July 2017 - Freeradius-Users - lists.freeradius.org

FreeRADIUS 4.0.0 and DHCP
by Montana Bag 12 Jul '17

12 Jul '17

Hello all! I have a problem with "listen" section for the dhcp module. I download and install last version freeradius 4.0.0 (with github) I get this error: Debug : server dhcp { Error : /usr/local/etc/raddb/sites-enabled/dhcp[23]: virtual server dhcp MUST contain a 'namespace' option After adding the required option (namespace = "dhcpv4"): Debug : server dhcp { Debug : namespace = "dhcpv4" Error : /usr/local/etc/raddb/sites-enabled/dhcp[44]: Failed to link to module "proto_dhcpv4": /usr/local/lib/proto_dhcpv4.so: undefined symbol: common_socket_open : /usr/local/lib/proto_dhcpv4.so: undefined symbol: common_socket_open Error : /usr/local/etc/raddb/sites-enabled/dhcp[44]: Make sure it (and all its dependent libraries!) are in the search path of your system's ld Error : /usr/local/etc/raddb/sites-enabled/dhcp[44]: Failed loading proto module I change listen section: listen { type = dhcp transport = udp udp { ipaddr = * port = 67 } } But this did not work. Full output of 'radiusd -X' Info : FreeRADIUS Version 4.0.0 Info : Copyright (C) 1999-2017 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Info : Starting - reading configuration files ... Debug : Including dictionary file "/usr/local/share/freeradius/dictionary" Debug : Including dictionary file "/usr/local/etc/raddb/dictionary" Debug : Including configuration file "/usr/local/etc/raddb/radiusd.conf" Debug : Including configuration file "/usr/local/etc/raddb/clients.conf" Debug : Including files in directory "/usr/local/etc/raddb/mods-enabled/" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/linelog" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/unpack" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/files" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/soh" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/cache_eap" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/detail" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/logintime" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/chap" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/unix" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/digest" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/dhcpv4" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/exec" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/pap" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/expr" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/expiration" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/ntlm_auth" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/always" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/sradutmp" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/detail.log" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/utf8" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/radutmp" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/echo" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/attr_filter" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/passwd" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/client" Debug : Including configuration file "/usr/local/etc/raddb/mods-enabled/mschap" Debug : Including files in directory "/usr/local/etc/raddb/policy.d/" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/eap" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/vendor" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/canonicalization" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/accounting" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/abfab-tr" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/operator-name" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/debug" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/filter" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/cui" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/dhcp" Debug : Including configuration file "/usr/local/etc/raddb/policy.d/control" Debug : Including files in directory "/usr/local/etc/raddb/sites-enabled/" Debug : Including configuration file "/usr/local/etc/raddb/sites-enabled/dhcp" Debug : main { Debug : security { Debug : allow_core_dumps = no Debug : max_attributes = 200 Debug : reject_delay = 1.000000 Debug : status_server = yes Debug : allow_vulnerable_openssl = "yes" Debug : } Debug : name = "radiusd" Debug : prefix = "/usr/local" Debug : localstatedir = "/usr/local/var" Debug : run_dir = "/usr/local/var/run/radiusd" Debug : } Debug : main { Debug : security { Debug : allow_core_dumps = no Debug : max_attributes = 200 Debug : reject_delay = 1.000000 Debug : status_server = yes Debug : allow_vulnerable_openssl = "yes" Debug : } Debug : name = "radiusd" Debug : prefix = "/usr/local" Debug : localstatedir = "/usr/local/var" Debug : run_dir = "/usr/local/var/run/radiusd" Debug : sbindir = "/usr/local/sbin" Debug : logdir = "/usr/local/var/log/radius" Debug : libdir = "/usr/local/lib" Debug : radacctdir = "/usr/local/var/log/radius/radacct" Debug : hostname_lookups = no Debug : max_request_time = 30 Debug : cleanup_delay = 5 Debug : continuation_timeout = 15 Debug : max_requests = 16384 Debug : pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Debug : checkrad = "/usr/local/sbin/checkrad" Debug : debug_level = 0 Debug : proxy_requests = yes Debug : log { Debug : stripped_names = no Debug : auth = no Debug : auth_badpass = no Debug : auth_goodpass = no Debug : colourise = yes Debug : msg_denied = "You are already logged in - access denied" Debug : } Debug : resources { Debug : } Debug : server dhcp { Debug : namespace = "dhcpv4" Error : /usr/local/etc/raddb/sites-enabled/dhcp[44]: Failed to link to module "proto_dhcpv4": /usr/local/lib/proto_dhcpv4.so: undefined symbol: common_socket_open : /usr/local/lib/proto_dhcpv4.so: undefined symbol: common_socket_open Error : /usr/local/etc/raddb/sites-enabled/dhcp[44]: Make sure it (and all its dependent libraries!) are in the search path of your system's ld Error : /usr/local/etc/raddb/sites-enabled/dhcp[44]: Failed loading proto module uname -a Linux srv-debian8-template 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2+deb8u2 (2017-06-26) x86_64 GNU/Linux radiusd -v Info : radiusd: FreeRADIUS version 4.0.0, for host x86_64-unknown-linux-gnu, built on Jul 12 2017 at 14:06:38 Info : FreeRADIUS Version 4.0.0 Info : Copyright (C) 1999-2017 The FreeRADIUS server project and contributors Info : There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Info : PARTICULAR PURPOSE Info : You may redistribute copies of FreeRADIUS under the terms of the Info : GNU General Public License Info : For more information about these matters, see the file named COPYRIGHT Before that, I used freeradius 4.0.0 with the dhcp module and it worked How to properly configure the socket for DHCP? Thanks for your help. Ivan

3 2

eap: Freeradius proxy doesn't work with EAP PEAP auth
by Danilo Raspa 12 Jul '17

12 Jul '17

Hi everybody, I have a problem with radius. This my architecture: 1. AP 192.168.0.210 2. Radius proxy: 192.168.0.158 3. Radius server: 192.168.0.243 The operating system of both radius server and radius proxy is CentOS 7, I have installed freeradius 3.0.4. I use MySQL to store the users. When I try to connect by using the command "radtest" everything works perfectly, here the command: "radtest danilo.raspa(a)realm_example.com 1234 192.168.0.158 18120 password" The problem is that when I try to connect from my phone using EAP PEAP(using same danilo.raspa(a)realm_example.com/1234) I recieve an "Access Reject" message from the radius server (this is the error: "eap : Identity does not match User-Name, setting from EAP Identity"). Here are some other info: proxy.conf (from radius proxy) [.. default part ..] home_server server1 { type = auth ipaddr = 192.168.0.243 port = 1812 secret = password } home_server_pool server_pool { type = fail-over home_server = server1 } realm "realm_example.com" { auth_pool = server_pool } --------------------------------- mods-enabled/eap eap { default_eap_type = peap proxy_tunneled_request_as_eap = no [..] } --------------------------------- User in table radcheck from schema radius: username: danilo.raspa attribute: Cleartext-Password op: := val: 1234 --------------------------------- Log request from RADIUS PROXY: Received Access-Request Id 168 from 192.168.0.210:3126 to 192.168.0.158:1812 length 168 User-Name = 'danilo.raspa(a)realm_example.com' NAS-IP-Address = 192.168.0.210 NAS-Identifier = 'RalinkAP0' NAS-Port = 0 Called-Station-Id = '80-1F-02-E0-D9-00' Calling-Station-Id = 'EC-9B-F3-64-E8-00' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201001d0164616e696c6f2e7261737061406d6f76656e64612e636f6d Message-Authenticator = 0x450b54bc468fdabb50573826f97ac97a (0) Received Access-Request packet from host 192.168.0.210 port 3126, id=168, length=168 (0) User-Name = 'danilo.raspa(a)realm_example.com' (0) NAS-IP-Address = 192.168.0.210 (0) NAS-Identifier = 'RalinkAP0' (0) NAS-Port = 0 (0) Called-Station-Id = '80-1F-02-E0-D9-00' (0) Calling-Station-Id = 'EC-9B-F3-64-E8-00' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) EAP-Message = 0x0201001d0164616e696c6f2e7261737061406d6f76656e64612e636f6d (0) Message-Authenticator = 0x450b54bc468fdabb50573826f97ac97a (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log : --> /var/log/radius/radacct/ 192.168.0.210/auth-detail-20170705 (0) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.210/auth-detail-20170705 (0) auth_log : EXPAND %t (0) auth_log : --> Wed Jul 5 14:55:26 2017 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : Looking up realm "realm_example.com" for User-Name = " danilo.raspa(a)realm_example.com" (0) suffix : Found realm "realm_example.com" (0) suffix : Adding Stripped-User-Name = "danilo.raspa" (0) suffix : Adding Realm = "realm_example.com" (0) suffix : Proxying request from user danilo.raspa to realm realm_example.com (0) suffix : Preparing to proxy authentication request to realm " realm_example.com" (0) [suffix] = updated (0) eap : Request is supposed to be proxied to Realm realm_example.com. Not doing EAP. (0) [eap] = noop (0) sql : EXPAND %{User-Name} (0) sql : --> danilo.raspa(a)realm_example.com (0) sql : SQL-User-Name set to 'danilo.raspa(a)realm_example.com' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'danilo.raspa(a)realm_example.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'danilo.raspa(a)realm_example.com' ORDER BY id' (0) sql : User found in radcheck table (0) sql : Check items matched (0) sql : EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql : --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'danilo.raspa(a)realm_example.com' ORDER BY id rlm_sql (sql): Executing query: 'SELECT id, username, attribute, value, op FROM radreply WHERE username = 'danilo.raspa(a)realm_example.com' ORDER BY id' (0) sql : EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql : --> SELECT groupname FROM radusergroup WHERE username = ' danilo.raspa(a)realm_example.com' ORDER BY priority rlm_sql (sql): Executing query: 'SELECT groupname FROM radusergroup WHERE username = 'danilo.raspa(a)realm_example.com' ORDER BY priority' (0) sql : User not found in any groups rlm_sql (sql): Released connection (4) rlm_sql (sql): Closing connection (0), from 1 unused connections rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (3): Hit idle_timeout, was idle for 88 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (2): Hit idle_timeout, was idle for 88 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket rlm_sql (sql): Closing connection (1): Hit idle_timeout, was idle for 88 seconds rlm_sql (sql): You probably need to lower "min" rlm_sql_mysql: Socket destructor called, closing socket (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 41438 (0) Proxying request to home server 192.168.0.243 port 1812 timeout 30.000000 (0) Sending Access-Request packet to host 192.168.0.243 port 1812, id=158, length=0 (0) User-Name = 'danilo.raspa' (0) NAS-IP-Address = 192.168.0.210 (0) NAS-Identifier = 'RalinkAP0' (0) NAS-Port = 0 (0) Called-Station-Id = '80-1F-02-E0-D9-A0' (0) Calling-Station-Id = 'EC-9B-F3-64-E8-D8' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) EAP-Message = 0x0201001d0164616e696c6f2e7261737061406d6f76656e64612e636f6d (0) Message-Authenticator = 0x450b54bc468fdabb50573826f97ac97a (0) Event-Timestamp = 'Jul 5 2017 14:55:26 CEST' (0) Stripped-User-Name = 'danilo.raspa' (0) Realm = 'realm_example.com' (0) EAP-Type = Identity (0) Proxy-State = 0x313638 Sending Access-Request Id 158 from 0.0.0.0:41438 to 192.168.0.243:1812 User-Name = 'danilo.raspa' NAS-IP-Address = 192.168.0.210 NAS-Identifier = 'RalinkAP0' NAS-Port = 0 Called-Station-Id = '80-1F-02-E0-D9-00' Calling-Station-Id = 'EC-9B-F3-64-E8-00' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201001d0164616e696c6f2e7261737061406d6f76656e64612e636f6d Message-Authenticator = 0x450b54bc468fdabb50573826f97ac97a Event-Timestamp = 'Jul 5 2017 14:55:26 CEST' Proxy-State = 0x313638 Waking up in 0.3 seconds. Waking up in 0.1 seconds. (0) Expecting proxy response no later than 29.499665 seconds from now Waking up in 29.4 seconds. Received Access-Request Id 168 from 192.168.0.210:3126 to 192.168.0.158:1812 length 168 Suppressing duplicate proxied request (too fast) to home server 192.168.0.243 port 1812 proto TCP - ID: 158 Waking up in 29.0 seconds. Received Access-Reject Id 158 from 192.168.0.243:1812 to 192.168.0.158:41438 length 25 Proxy-State = 0x313638 (0) Received Access-Reject packet from host 192.168.0.243 port 1812, id=158, length=25 (0) Proxy-State = 0x313638 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) post-proxy { (0) eap : No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = noop (0) Login incorrect (Home Server says so): [danilo.raspa(a)realm_example.com] (from client company-intranet port 0 cli EC-9B-F3-64-E8-00) (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql : EXPAND .query (0) sql : --> .query (0) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND %{User-Name} (0) sql : --> danilo.raspa(a)realm_example.com (0) sql : SQL-User-Name set to 'danilo.raspa(a)realm_example.com' (0) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'danilo.raspa(a)realm_example.com', '', 'Access-Reject', '2017-07-05 14:55:26') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'danilo.raspa(a)realm_example.com', '', 'Access-Reject', '2017-07-05 14:55:26')' rlm_sql (sql): Released connection (4) rlm_sql (sql): 0 of 1 connections in use. Need more spares rlm_sql (sql): Opening additional connection (5) rlm_sql_mysql: Starting connect to MySQL server (0) [sql] = ok (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> danilo.raspa(a)realm_example.com (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Request was previously rejected, inserting EAP-Failure (0) [eap] = updated (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sending Access-Reject packet to host 192.168.0.210 port 3126, id=168, length=0 (0) EAP-Message = 0x04010004 (0) Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Reject Id 168 from 192.168.0.158:1812 to 192.168.0.210:3126 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 168 with timestamp +88 Ready to process requests --------------------------------- Log request from RADIUS SERVER: Received Access-Request Id 158 from 192.168.0.158:41438 to 192.168.0.243:1812 length 167 User-Name = 'danilo.raspa' NAS-IP-Address = 192.168.0.210 NAS-Identifier = 'RalinkAP0' NAS-Port = 0 Called-Station-Id = '80-1F-02-E0-D9-00' Calling-Station-Id = 'EC-9B-F3-64-E8-00' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201001d0164616e696c6f2e7261737061406d6f76656e64612e636f6d Message-Authenticator = 0x1a099d1b62181477dc9bd471b56d829e Event-Timestamp = 'Jul 5 2017 14:55:26 CEST' Proxy-State = 0x313638 (0) Received Access-Request packet from host 192.168.0.158 port 41438, id=158, length=167 (0) User-Name = 'danilo.raspa' (0) NAS-IP-Address = 192.168.0.210 (0) NAS-Identifier = 'RalinkAP0' (0) NAS-Port = 0 (0) Called-Station-Id = '80-1F-02-E0-D9-00' (0) Calling-Station-Id = 'EC-9B-F3-64-E8-00' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) EAP-Message = 0x0201001d0164616e696c6f2e7261737061406d6f76656e64612e636f6d (0) Message-Authenticator = 0x1a099d1b62181477dc9bd471b56d829e (0) Event-Timestamp = 'Jul 5 2017 14:55:26 CEST' (0) Proxy-State = 0x313638 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log : --> /var/log/radius/radacct/ 192.168.0.158/auth-detail-20170705 (0) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.158/auth-detail-20170705 (0) auth_log : EXPAND %t (0) auth_log : --> Wed Jul 5 14:55:26 2017 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "danilo.raspa", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : Peer sent code Response (2) ID 1 length 29 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Identity does not match User-Name, setting from EAP Identity <-----[I think that the problem is HERE!!] (0) eap : Failed in handler (0) [eap] = invalid (0) } # authenticate = invalid (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql : EXPAND .query (0) sql : --> .query (0) sql : Using query template 'query' rlm_sql (sql): Reserved connection (4) (0) sql : EXPAND %{User-Name} (0) sql : --> danilo.raspa (0) sql : SQL-User-Name set to 'danilo.raspa' (0) sql : EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql : --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'danilo.raspa', '', 'Access-Reject', '2017-07-05 14:55:26') rlm_sql (sql): Executing query: 'INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'danilo.raspa', '', 'Access-Reject', '2017-07-05 14:55:26')' rlm_sql (sql): Released connection (4) (0) [sql] = ok (0) attr_filter.access_reject : EXPAND %{User-Name} (0) attr_filter.access_reject : --> danilo.raspa (0) attr_filter.access_reject : Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) eap : Identity does not match User-Name, setting from EAP Identity (0) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (0) [eap] = noop (0) remove_reply_message_if_eap remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else else { (0) [noop] = noop (0) } # else else = noop (0) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sending Access-Reject packet to host 192.168.0.158 port 41438, id=158, length=0 (0) Proxy-State = 0x313638 Sending Access-Reject Id 158 from 192.168.0.243:1812 to 192.168.0.158:41438 Proxy-State = 0x313638 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 158 with timestamp +7 Ready to process requests ---------------------------------------- Thanks in advance Danilo Raspa

2 11

What capacity does radtest have to display custom attributes
by Mark Williams 11 Jul '17

11 Jul '17

I’ve been experimenting with the server, trying to get it to return arbitrary custom attributes (defined in dictionary.local) to the Radius-reply. When I run radtest against the virtual-server I see the attributes being added and mentioned in the post-auth debug, but I never see the attribute on the client side of the radtest. Is radtest limited to only displaying officially defined attributes, or might I be doing something obviously ridiculous? Radius Debug ~~~ 0) Sending Access-Accept packet to host 192.0.2.90 port 36843, id=194, length=0 (0) Entitlement := 'vpn-library' (0) Juniper-Ip-Pool-Name := 'vpn-library' Sending Access-Accept Id 194 from 192.0.2.53:1828 to 192.0.2.90:36843 Juniper-Ip-Pool-Name := 'vpn-library’ Radtest Output ~~~ Sending Access-Request Id 194 from 0.0.0.0:36843 to 192.0.2.53:1828 User-Name = ‘glados' User-Password = ‘ilovecake' NAS-IP-Address = 192.0.2.90 NAS-Port = 0 Message-Authenticator = 0x00 Received Access-Accept Id 194 from 192.0.2.53:1828 to 192.0.2.90:36843 length 39 Juniper-Ip-Pool-Name = 'vpn-library' ======================= Mark Williams markhw(a)vt.edu (2A83CAC8)

3 4

Parsing Value with External Script
by Jean Tomaz 10 Jul '17

10 Jul '17

I have a question. I need to pass a value to Framed-Pool attribute only to one user, using an external script. My file /etc/freeradius/users user_test Cleartext-Password := "testing" Auth-Type := Accept Framed-Protocol = PPP Framed-Pool = `%{exec:/bin/echo foo}` Fall-Through = Yes It's not working. What it's happening? Using the freeradius debug the Framed-Pool attribute is appearing empty.

5 9

Trying to understand expression in SQL module
by Kenroy 10 Jul '17

10 Jul '17

Hello everyone, I am reading the sql model query config trying to understand it. I came across the following an expression *${....acct_table1}* . What is the purpose of the the ellipsis (....) in front of the variable acct_table1. See below for full query expression. INSERT INTO* ${....acct_table1}* \ (${...column_list}) \ VALUES(\ '%{Acct-Session-Id}', \ '%{Acct-Unique-Session-Id}', \ '%{SQL-User-Name}', \ NULLIF('%{Realm}', ''), \ '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}', \ NULLIF('%{%{NAS-Port-ID}:-%{NAS-Port}}', ''), \ '%{NAS-Port-Type}', \ TO_TIMESTAMP(%{integer:Event-Timestamp}), \ TO_TIMESTAMP(%{integer:Event-Timestamp}), \ NULL, \ 0, \ '%{Acct-Authentic}', \ '%{Connect-Info}', \ NULL, \ 0, \ 0, \ '%{Called-Station-Id}', \ '%{Calling-Station-Id}', \ NULL, \ '%{Service-Type}', \ '%{Framed-Protocol}', \ NULLIF('%{Framed-IP-Address}', '')::inet), \ '%{Nomadix-User-Definable-1}', \ '%{Nomadix-User-Definable-2}', \ '%{NAS-Identifier}' "

2 4

timeout and period values are rounded
by denis 09 Jul '17

09 Jul '17

Hello, I'm trying to play with timeouts and periods in my proxy setup. Changing values: zombie_period, response_window in debug log getting warnings: WARNING: Ignoring "response_window = 60.000000", forcing to "response_window = 30.000000" WARNING: Ignoring "zombie_period = 10", forcing to "zombie_period = 30" experimented a bit and found that if I set response_window = 70, it will be rounded to 60 i.e WARNING: Ignoring "response_window = 70.000000", forcing to "response_window = 60.000000" if I set zombie_period = 0, it will be rounded to 1: WARNING: Ignoring "zombie_period = 0", forcing to "zombie_period = 1" but didn't find any way to get any other values, like zombie_period = 15 or response_window = 50. they're always rounded to some other value, and I was not able to find in docs how/why it's rounded. freeradius 3.0.12 Also I have wider/general question: Are there any "best practices" for high latency links with proxy setup. When NAS'es are far from home server. Actually adjusting timeouts and periods I'm trying to fight continuous zombie/alive issue: Sun Jul 9 08:55:51 2017 : ERROR: (503) ERROR: Failing proxied request for user "user1", due to lack of any response from home server 46.111.128.2 port 1813 Sun Jul 9 08:57:17 2017 : Proxy: (515) Marking home server 46.111.128.2 port 1813 alive -- Denis

3 5

Active Directory authentication into subtree sctructure
by Alejandro Cabrera Obed 07 Jul '17

07 Jul '17

Dear, I've implemented a Freeradius service that let authenticate users with PEAP/MSCHAPv2/NTLM against an Active Directory tree from a Windows Domain Controller server. In this scenario every user is authenticated developing a search from the root of the Active Directory tree. Suppose my domain is "company.com", and now I need to authenticate users against some subtrees like these: sales.company.com support.company.com and not from the AD's root: company.com Is this possible to do this with my current implementation? Thanks in advance, regards.

2 1

upgrade unlang from 2.1.12 to 3.0.14
by adrian.p.smith＠bt.com 07 Jul '17

07 Jul '17

We have a fairly complex configuration running on an ageing 2.1.12 version of FreeRadius. We are looking to upgrade to latest 3.0.14 for various reasons. I'm having some issues with some of the unlang and would be grateful for some clarification please? We have config similar to: if ( !(Cisco-SSG-Service-Info) && ("%{Tunnel-Type}" != "VLAN") ) { ... } and if ( ("%{Acct-Status-Type}" == "Stop") && ("%{Tunnel-Type}" == "VLAN") && ("%{client:operator}" != "WLC") ) { ... } But are seeing error messages such as: ERROR: Failed retrieving values required to evaluate condition So questions are: 1. Testing presence of an attribute I think is now "if ( &Cisco-SSG-Service-Info )" ? 2. Can I test presence of and value of an attribute of a variable at the same time, i.e. "if (&Cisco-SSG-Service-Info = "fred" )" ? 3. How can I now do "client:operator" ? Thanks Adrian

4 13

Windows mobile unable to authenticate [FreeRadius+Active directory]
by Burn Zero 07 Jul '17

07 Jul '17

Hi, FreeRadius version 3.0.13 We are using FreeRadius+Active directory setup in our environment to authenticate users for the WIFI. The clients are authenticated using server side cert + their Active directory credentials. This is working properly except windows phone users. Users who own windows phone are unable to authenticate via Freeradius. Below is the debug error log when they try to connect WIFI. (5829) Mon Jun 5 07:53:43 2017: Debug: eap: Calling submodule eap_peap to process data (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Continuing EAP-TLS (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: [eaptls verify] = ok (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Done initial handshake (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: [eaptls process] = ok (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Session established. Decoding tunneled attributes (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: PEAP state send tlv success (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Received EAP-TLV response (5829) Mon Jun 5 07:53:43 2017: Debug: eap_peap: Client rejected our response. The password is probably incorrect (5829) Mon Jun 5 07:53:43 2017: ERROR: eap_peap: We sent a success, but the client did not agree (5829) Mon Jun 5 07:53:43 2017: ERROR: eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed (5829) Mon Jun 5 07:53:43 2017: Debug: eap: Sending EAP Failure (code 4) ID 11 length 4 (5829) Mon Jun 5 07:53:43 2017: Debug: eap: Failed in EAP select Does any one of you know what the problem is? Thank in advance for the help.

3 8

FreeRADIUS 3.0.12, Ubuntu 16.04 - Python module is unable to load
by Cuong Nguyen 05 Jul '17

05 Jul '17

Hi, I am trying to develop a python module and hook it into FreeRADIUS. The module supposes to query LDAP for some specific parameters and allows or rejects user's access based on the result. For some reasons, whenever I try to import ldap3 module ( http://ldap3.readthedocs.io) I encounter this issue: Python version: 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609] python_function_load - Module 'session_limit' not found <class 'ldap3.core.exceptions.LDAPSSLNotSupportedError'> (SSL not supported in this Python interpreter) python_function_load - Failed to import python function 'session_limit.instantiate' /etc/freeradius/mods-enabled/python[9]: Instantiation failed for module "python" Remove the import in the module, it works fine. Is there anything I could do to solve this? With the same script I can run using normal python environment (the script has the import ldap3). Below is the debug with import ldap3 root@rad01:/etc/freeradius/mods-config/python# freeradius -X FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/mysql/queries.conf including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/python including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/ldap including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/passwd including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/dhcp including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/control-socket including configuration file /etc/freeradius/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no msg_badpass = "Password is wrong" colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm starhub.com { auth_pool = my_auth_failover } realm LOCAL { } realm ~(.*\.)*webspeed\.com.sg$ { auth_pool = my_auth_failover } realm ~(.*\.)*starhub\.com$ { auth_pool = my_auth_failover } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.254.1 { ipaddr = 192.168.254.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client private-network-2 { ipaddr = 61.0.240.0/24 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" logfile = "/var/log/freeradius/sqllog.sql" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" query_timeout = 5 accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_python # Loading module "python" from file /etc/freeradius/mods-enabled/python python { mod_instantiate = "session_limit" func_instantiate = "instantiate" mod_authorize = "session_limit" func_authorize = "authorize" mod_authenticate = "session_limit" func_authenticate = "authenticate" mod_preacct = "session_limit" func_preacct = "preacct" mod_accounting = "session_limit" func_accounting = "accounting" mod_checksimul = "session_limit" func_checksimul = "checksimul" mod_pre_proxy = "session_limit" func_pre_proxy = "pre_proxy" mod_post_proxy = "session_limit" func_post_proxy = "post_proxy" mod_post_auth = "session_limit" func_post_auth = "post_auth" mod_recv_coa = "session_limit" func_recv_coa = "recv_coa" mod_send_coa = "session_limit" func_send_coa = "send_coa" mod_detach = "session_limit" func_detach = "instantiate" python_path = "/etc/freeradius/mods-config/python:/usr/lib/python2.7/dist-packages/:/usr/lib/python2.7/" cext_compat = yes } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap ldap { server = "192.168.254.110" port = 389 identity = "cn=admin,dc=starhub,dc=com" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "ou=Adsl-User,o=webspeed.com.sg,dc=starhub,dc=com" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } instantiate { } # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "sql" from file /etc/freeradius/mods-enabled/sql rlm_sql_mysql: libmysql version: 5.7.18 mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.18-0ubuntu0.16.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.18-0ubuntu0.16.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.18-0ubuntu0.16.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.18-0ubuntu0.16.04.1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.7.18-0ubuntu0.16.04.1, protocol version 10 # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "python" from file /etc/freeradius/mods-enabled/python Python version: 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609] python_function_load - Module 'session_limit' not found <class 'ldap3.core.exceptions.LDAPSSLNotSupportedError'> (SSL not supported in this Python interpreter) python_function_load - Failed to import python function 'session_limit.instantiate' /etc/freeradius/mods-enabled/python[9]: Instantiation failed for module "python" root@rad01:/etc/freeradius/mods-config/python#

4 5