthal Univ. of Technology E-Mail: strauf(a)rz.tu-clausthal.de Rechenzentrum Web: www.rz.tu-clausthal.de Erzstraße 18 Tel.: +49-5323-72-2086 Fax: -992086 D-38678 Clausthal-Zellerfeld

3 7

iOS mysterious issues on Freeradius 3.0.14
by Igor Sousa 27 Mar '17

27 Mar '17

Hello everyone, I've read a lot messages in Freeradius Forum and I continued misunderstand why iOS devices (iPhone, iPad) doesn't connect in my WPA-Enterprise wifi network. I've installed and configured a freeradius server, version 3.0.14, over openssl 1.1.0e (both have installed from sources on Debian 8). I've tested connect Android devices to my wifi network and everytime they can connect to the network, but iOS devices have mysterious issues. When I try connect iOS device to my wifi in first time, they can connect perfectly. Though, if this same iOS device lost connection (because it's out of range AP signal or air plane mode turn on by the user for 30 minutes or hours) and try connect again the device doesn't connect. When I've saw the debug mode, I've noticed that EAP-PEAP tunnel athentication was successful and server sent Access-Challenge, but device doesn't answer this challenge. I don't understand why the android devices doesn't this issues. Glad, Igor Sousa Wed Mar 22 07:33:50 2017 : Debug: Waking up in 1.1 seconds. Wed Mar 22 07:33:50 2017 : Debug: (17) Received Access-Request Id 8 from 10.41.17.64:1042 to 10.41.110.86:1812 length 255 Wed Mar 22 07:33:50 2017 : Debug: (17) Message-Authenticator = 0x50eb8b4ea5bffe022eda2db1d905b40e Wed Mar 22 07:33:50 2017 : Debug: (17) Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) State = 0x541acf3e5312d64e560d7f91490adef3 Wed Mar 22 07:33:50 2017 : Debug: (17) Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) EAP-Message = 0x0208002b19001703010020b525f058fa80f3f09e827ff6899bf36e4cab 3f5023d51a927e3e3accc04d61bd Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) session-state: No cached attributes Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:50 2017 : Debug: (17) authorize { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Mar 22 07:33:50 2017 : Debug: (17) [preprocess] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent EAP Response (code 2) ID 8 length 43 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Continuing tunnel setup Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) [eap] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) } # authorize = ok Wed Mar 22 07:33:50 2017 : Debug: (17) Found Auth-Type = eap Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:50 2017 : Debug: (17) authenticate { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authenticate]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Expiring EAP session with state 0xb44ea59dbc47bc85 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Finished EAP session with state 0x541acf3e5312d64e Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Previous EAP request found for state 0x541acf3e5312d64e, released from the list Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent packet with method EAP PEAP (25) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Calling submodule eap_peap to process data Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Continuing EAP-TLS Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Peer sent flags --- Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: [eaptls verify] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Done initial handshake Wed Mar 22 07:33:50 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: [eaptls process] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Session established. Decoding tunneled attributes Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: PEAP state phase2 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP method MSCHAPv2 (26) Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Got tunneled request Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Setting User-Name to userTest Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Sending tunneled request to inner-tunnel Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: State = 0x1c722cc11d7a36d74beb044945cb21bf Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Event-Timestamp = "Mar 22 2017 07:33:50 -03" Wed Mar 22 07:33:50 2017 : Debug: (17) Virtual server inner-tunnel received request Wed Mar 22 07:33:50 2017 : Debug: (17) EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) FreeRADIUS-Proxied-To = 127.0.0.1 Wed Mar 22 07:33:50 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) State = 0x1c722cc11d7a36d74beb044945cb21bf Wed Mar 22 07:33:50 2017 : Debug: (17) Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) Event-Timestamp = "Mar 22 2017 07:33:50 -03" Wed Mar 22 07:33:50 2017 : WARNING: (17) Outer and inner identities are the same. User privacy is compromised. Wed Mar 22 07:33:50 2017 : Debug: (17) server inner-tunnel { Wed Mar 22 07:33:50 2017 : Debug: (17) session-state: No cached attributes Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:50 2017 : Debug: (17) authorize { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent EAP Response (code 2) ID 8 length 6 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: No EAP Start, assuming it's an on-going EAP conversation Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) [eap] = updated Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling ldap (rlm_ldap) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL LITERAL Wed Mar 22 07:33:50 2017 : Debug: rlm_ldap (ldap): Reserved connection (3) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL XLAT Wed Mar 22 07:33:50 2017 : Debug: (uid=%{%{Stripped-User-Name}:- %{User-Name}}) Wed Mar 22 07:33:50 2017 : Debug: Parsed xlat tree: Wed Mar 22 07:33:50 2017 : Debug: literal --> (uid= Wed Mar 22 07:33:50 2017 : Debug: XLAT-IF { Wed Mar 22 07:33:50 2017 : Debug: attribute --> Stripped-User-Name Wed Mar 22 07:33:50 2017 : Debug: } Wed Mar 22 07:33:50 2017 : Debug: XLAT-ELSE { Wed Mar 22 07:33:50 2017 : Debug: attribute --> User-Name Wed Mar 22 07:33:50 2017 : Debug: } Wed Mar 22 07:33:50 2017 : Debug: literal --> ) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: --> (uid=userTest) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL LITERAL Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: Performing search in "ou=people,dc=test,dc=br" with filter "(uid=userTest)", scope "sub" Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: Waiting for search result... Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: User object found at DN "uid=userTest,ou=people,dc=test,dc=br" Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: Processing user attributes Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: control:NT-Password := 0x3145333941394139324632423038413045363942344435414441374535333332 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Released connection (3) Wed Mar 22 07:33:53 2017 : Info: Need 2 more connections to reach 10 spares Wed Mar 22 07:33:53 2017 : Info: rlm_ldap (ldap): Opening additional connection (8), 1 of 24 pending slots used Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Connecting to ldap:// 10.0.0.2:389 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): New libldap handle 0x1d2afa0 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Waiting for bind result... Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Bind successful Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from ldap (rlm_ldap) Wed Mar 22 07:33:53 2017 : Debug: (17) [ldap] = updated Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling expiration (rlm_expiration) Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from expiration (rlm_expiration) Wed Mar 22 07:33:53 2017 : Debug: (17) [expiration] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling logintime (rlm_logintime) Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from logintime (rlm_logintime) Wed Mar 22 07:33:53 2017 : Debug: (17) [logintime] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling pap (rlm_pap) Wed Mar 22 07:33:53 2017 : Debug: (17) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes Wed Mar 22 07:33:53 2017 : WARNING: (17) pap: Auth-Type already set. Not setting to PAP Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from pap (rlm_pap) Wed Mar 22 07:33:53 2017 : Debug: (17) [pap] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) } # authorize = updated Wed Mar 22 07:33:53 2017 : Debug: (17) Found Auth-Type = eap Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) authenticate { Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: calling eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Expiring EAP session with state 0xb44ea59dbc47bc85 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Finished EAP session with state 0x1c722cc11d7a36d7 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Previous EAP request found for state 0x1c722cc11d7a36d7, released from the list Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Peer sent packet with method EAP MSCHAPv2 (26) Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Calling submodule eap_mschapv2 to process data Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Sending EAP Success (code 3) ID 8 length 4 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Freeing handler Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: returned from eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) [eap] = ok Wed Mar 22 07:33:53 2017 : Debug: (17) } # authenticate = ok Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) post-auth { ... } # empty sub-section is ignored Wed Mar 22 07:33:53 2017 : Debug: (17) } # server inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) Virtual server sending reply Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Got tunneled reply code 2 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Got tunneled reply RADIUS code 2 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Tunneled authentication was successful Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: SUCCESS Wed Mar 22 07:33:53 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Saving tunneled attributes for later Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Sending EAP Request (code 1) ID 9 length 43 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: EAP session adding &reply:State = 0x541acf3e5c13d64e Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: returned from eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) [eap] = handled Wed Mar 22 07:33:53 2017 : Debug: (17) } # authenticate = handled Wed Mar 22 07:33:53 2017 : Debug: (17) Using Post-Auth-Type Challenge Wed Mar 22 07:33:53 2017 : Debug: (17) Post-Auth-Type sub-section not found. Ignoring. Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:53 2017 : Debug: (17) session-state: Nothing to cache Wed Mar 22 07:33:53 2017 : Debug: (17) Sent Access-Challenge Id 8 from 10.41.110.86:1812 to 10.41.17.64:1042 length 0 Wed Mar 22 07:33:53 2017 : Debug: (17) EAP-Message = 0x0109002b1900170301002040009148da66c66e92399186be36b8b9bfb2 dd86e5e250997e63aa0d31227eff Wed Mar 22 07:33:53 2017 : Debug: (17) Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) State = 0x541acf3e5c13d64e560d7f91490adef3 Wed Mar 22 07:33:53 2017 : Debug: (17) Finished request Wed Mar 22 07:33:53 2017 : Debug: (8) Cleaning up request packet ID 8 with timestamp +7 Wed Mar 22 07:33:53 2017 : Debug: (9) Cleaning up request packet ID 0 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (10) Cleaning up request packet ID 1 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (11) Cleaning up request packet ID 2 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (12) Cleaning up request packet ID 3 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (13) Cleaning up request packet ID 4 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (14) Cleaning up request packet ID 5 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (15) Cleaning up request packet ID 6 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (7) Cleaning up request packet ID 7 with timestamp +3 Wed Mar 22 07:33:53 2017 : Debug: Waking up in 4.9 seconds. Wed Mar 22 07:33:58 2017 : Debug: (17) Cleaning up request packet ID 8 with timestamp +14 Wed Mar 22 07:33:58 2017 : Debug: Waking up in 1.8 seconds. Wed Mar 22 07:34:00 2017 : Debug: (16) Cleaning up request packet ID 7 with timestamp +10 Wed Mar 22 07:34:00 2017 : Info: Ready to process requests

6 15

How to log Request
by Andrés Gómez 27 Mar '17

27 Mar '17

Hi dear list. I need to log when there is an authentication request using an incorrect Radius secret. This is my radiusd.conf: log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } So, I can log all good or bad requests made with the correct secret, but I can't see when is made a request using an incorrect secret. How Can I do it? Best regards -- *C. Andrés Gómez R.*

3 3

acct_unique with more than one Class attribute
by Andrea Gabellini 27 Mar '17

27 Mar '17

Hi, I'm trying to use acct_unique from the default accounting policy with FR 3.0.13: acct_unique { update request { &Tmp-String-9 := "${policy.class_value_prefix}" } if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && \ ("%{string:&Class}" =~ /^${policy.class_value_prefix}([0-9a-f]{32})/i)) { update request { &Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}" } } else { update request { &Acct-Unique-Session-Id := "%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID}, %{NAS-Port}}" } } } Currently I already use the Class attribute to deliver some QoS, and so this policy doesn't work. Any hint to modify it to manage multi value Class atttibute? Thanks, Andrea -- ---------------------------------------------------------------- Hit any user to continue. ---------------------------------------------------------------- Ing. Andrea Gabellini Email: andrea.gabellini(a)telecomitalia.sm Skype: andreagabellini Tel: (+378) 0549 886111 Fax: (+378) 0549 886188 Telecom Italia San Marino S.p.A. Via XXVIII Luglio, 212 - Piano -2 47893 Borgo Maggiore Republic of San Marino http://www.telecomitalia.sm

2 8

(5) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
by jaseywang 27 Mar '17

27 Mar '17

I need to use radius as the backend of pptp vpn for auth/login/accounting etc. and I try to figure it out with the help of this doc: http://www.sajithpn.com/2016/08/centos-7-installing-pptp-freeradius.html freeradius: # rpm -qa | grep radius freeradius-3.0.4-7.el7_3.x86_64 radiusclient-ng-0.5.6-9.el7.x86_64 freeradius-utils-3.0.4-7.el7_3.x86_64 freeradius-mysql-3.0.4-7.el7_3.x86_64 with daloradius-0.9.9 as the web interface, both running on localhost, the system is centos 7.2. I use daloradius to add a new user wyx1(cleartext-password), and it passed "test user connectivity" test, below is the daloradius/radtest and radiusd -X output: daloradius output: *Executed:* echo "User-Name='wyx1',User-Password='wyx1'" | radclient -c '1' -n '3' -r '3' -t '3' -x '127.0.0.1:1812' 'auth' 'testing123' 2>&1 *Results:* Sending Access-Request Id 12 from 0.0.0.0:33948 to 127.0.0.1:1812 User-Name = 'wyx1' User-Password = 'wyx1' Received Access-Accept Id 12 from 127.0.0.1:1812 to 127.0.0.1:33948 length 20 radtest output: # radtest wyx1 wyx1 127.0.0.1 0 testing123 Sending Access-Request Id 127 from 0.0.0.0:38206 to 127.0.0.1:1812 User-Name = 'wyx1' User-Password = 'wyx1' NAS-IP-Address = 10.44.55.2 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 127 from 127.0.0.1:1812 to 127.0.0.1:38206 length 20 radius -X output: Received Access-Request Id 32 from 127.0.0.1:46310 to 127.0.0.1:1812 length 44 User-Name = 'wyx1' User-Password = 'wyx1' (6) Received Access-Request packet from host 127.0.0.1 port 46310, id=32, length=44 (6) User-Name = 'wyx1' (6) User-Password = 'wyx1' (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) if (!&User-Name) (6) if (!&User-Name) -> FALSE (6) if (&User-Name =~ / /) (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@.*@/ ) (6) if (&User-Name =~ /@.*@/ ) -> FALSE (6) if (&User-Name =~ /\\.\\./ ) (6) if (&User-Name =~ /\\.\\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\\.$/) (6) if (&User-Name =~ /\\.$/) -> FALSE (6) if (&User-Name =~ /(a)\\./) (6) if (&User-Name =~ /(a)\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [preprocess] = ok (6) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (6) auth_log : --> /var/log/radius/radacct/ 127.0.0.1/auth-detail-20170327 (6) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20170327 (6) auth_log : EXPAND %t (6) auth_log : --> Mon Mar 27 00:53:15 2017 (6) [auth_log] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : Checking for suffix after "@" (6) suffix : No '@' in User-Name = "wyx1", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : No EAP-Message, not doing EAP (6) [eap] = noop (6) sql : EXPAND %{User-Name} (6) sql : --> wyx1 (6) sql : SQL-User-Name set to 'wyx1' rlm_sql (sql): Reserved connection (7) (6) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (6) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wyx1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wyx1' ORDER BY id' (6) sql : User found in radcheck table (6) sql : Check items matched (6) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (6) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wyx1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wyx1' ORDER BY id' (6) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (6) sql : --> SELECT groupname FROM radusergroup WHERE username = 'wyx1' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'wyx1' ORDER BY priority' (6) sql : User not found in any groups rlm_sql (sql): Released connection (7) rlm_sql (sql): 0 of 3 connections in use. Need more spares rlm_sql (sql): Opening additional connection (8) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (sql): Closing connection (6): Hit idle_timeout, was idle for 933 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (5): Hit idle_timeout, was idle for 967 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket (6) [sql] = ok (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = updated (6) } # authorize = updated (6) Found Auth-Type = PAP (6) # Executing group from file /etc/raddb/sites-enabled/default (6) Auth-Type PAP { (6) pap : Login attempt with password (6) pap : User authenticated successfully (6) [pap] = ok (6) } # Auth-Type PAP = ok (6) # Executing section post-auth from file /etc/raddb/sites-enabled/default (6) post-auth { (6) reply_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (6) reply_log : --> /var/log/radius/radacct/ 127.0.0.1/reply-detail-20170327 (6) reply_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/reply-detail-20170327 (6) reply_log : EXPAND %t (6) reply_log : --> Mon Mar 27 00:53:15 2017 (6) [reply_log] = ok (6) sql : EXPAND .query (6) sql : --> .query (6) sql : Using query template 'query' rlm_sql (sql): Reserved connection (8) (6) sql : EXPAND %{User-Name} (6) sql : --> wyx1 (6) sql : SQL-User-Name set to 'wyx1' (6) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (6) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wyx1', 'wyx1', 'Access-Accept', '2017-03-27 00:53:15') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wyx1', 'wyx1', 'Access-Accept', '2017-03-27 00:53:15')' rlm_sql (sql): Released connection (8) (6) [sql] = ok (6) [exec] = noop (6) remove_reply_message_if_eap remove_reply_message_if_eap { (6) if (&reply:EAP-Message && &reply:Reply-Message) (6) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (6) else else { (6) [noop] = noop (6) } # else else = noop (6) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (6) } # post-auth = ok (6) Sending Access-Accept packet to host 127.0.0.1 port 46310, id=32, length=0 Sending Access-Accept Id 32 from 127.0.0.1:1812 to 127.0.0.1:46310 (6) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. (6) Cleaning up request packet ID 32 with timestamp +1053 Ready to process requests Now, everything seems fine. But when I use the same account to connect the pptp server, it says Authentication failed: Received Access-Request Id 232 from 127.0.0.1:39104 to 127.0.0.1:1812 length 65 Service-Type = Framed-User Framed-Protocol = PPP User-Name = 'wyx1' Calling-Station-Id = '117.73.147.49' NAS-IP-Address = 10.44.55.2 NAS-Port = 0 (7) Received Access-Request packet from host 127.0.0.1 port 39104, id=232, length=65 (7) Service-Type = Framed-User (7) Framed-Protocol = PPP (7) User-Name = 'wyx1' (7) Calling-Station-Id = '117.73.147.49' (7) NAS-IP-Address = 10.44.55.2 (7) NAS-Port = 0 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (!&User-Name) (7) if (!&User-Name) -> FALSE (7) if (&User-Name =~ / /) (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@.*@/ ) (7) if (&User-Name =~ /@.*@/ ) -> FALSE (7) if (&User-Name =~ /\\.\\./ ) (7) if (&User-Name =~ /\\.\\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\\.$/) (7) if (&User-Name =~ /\\.$/) -> FALSE (7) if (&User-Name =~ /(a)\\./) (7) if (&User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [preprocess] = ok (7) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (7) auth_log : --> /var/log/radius/radacct/ 127.0.0.1/auth-detail-20170327 (7) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20170327 (7) auth_log : EXPAND %t (7) auth_log : --> Mon Mar 27 00:56:06 2017 (7) [auth_log] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "wyx1", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : No EAP-Message, not doing EAP (7) [eap] = noop (7) sql : EXPAND %{User-Name} (7) sql : --> wyx1 (7) sql : SQL-User-Name set to 'wyx1' rlm_sql (sql): Reserved connection (8) (7) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (7) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wyx1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wyx1' ORDER BY id' (7) sql : User found in radcheck table (7) sql : Check items matched (7) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (7) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wyx1' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wyx1' ORDER BY id' (7) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (7) sql : --> SELECT groupname FROM radusergroup WHERE username = 'wyx1' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'wyx1' ORDER BY priority' (7) sql : User not found in any groups rlm_sql (sql): Released connection (8) rlm_sql (sql): 0 of 2 connections in use. Need more spares rlm_sql (sql): Opening additional connection (9) rlm_sql_mysql: Starting connect to MySQL server rlm_sql (sql): Closing connection (7): Hit idle_timeout, was idle for 171 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket (7) [sql] = ok (7) [expiration] = noop (7) [logintime] = noop (7) pap : No cleartext password in the request. Not performing PAP (7) [pap] = noop (7) } # authorize = ok (7) WARNING: Please update your configuration, and remove 'Auth-Type = Local' (7) WARNING: Use the PAP or CHAP modules instead (7) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/raddb/sites-enabled/default (7) Post-Auth-Type REJECT { (7) sql : EXPAND .query (7) sql : --> .query (7) sql : Using query template 'query' rlm_sql (sql): Reserved connection (9) (7) sql : EXPAND %{User-Name} (7) sql : --> wyx1 (7) sql : SQL-User-Name set to 'wyx1' (7) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (7) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wyx1', '', 'Access-Reject', '2017-03-27 00:56:06') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wyx1', '', 'Access-Reject', '2017-03-27 00:56:06')' rlm_sql (sql): Released connection (9) (7) [sql] = ok (7) attr_filter.access_reject : EXPAND %{User-Name} (7) attr_filter.access_reject : --> wyx1 (7) attr_filter.access_reject : Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (7) [eap] = noop (7) remove_reply_message_if_eap remove_reply_message_if_eap { (7) if (&reply:EAP-Message && &reply:Reply-Message) (7) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (7) else else { (7) [noop] = noop (7) } # else else = noop (7) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (7) } # Post-Auth-Type REJECT = updated (7) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (7) Sending delayed response (7) Sending Access-Reject packet to host 127.0.0.1 port 39104, id=232, length=0 Sending Access-Reject Id 232 from 127.0.0.1:1812 to 127.0.0.1:39104 Waking up in 3.9 seconds. (7) Cleaning up request packet ID 232 with timestamp +1224 Ready to process requests And the responding pptp log: Mar 27 00:56:06 iZ2597ft3dqZ pptpd[23202]: CTRL: Client control connection started Mar 27 00:56:06 iZ2597ft3dqZ pptpd[23202]: CTRL: Starting call (launching pppd, opening GRE) Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Plugin radius.so loaded. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: RADIUS plugin initialized. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Plugin radattr.so loaded. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: RADATTR plugin initialized. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Plugin /usr/lib64/pptpd/pptpd-logwtmp.so loaded. Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: pptpd-logwtmp: $Version$ Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: pppd 2.4.5 started by root, uid 0 Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Using interface ppp0 Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: Connect: ppp0 <--> /dev/pts/0 Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: rc_avpair_new: unknown attribute 11 Mar 27 00:56:06 iZ2597ft3dqZ pppd[23203]: rc_avpair_new: unknown attribute 25 Mar 27 00:56:07 iZ2597ft3dqZ pppd[23203]: Peer wyx1 failed CHAP authentication Mar 27 00:56:07 iZ2597ft3dqZ pptpd[23202]: CTRL: EOF or bad error reading ctrl packet length. Mar 27 00:56:07 iZ2597ft3dqZ pptpd[23202]: CTRL: couldn't read packet header (exit) Mar 27 00:56:07 iZ2597ft3dqZ pptpd[23202]: CTRL: CTRL read failed Mar 27 00:56:07 iZ2597ft3dqZ pppd[23203]: Modem hangup Mar 27 00:56:07 iZ2597ft3dqZ pppd[23203]: Connection terminated. Mar 27 00:56:07 iZ2597ft3dqZ pppd[23203]: Exit. Mar 27 00:56:07 iZ2597ft3dqZ pptpd[23202]: CTRL: Client control connection finished config file: # cat /etc/raddb/clients.conf: client localhost { ipaddr = 127.0.0.1 proto = * secret = testing123 require_message_authenticator = no limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 secret = testing123 } # cat /etc/raddb/radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} modconfdir = ${confdir}/mods-config certdir = ${confdir}/certs cadir = ${confdir}/certs run_dir = ${localstatedir}/run/${name} db_dir = ${localstatedir}/lib/radiusd libdir = /usr/lib64/freeradius pidfile = ${run_dir}/${name}.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 hostname_lookups = no log { destination = files colourise = yes file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no msg_denied = "You are already logged in - access denied" } checkrad = ${sbindir}/checkrad security { user = radiusd group = radiusd allow_core_dumps = no max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 auto_limit_acct = no } modules { $INCLUDE mods-enabled/ } instantiate { } policy { $INCLUDE policy.d/ } $INCLUDE sites-enabled/ cat /etc/raddb/users bob Cleartext-Password := "hello" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP cat /etc/raddb/site-enabled/default server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { filter_username preprocess auth_log chap mschap digest suffix eap { ok = return } sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest eap } preacct { preprocess acct_unique suffix } accounting { detail unix sql exec attr_filter.accounting_response } session { radutmp sql } post-auth { reply_log sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } } pre-proxy { } post-proxy { eap } } # cat /etc/ppp/options.pptpd name pptpd refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 ms-dns 8.8.8.8 ms-dns 8.8.4.4 proxyarp debug lock nobsdcomp novj novjccomp nologfd plugin radius.so plugin radattr.so radius-config-file /etc/radiusclient-ng/radiusclient.conf # cat /usr/share/radiusclient-ng/dictionary # grep -v "#" dictionary | grep -v ^$ ATTRIBUTE User-Name 1 string ATTRIBUTE Password 2 string ATTRIBUTE CHAP-Password 3 string ATTRIBUTE NAS-IP-Address 4 ipaddr ATTRIBUTE NAS-Port-Id 5 integer ATTRIBUTE Service-Type 6 integer ATTRIBUTE Framed-Protocol 7 integer ATTRIBUTE Framed-IP-Address 8 ipaddr ATTRIBUTE Framed-IP-Netmask 9 ipaddr ATTRIBUTE Framed-Routing 10 integer ATTRIBUTE Filter-Id 11 string ATTRIBUTE Framed-MTU 12 integer ATTRIBUTE Framed-Compression 13 integer ATTRIBUTE Login-IP-Host 14 ipaddr ATTRIBUTE Login-Service 15 integer ATTRIBUTE Login-TCP-Port 16 integer ATTRIBUTE Reply-Message 18 string ATTRIBUTE Callback-Number 19 string ATTRIBUTE Callback-Id 20 string ATTRIBUTE Framed-Route 22 string ATTRIBUTE Framed-IPX-Network 23 ipaddr ATTRIBUTE State 24 string ATTRIBUTE Class 25 string ATTRIBUTE Vendor-Specific 26 string ATTRIBUTE Session-Timeout 27 integer ATTRIBUTE Idle-Timeout 28 integer ATTRIBUTE Termination-Action 29 integer ATTRIBUTE Called-Station-Id 30 string ATTRIBUTE Calling-Station-Id 31 string ATTRIBUTE NAS-Identifier 32 string ATTRIBUTE Proxy-State 33 string ATTRIBUTE Login-LAT-Service 34 string ATTRIBUTE Login-LAT-Node 35 string ATTRIBUTE Login-LAT-Group 36 string ATTRIBUTE Framed-AppleTalk-Link 37 integer ATTRIBUTE Framed-AppleTalk-Network 38 integer ATTRIBUTE Framed-AppleTalk-Zone 39 string ATTRIBUTE Acct-Status-Type 40 integer ATTRIBUTE Acct-Delay-Time 41 integer ATTRIBUTE Acct-Input-Octets 42 integer ATTRIBUTE Acct-Output-Octets 43 integer ATTRIBUTE Acct-Session-Id 44 string ATTRIBUTE Acct-Authentic 45 integer ATTRIBUTE Acct-Session-Time 46 integer ATTRIBUTE Acct-Input-Packets 47 integer ATTRIBUTE Acct-Output-Packets 48 integer ATTRIBUTE Acct-Terminate-Cause 49 integer ATTRIBUTE Acct-Multi-Session-Id 50 string ATTRIBUTE Acct-Link-Count 51 integer ATTRIBUTE Event-Timestamp 55 integer ATTRIBUTE CHAP-Challenge 60 string ATTRIBUTE NAS-Port-Type 61 integer ATTRIBUTE Port-Limit 62 integer ATTRIBUTE Login-LAT-Port 63 integer ATTRIBUTE Connect-Info 77 string ATTRIBUTE NAS-IPv6-Address 95 string ATTRIBUTE Framed-Interface-Id 96 string ATTRIBUTE Framed-IPv6-Prefix 97 string ATTRIBUTE Login-IPv6-Host 98 string ATTRIBUTE Framed-IPv6-Route 99 string ATTRIBUTE Framed-IPv6-Pool 100 string ATTRIBUTE Huntgroup-Name 221 string ATTRIBUTE User-Category 1029 string ATTRIBUTE Group-Name 1030 string ATTRIBUTE Simultaneous-Use 1034 integer ATTRIBUTE Strip-User-Name 1035 integer ATTRIBUTE Fall-Through 1036 integer ATTRIBUTE Add-Port-To-IP-Address 1037 integer ATTRIBUTE Exec-Program 1038 string ATTRIBUTE Exec-Program-Wait 1039 string ATTRIBUTE Hint 1040 string ATTRIBUTE Expiration 21 date ATTRIBUTE Auth-Type 1000 integer ATTRIBUTE Menu 1001 string ATTRIBUTE Termination-Menu 1002 string ATTRIBUTE Prefix 1003 string ATTRIBUTE Suffix 1004 string ATTRIBUTE Group 1005 string ATTRIBUTE Crypt-Password 1006 string ATTRIBUTE Connect-Rate 1007 integer VALUE Service-Type Login-User 1 VALUE Service-Type Framed-User 2 VALUE Service-Type Callback-Login-User 3 VALUE Service-Type Callback-Framed-User 4 VALUE Service-Type Outbound-User 5 VALUE Service-Type Administrative-User 6 VALUE Service-Type NAS-Prompt-User 7 VALUE Framed-Protocol PPP 1 VALUE Framed-Protocol SLIP 2 VALUE Framed-Routing None 0 VALUE Framed-Routing Broadcast 1 VALUE Framed-Routing Listen 2 VALUE Framed-Routing Broadcast-Listen 3 VALUE Framed-Compression None 0 VALUE Framed-Compression Van-Jacobson-TCP-IP 1 VALUE Login-Service Telnet 0 VALUE Login-Service Rlogin 1 VALUE Login-Service TCP-Clear 2 VALUE Login-Service PortMaster 3 VALUE Acct-Status-Type Start 1 VALUE Acct-Status-Type Stop 2 VALUE Acct-Status-Type Alive 3 VALUE Acct-Status-Type Accounting-On 7 VALUE Acct-Status-Type Accounting-Off 8 VALUE Acct-Authentic RADIUS 1 VALUE Acct-Authentic Local 2 VALUE Acct-Authentic PowerLink128 100 VALUE Termination-Action Default 0 VALUE Termination-Action RADIUS-Request 1 VALUE NAS-Port-Type Async 0 VALUE NAS-Port-Type Sync 1 VALUE NAS-Port-Type ISDN 2 VALUE NAS-Port-Type ISDN-V120 3 VALUE NAS-Port-Type ISDN-V110 4 VALUE Acct-Terminate-Cause User-Request 1 VALUE Acct-Terminate-Cause Lost-Carrier 2 VALUE Acct-Terminate-Cause Lost-Service 3 VALUE Acct-Terminate-Cause Idle-Timeout 4 VALUE Acct-Terminate-Cause Session-Timeout 5 VALUE Acct-Terminate-Cause Admin-Reset 6 VALUE Acct-Terminate-Cause Admin-Reboot 7 VALUE Acct-Terminate-Cause Port-Error 8 VALUE Acct-Terminate-Cause NAS-Error 9 VALUE Acct-Terminate-Cause NAS-Request 10 VALUE Acct-Terminate-Cause NAS-Reboot 11 VALUE Acct-Terminate-Cause Port-Unneeded 12 VALUE Acct-Terminate-Cause Port-Preempted 13 VALUE Acct-Terminate-Cause Port-Suspended 14 VALUE Acct-Terminate-Cause Service-Unavailable 15 VALUE Acct-Terminate-Cause Callback 16 VALUE Acct-Terminate-Cause User-Error 17 VALUE Acct-Terminate-Cause Host-Request 18 VALUE Auth-Type Local 0 VALUE Auth-Type System 1 VALUE Auth-Type SecurID 2 VALUE Auth-Type Crypt-Local 3 VALUE Auth-Type Reject 4 VALUE Auth-Type Pam 253 VALUE Auth-Type Accept 254 VALUE Fall-Through No 0 VALUE Fall-Through Yes 1 VALUE Add-Port-To-IP-Address No 0 VALUE Add-Port-To-IP-Address Yes 1 INCLUDE /usr/share/radiusclient-ng/dictionary.merit INCLUDE /usr/share/radiusclient-ng/dictionary.microsoft INCLUDE /usr/share/radiusclient-ng/dictionary.ascend INCLUDE /usr/share/radiusclient-ng/dictionary.compat I have googled a lot, but no big progress, any help is appreciated.

2 2