August 2017 - Freeradius-Users - lists.freeradius.org

Adding attributes to Access-Reply
by matt.southward＠gmail.com 22 Aug '17

22 Aug '17

Forgive me if this is an obvious thing...I've been looking at the documentation and it just isn't clicking for me. I need to send the Framed-IP-Address and the Service-Type attributes in the Access-Reply. In my post-auth section of my default file I've added update reply { Service-Type = "Framed-User" }. How do I specify the Framed-IP-Address? This value will be returned from a SQL query, if there is no value default to 255.255.255.254.

2 1

Trouble running ntlm_auth with mschap
by Dirk Bonenkamp - ProActive 21 Aug '17

21 Aug '17

Hi All, I'm running Ubuntu 16.04 LTS, Samba 4.3.11 and Freeradius 3.0.15. I'm having trouble using mschap when authenticating against my AD using ntlm_auth. Testing with wbinfo or ntlm_auth from the command line works. Running NTLM_AUTH trough freeradius (configured by myself, which just calls ntlm_auth staight), works fine: radtest dirk MyPaSsWord localhost 0 testing123 Ouput: (2) Found Auth-Type = NTLM_AUTH (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) Auth-Type NTLM_AUTH { (2) ntlm_auth: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=PROACTIVE --username=%{mschap:User-Name} --password=%{User-Password}: (2) ntlm_auth: EXPAND --username=%{mschap:User-Name} (2) ntlm_auth: --> --username=dirk (2) ntlm_auth: EXPAND --password=%{User-Password} (2) ntlm_auth: --> --password=MyPaSsWord (2) ntlm_auth: Program returned code (0) and output 'NT_STATUS_OK: Success (0x0)' (2) ntlm_auth: Program executed successfully (2) [ntlm_auth] = ok (2) } # Auth-Type NTLM_AUTH = ok But when running: radtest -t mschap dirk MyPaSsWord localhost 0 testing123 I get: (0) Found Auth-Type = mschap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) mschap: Client is using MS-CHAPv1 with NT-Password (0) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=PROACTIVE --username=%{mschap:User-Name} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (0) mschap: EXPAND --username=%{mschap:User-Name} (0) mschap: --> --username=dirk (0) mschap: mschap1: a2 (0) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (0) mschap: --> --challenge=a2ecd01e5bdf0ef6 (0) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (0) mschap: --> --nt-response=28c30e8ce6d1a2ecd6877be94a654d6336afa03527aace03 (0) mschap: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' (0) mschap: External script failed (0) mschap: ERROR: External script says: Logon failure (0xc000006d) (0) mschap: ERROR: MS-CHAP2-Response is incorrect (0) [mschap] = reject I'm really puzzled here... I had this working on an Ubuntu 12.04 / freeradius 2.x setup, but I'm really stuck now. Any help or hints are highly appreciated. Thank you in advance, kind regards, Dirk

2 3

TLS Alert read:fatal:unknown CA
by Fatih Naufal 21 Aug '17

21 Aug '17

Hi everyone, I already success create 802.1x wireless authentication using freeradius and ldap, i did a test to every device that i have (iphone and laptop running windows 10 can connect to 802.1x wireless) but when i try to conenct on laptop running windows 7 there's "TLS Alert read:fatal:unknown CA" error. I already re-create the root CA (i did this following documentation http://deployingradius.com/documents/configuration/certificates.html) import it to the client, and ensure every detail of the certificate. Is there any bug with windows 7 or something? any kind of help would be appreciated. Thankyou (ca.cnf and server.cnf attached) Radius log : (0) Received Access-Request Id 60 from 172.30.254.3:49431 to 172.29.164.218:1812 length 267 (0) User-Name = "gpler" (0) Chargeable-User-Identity = 0x03 (0) Location-Capable = Civix-Location (0) Calling-Station-Id = "6c-71-d9-a9-5e-65" (0) Called-Station-Id = "58-ac-78-ee-8a-20:802.1x" (0) NAS-Port = 1 (0) Cisco-AVPair = "audit-session-id=03fe1eac0003fe3fa18e9759" (0) Acct-Session-Id = "59978ea1/6c:71:d9:a9:5e:65/71057" (0) NAS-IP-Address = 172.30.xxx.x (0) NAS-Identifier = "IPB-WLC-5520" (0) Airespace-Wlan-Id = 69 (0) Service-Type = Framed-User (0) Framed-MTU = 1300 (0) NAS-Port-Type = Wireless-802.11 (0) Tunnel-Type:0 = VLAN (0) Tunnel-Medium-Type:0 = IEEE-802 (0) Tunnel-Private-Group-Id:0 = "255" (0) EAP-Message = 0x0202000a0167706c6572 (0) Message-Authenticator = 0x107b01b20e515d3a076209dea9af2966 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "gpler", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 2 length 10 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_peap to process data (0) eap_peap: Initiating new EAP-TLS session (0) eap_peap: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 3 length 6 (0) eap: EAP session adding &reply:State = 0x68d16d7c68d27498 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Sent Access-Challenge Id 60 from 172.29.164.218:1812 to 172.30.xxx.x:49431 length 0 (0) EAP-Message = 0x010300061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x68d16d7c68d27498a8bfbed341c368c9 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 61 from 172.30.254.3:49431 to 172.29.164.218:1812 length 380 (1) User-Name = "gpler" (1) Chargeable-User-Identity = 0x03 (1) Location-Capable = Civix-Location (1) Calling-Station-Id = "6c-71-d9-a9-5e-65" (1) Called-Station-Id = "58-ac-78-ee-8a-20:802.1x" (1) NAS-Port = 1 (1) Cisco-AVPair = "audit-session-id=03fe1eac0003fe3fa18e9759" (1) Acct-Session-Id = "59978ea1/6c:71:d9:a9:5e:65/71057" (1) NAS-IP-Address = 172.30.xxx.x (1) NAS-Identifier = "IPB-WLC-5520" (1) Airespace-Wlan-Id = 69 (1) Service-Type = Framed-User (1) Framed-MTU = 1300 (1) NAS-Port-Type = Wireless-802.11 (1) Tunnel-Type:0 = VLAN (1) Tunnel-Medium-Type:0 = IEEE-802 (1) Tunnel-Private-Group-Id:0 = "255" (1) EAP-Message = 0x0203006919800000005f160301005a01000056030159978e892bc0cea1314b3076e48c1432d22b3a1f575d2bd9ef5eadcd1efab780000018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 (1) State = 0x68d16d7c68d27498a8bfbed341c368c9 (1) Message-Authenticator = 0x9e55b07936045ad7e26084813251454b (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "gpler", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 3 length 105 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x68d16d7c68d27498 (1) eap: Finished EAP session with state 0x68d16d7c68d27498 (1) eap: Previous EAP request found for state 0x68d16d7c68d27498, released from the list (1) eap: Peer sent packet with method EAP PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Continuing EAP-TLS (1) eap_peap: Peer indicated complete TLS record size will be 95 bytes (1) eap_peap: Got complete TLS record (95 bytes) (1) eap_peap: [eaptls verify] = length included (1) eap_peap: (other): before/accept initialization (1) eap_peap: TLS_accept: before/accept initialization (1) eap_peap: <<< recv TLS 1.0 Handshake [length 005a], ClientHello (1) eap_peap: TLS_accept: unknown state (1) eap_peap: >>> send TLS 1.0 Handshake [length 0031], ServerHello (1) eap_peap: TLS_accept: unknown state (1) eap_peap: >>> send TLS 1.0 Handshake [length 02c0], Certificate (1) eap_peap: TLS_accept: unknown state (1) eap_peap: >>> send TLS 1.0 Handshake [length 0004], ServerHelloDone (1) eap_peap: TLS_accept: unknown state (1) eap_peap: TLS_accept: unknown state (1) eap_peap: TLS_accept: unknown state (1) eap_peap: TLS_accept: Need to read more data: unknown state (1) eap_peap: TLS_accept: Need to read more data: unknown state (1) eap_peap: In SSL Handshake Phase (1) eap_peap: In SSL Accept mode (1) eap_peap: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 4 length 778 (1) eap: EAP session adding &reply:State = 0x68d16d7c69d57498 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Sent Access-Challenge Id 61 from 172.29.164.218:1812 to 172.30.xxx.x:49431 length 0 (1) EAP-Message = 0x0104030a190016030100310200002d03016e22346727c2b7bfd58d3b5bd06acbc17fa96d02f7937abfe946a411c305079800002f000005ff0100010016030102c00b0002bc0002b90002b6308202b23082019aa003020102020900e889295aaea3149d300d06092a864886f70d01010b05003011310f30 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x68d16d7c69d57498a8bfbed341c368c9 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 62 from 172.30.xxx.x:49431 to 172.29.164.218:1812 length 292 (2) User-Name = "gpler" (2) Chargeable-User-Identity = 0x03 (2) Location-Capable = Civix-Location (2) Calling-Station-Id = "6c-71-d9-a9-5e-65" (2) Called-Station-Id = "58-ac-78-ee-8a-20:802.1x" (2) NAS-Port = 1 (2) Cisco-AVPair = "audit-session-id=03fe1eac0003fe3fa18e9759" (2) Acct-Session-Id = "59978ea1/6c:71:d9:a9:5e:65/71057" (2) NAS-IP-Address = 172.30.xxx.x (2) NAS-Identifier = "IPB-WLC-5520" (2) Airespace-Wlan-Id = 69 (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Wireless-802.11 (2) Tunnel-Type:0 = VLAN (2) Tunnel-Medium-Type:0 = IEEE-802 (2) Tunnel-Private-Group-Id:0 = "255" (2) EAP-Message = 0x0204001119800000000715030100020230 (2) State = 0x68d16d7c69d57498a8bfbed341c368c9 (2) Message-Authenticator = 0xfd97ab9dc41ef3ae771c43ad2daa9331 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "gpler", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 4 length 17 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x68d16d7c69d57498 (2) eap: Finished EAP session with state 0x68d16d7c69d57498 (2) eap: Previous EAP request found for state 0x68d16d7c69d57498, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 7 bytes (2) eap_peap: Got complete TLS record (7 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: <<< recv TLS 1.0 Alert [length 0002], fatal unknown_ca *(2) eap_peap: ERROR: TLS Alert read:fatal:unknown CA* *(2) eap_peap: ERROR: TLS_accept: Failed in unknown state* *(2) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read)* *(2) eap_peap: ERROR: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca* *(2) eap_peap: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake failure* *(2) eap_peap: ERROR: System call (I/O) error (-1)* *(2) eap_peap: ERROR: TLS receive handshake failed during operation* *(2) eap_peap: ERROR: [eaptls process] = fail* *(2) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed* (2) eap: Sending EAP Failure (code 4) ID 4 length 4 (2) eap: Failed in EAP select (2) [eap] = invalid (2) } # authenticate = invalid (2) Failed to authenticate the user (2) Using Post-Auth-Type Reject (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Post-Auth-Type REJECT { (2) attr_filter.access_reject: EXPAND %{User-Name} (2) attr_filter.access_reject: --> gpler (2) attr_filter.access_reject: Matched entry DEFAULT at line 11 (2) [attr_filter.access_reject] = updated (2) [eap] = noop (2) policy remove_reply_message_if_eap { (2) if (&reply:EAP-Message && &reply:Reply-Message) { (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (2) else { (2) [noop] = noop (2) } # else = noop (2) } # policy remove_reply_message_if_eap = noop (2) } # Post-Auth-Type REJECT = updated (2) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (2) Sending delayed response (2) Sent Access-Reject Id 62 from 172.29.164.218:1812 to 172.30.xxx.x:49431 length 44 (2) EAP-Message = 0x04040004 (2) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 60 with timestamp +628 (1) Cleaning up request packet ID 61 with timestamp +628 (2) Cleaning up request packet ID 62 with timestamp +628

5 7

freeRadius Ldap connection error
by Dhivya Alagar 20 Aug '17

20 Aug '17

Hi All, I have set up a lab with 2 virtual boxes. One machine acts as freeRadius server and openldap server(backend). The other as radius client. I configured Radius server, modules for Ldap, openLdap server and everything is fine. I tested authenticating user in openLDAP server which also is good. radtest to localhost from the server throws error. *radius.log output:* Sun Aug 20 13:31:25 2017 : Info: rlm_sql (sql): Connected new DB handle, #31 Sun Aug 20 13:31:25 2017 : Info: Loaded virtual server <default> Sun Aug 20 13:31:25 2017 : Info: Loaded virtual server inner-tunnel Sun Aug 20 13:31:25 2017 : Info: Ready to process requests. Sun Aug 20 13:36:30 2017 : Error: [ldap] cn=Manager,dc=example,dc=com bind to radserv.example.com:389 failed Server is unwilling to perform Sun Aug 20 13:36:30 2017 : Error: [ldap] (re)connection attempt failed Sun Aug 20 14:03:23 2017 : Error: [ldap] cn=Manager,dc=example,dc=com bind to radserv.example.com:389 failed Server is unwilling to perform Sun Aug 20 14:03:23 2017 : Error: [ldap] (re)connection attempt failed [image: Inline image 1] *Here is the radiusd output* [root@radserv tmp]# radiusd -X radiusd: FreeRADIUS Version 2.2.6, for host i386-redhat-linux-gnu, built on Jul 18 2017 at 12:07:53 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "radsecret123" nastype = "other" } client 192.168.126.129 { ipaddr = 192.168.126.129 require_message_authenticator = no secret = "othersecret123" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ? modules { Module: Creating Auth-Type = digest Module: Creating Auth-Type = LDAP Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/raddb/modules/ldap ldap { server = "radserv.example.com" port = 389 password = "" expect_password = yes identity = "cn=Manager,dc=example,dc=com" net_timeout = 1 timeout = 4 timelimit = 5 max_uses = 0 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=example,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes keepalive { idle = 60 probes = 3 interval = 3 } } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x1693650 Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql): Connected new DB handle, #31 Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to authentication address * port 1812: Address already in use /etc/raddb/radiusd.conf[273]: Error binding to port for 0.0.0.0 port 1812 [root@radserv tmp]# *ldap module Configuration:* [root@radserv modules]# cat ldap # -*- text -*- # # $Id: d13892634e4a8458c942ce170f59f98521dce500 $ # Lightweight Directory Access Protocol (LDAP) # # This module definition allows you to use LDAP for # authorization and authentication. # # See raddb/sites-available/default for reference to the # ldap module in the authorize and authenticate sections. # # However, LDAP can be used for authentication ONLY when the # Access-Request packet contains a clear-text User-Password # attribute. LDAP authentication will NOT work for any other # authentication method. # # This means that LDAP servers don't understand EAP. If you # force "Auth-Type = LDAP", and then send the server a # request containing EAP authentication, then authentication # WILL NOT WORK. # # The solution is to use the default configuration, which does # work. # # Setting "Auth-Type = LDAP" is ALMOST ALWAYS WRONG. We # really can't emphasize this enough. # ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "radserv.example.com" identity = "cn=Manager,dc=example,dc=com" #password = mypass basedn = "dc=example,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # How many times the connection can be used before # being re-established. This is useful for things # like load balancers, which may exhibit sticky # behaviour without it. (0) is unlimited. max_uses = 0 # Port to connect on, defaults to 389. Setting this to # 636 will enable LDAPS if start_tls (see below) is not # able to be used. #port = 389 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 5 # # seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1 # # This subsection configures the tls related items # that control how FreeRADIUS connects to an LDAP # server. It contains all of the "tls_*" configuration # entries used in older versions of FreeRADIUS. Those # configuration entries can still be used, but we recommend # using these. # tls { # Set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # # The StartTLS operation is supposed to be # used with normal ldap connections instead of # using ldaps (port 636) connections start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # Certificate Verification requirements. Can be: # "never" (don't even bother trying) # "allow" (try, but don't fail if the cerificate # can't be verified) # "demand" (fail if the certificate doesn't verify.) # # The default is "allow" # require_cert = "demand" } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap # Set password_attribute = nspmPassword to get the # user's password from a Novell eDirectory # backend. This will work ONLY IF FreeRADIUS has been # built with the --with-edir configure option. # # See also the following links: # # http://www.novell.com/coolsolutions/appnote/16745.html # https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.S… # # Novell may require TLS encrypted sessions before returning # the user's password. # # password_attribute = userPassword # Un-comment the following to disable Novell # eDirectory account policy check and intruder # detection. This will work *only if* FreeRADIUS is # configured to build with --with-edir option. # edir_account_policy_check = no # # Group membership checking. Disabled by default. # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # The following two configuration items are for Active Directory # compatibility. If you see the helpful "operations error" # being returned to the LDAP module, uncomment the next # two lines. # # chase_referrals = yes # rebind = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # THIS WILL ONLY WORK FOR PAP AUTHENTICATION. # # THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes # ldap_debug: debug flag for LDAP SDK # (see OpenLDAP documentation). Set this to enable # huge amounts of LDAP debugging on the screen. # You should only use this if you are an LDAP expert. # # default: 0x0000 (no debugging messages) # Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS) #ldap_debug = 0x0028 # # Keepalive configuration. This MAY NOT be supported by your # LDAP library. If these configuration entries appear in the # output of "radiusd -X", then they are supported. Otherwise, # they are unsupported, and changing them will do nothing. # keepalive { # LDAP_OPT_X_KEEPALIVE_IDLE idle = 60 # LDAP_OPT_X_KEEPALIVE_PROBES probes = 3 # LDAP_OPT_X_KEEPALIVE_INTERVAL interval = 3 } } [root@radserv modules]# Am I missing something. Please let me know Thanks, Dhivya

2 1

How to block certain usernames hitting Freeradius server
by Burn Zero 19 Aug '17

19 Aug '17

Hi, We have setup Freeradius latest version to help users authenticate, authorize to 802.x WIFI. While analyzing logs, we found that certain user names ( with random alphabets ) that are trying to authenticate every certain minutes. Those are just invalid usernames some people have configured in their phone/tablet/system. They won't even get authentication success since those are anyways invalid usernames. What I am trying to achieve is to prevent these usernames from hitting Freeradius servers ( do username, group check in Active Directory) so that when those invalid usernames comes to Freeradius it would be filtered and no longer go inside tunnels and then for username check in Active directory. Thank you. - BurnZero

4 3

Re: TLS Alert read:fatal:unknown CA
by Alan Buxey 19 Aug '17

19 Aug '17

That's not the solution. That's just insecure! On 19 Aug 2017 4:07 am, "Edelberto Franco" <esilva(a)midiacom.uff.br> wrote: Hi. Try unckecking the box in your network configuration at win7. As you can see on (Passo 4): http://www.midiacom.uff.br/edu roam-br/arquivos/eduroamConfigWin7.pdf I think your are using an untrusted CA for windows (out of the default trusted CA list). --Edelberto Em 18-Aug-17 10:25 PM, Fatih Naufal escreveu: > Hi everyone, > > I already success create 802.1x wireless authentication using freeradius > and ldap, i did a test to every device that i have (iphone and laptop > running windows 10 can connect to 802.1x wireless) but when i try to > conenct on laptop running windows 7 there's "TLS Alert read:fatal:unknown > CA" error. I already re-create the root CA (i did this following > documentation > http://deployingradius.com/documents/configuration/certificates.html) > import it to the client, and ensure every detail of the certificate. Is > there any bug with windows 7 or something? any kind of help would be > appreciated. Thankyou (ca.cnf and server.cnf attached) > > Radius log : > (0) Received Access-Request Id 60 from 172.30.254.3:49431 to > 172.29.164.218:1812 length 267 > (0) User-Name = "gpler" > (0) Chargeable-User-Identity = 0x03 > (0) Location-Capable = Civix-Location > (0) Calling-Station-Id = "6c-71-d9-a9-5e-65" > (0) Called-Station-Id = "58-ac-78-ee-8a-20:802.1x" > (0) NAS-Port = 1 > (0) Cisco-AVPair = "audit-session-id=03fe1eac0003fe3fa18e9759" > (0) Acct-Session-Id = "59978ea1/6c:71:d9:a9:5e:65/71057" > (0) NAS-IP-Address = 172.30.xxx.x > (0) NAS-Identifier = "IPB-WLC-5520" > (0) Airespace-Wlan-Id = 69 > (0) Service-Type = Framed-User > (0) Framed-MTU = 1300 > (0) NAS-Port-Type = Wireless-802.11 > (0) Tunnel-Type:0 = VLAN > (0) Tunnel-Medium-Type:0 = IEEE-802 > (0) Tunnel-Private-Group-Id:0 = "255" > (0) EAP-Message = 0x0202000a0167706c6572 > (0) Message-Authenticator = 0x107b01b20e515d3a076209dea9af2966 > (0) # Executing section authorize from file > /etc/freeradius/3.0/sites-enabled/default > (0) authorize { > (0) policy filter_username { > (0) if (&User-Name) { > (0) if (&User-Name) -> TRUE > (0) if (&User-Name) { > (0) if (&User-Name =~ /@[^@]*@/ ) { > (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE > (0) if (&User-Name =~ /\.\./ ) { > (0) if (&User-Name =~ /\.\./ ) -> FALSE > (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { > (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> > FALSE > (0) if (&User-Name =~ /\.$/) { > (0) if (&User-Name =~ /\.$/) -> FALSE > (0) if (&User-Name =~ /(a)\./) { > (0) if (&User-Name =~ /(a)\./) -> FALSE > (0) } # if (&User-Name) = notfound > (0) } # policy filter_username = notfound > (0) [preprocess] = ok > (0) [chap] = noop > (0) [mschap] = noop > (0) [digest] = noop > (0) suffix: Checking for suffix after "@" > (0) suffix: No '@' in User-Name = "gpler", looking up realm NULL > (0) suffix: No such realm "NULL" > (0) [suffix] = noop > (0) eap: Peer sent EAP Response (code 2) ID 2 length 10 > (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the > rest of authorize > (0) [eap] = ok > (0) } # authorize = ok > (0) Found Auth-Type = eap > (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (0) authenticate { > (0) eap: Peer sent packet with method EAP Identity (1) > (0) eap: Calling submodule eap_peap to process data > (0) eap_peap: Initiating new EAP-TLS session > (0) eap_peap: [eaptls start] = request > (0) eap: Sending EAP Request (code 1) ID 3 length 6 > (0) eap: EAP session adding &reply:State = 0x68d16d7c68d27498 > (0) [eap] = handled > (0) } # authenticate = handled > (0) Using Post-Auth-Type Challenge > (0) Post-Auth-Type sub-section not found. Ignoring. > (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (0) Sent Access-Challenge Id 60 from 172.29.164.218:1812 to > 172.30.xxx.x:49431 length 0 > (0) EAP-Message = 0x010300061920 > (0) Message-Authenticator = 0x00000000000000000000000000000000 > (0) State = 0x68d16d7c68d27498a8bfbed341c368c9 > (0) Finished request > Waking up in 4.9 seconds. > (1) Received Access-Request Id 61 from 172.30.254.3:49431 to > 172.29.164.218:1812 length 380 > (1) User-Name = "gpler" > (1) Chargeable-User-Identity = 0x03 > (1) Location-Capable = Civix-Location > (1) Calling-Station-Id = "6c-71-d9-a9-5e-65" > (1) Called-Station-Id = "58-ac-78-ee-8a-20:802.1x" > (1) NAS-Port = 1 > (1) Cisco-AVPair = "audit-session-id=03fe1eac0003fe3fa18e9759" > (1) Acct-Session-Id = "59978ea1/6c:71:d9:a9:5e:65/71057" > (1) NAS-IP-Address = 172.30.xxx.x > (1) NAS-Identifier = "IPB-WLC-5520" > (1) Airespace-Wlan-Id = 69 > (1) Service-Type = Framed-User > (1) Framed-MTU = 1300 > (1) NAS-Port-Type = Wireless-802.11 > (1) Tunnel-Type:0 = VLAN > (1) Tunnel-Medium-Type:0 = IEEE-802 > (1) Tunnel-Private-Group-Id:0 = "255" > (1) EAP-Message = > 0x0203006919800000005f160301005a01000056030159978e892bc0cea1 > 314b3076e48c1432d22b3a1f575d2bd9ef5eadcd1efab780000018002f00 > 350005000ac013c014c009c00a003200380013000401000015ff01000100 > 000a0006000400170018000b00020100 > (1) State = 0x68d16d7c68d27498a8bfbed341c368c9 > (1) Message-Authenticator = 0x9e55b07936045ad7e26084813251454b > (1) session-state: No cached attributes > (1) # Executing section authorize from file > /etc/freeradius/3.0/sites-enabled/default > (1) authorize { > (1) policy filter_username { > (1) if (&User-Name) { > (1) if (&User-Name) -> TRUE > (1) if (&User-Name) { > (1) if (&User-Name =~ /@[^@]*@/ ) { > (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE > (1) if (&User-Name =~ /\.\./ ) { > (1) if (&User-Name =~ /\.\./ ) -> FALSE > (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { > (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> > FALSE > (1) if (&User-Name =~ /\.$/) { > (1) if (&User-Name =~ /\.$/) -> FALSE > (1) if (&User-Name =~ /(a)\./) { > (1) if (&User-Name =~ /(a)\./) -> FALSE > (1) } # if (&User-Name) = notfound > (1) } # policy filter_username = notfound > (1) [preprocess] = ok > (1) [chap] = noop > (1) [mschap] = noop > (1) [digest] = noop > (1) suffix: Checking for suffix after "@" > (1) suffix: No '@' in User-Name = "gpler", looking up realm NULL > (1) suffix: No such realm "NULL" > (1) [suffix] = noop > (1) eap: Peer sent EAP Response (code 2) ID 3 length 105 > (1) eap: Continuing tunnel setup > (1) [eap] = ok > (1) } # authorize = ok > (1) Found Auth-Type = eap > (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (1) authenticate { > (1) eap: Expiring EAP session with state 0x68d16d7c68d27498 > (1) eap: Finished EAP session with state 0x68d16d7c68d27498 > (1) eap: Previous EAP request found for state 0x68d16d7c68d27498, released > from the list > (1) eap: Peer sent packet with method EAP PEAP (25) > (1) eap: Calling submodule eap_peap to process data > (1) eap_peap: Continuing EAP-TLS > (1) eap_peap: Peer indicated complete TLS record size will be 95 bytes > (1) eap_peap: Got complete TLS record (95 bytes) > (1) eap_peap: [eaptls verify] = length included > (1) eap_peap: (other): before/accept initialization > (1) eap_peap: TLS_accept: before/accept initialization > (1) eap_peap: <<< recv TLS 1.0 Handshake [length 005a], ClientHello > (1) eap_peap: TLS_accept: unknown state > (1) eap_peap: >>> send TLS 1.0 Handshake [length 0031], ServerHello > (1) eap_peap: TLS_accept: unknown state > (1) eap_peap: >>> send TLS 1.0 Handshake [length 02c0], Certificate > (1) eap_peap: TLS_accept: unknown state > (1) eap_peap: >>> send TLS 1.0 Handshake [length 0004], ServerHelloDone > (1) eap_peap: TLS_accept: unknown state > (1) eap_peap: TLS_accept: unknown state > (1) eap_peap: TLS_accept: unknown state > (1) eap_peap: TLS_accept: Need to read more data: unknown state > (1) eap_peap: TLS_accept: Need to read more data: unknown state > (1) eap_peap: In SSL Handshake Phase > (1) eap_peap: In SSL Accept mode > (1) eap_peap: [eaptls process] = handled > (1) eap: Sending EAP Request (code 1) ID 4 length 778 > (1) eap: EAP session adding &reply:State = 0x68d16d7c69d57498 > (1) [eap] = handled > (1) } # authenticate = handled > (1) Using Post-Auth-Type Challenge > (1) Post-Auth-Type sub-section not found. Ignoring. > (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (1) Sent Access-Challenge Id 61 from 172.29.164.218:1812 to > 172.30.xxx.x:49431 length 0 > (1) EAP-Message = > 0x0104030a190016030100310200002d03016e22346727c2b7bfd58d3b5b > d06acbc17fa96d02f7937abfe946a411c305079800002f000005ff010001 > 0016030102c00b0002bc0002b90002b6308202b23082019aa00302010202 > 0900e889295aaea3149d300d06092a864886f70d01010b05003011310f30 > (1) Message-Authenticator = 0x00000000000000000000000000000000 > (1) State = 0x68d16d7c69d57498a8bfbed341c368c9 > (1) Finished request > Waking up in 4.9 seconds. > (2) Received Access-Request Id 62 from 172.30.xxx.x:49431 to > 172.29.164.218:1812 length 292 > (2) User-Name = "gpler" > (2) Chargeable-User-Identity = 0x03 > (2) Location-Capable = Civix-Location > (2) Calling-Station-Id = "6c-71-d9-a9-5e-65" > (2) Called-Station-Id = "58-ac-78-ee-8a-20:802.1x" > (2) NAS-Port = 1 > (2) Cisco-AVPair = "audit-session-id=03fe1eac0003fe3fa18e9759" > (2) Acct-Session-Id = "59978ea1/6c:71:d9:a9:5e:65/71057" > (2) NAS-IP-Address = 172.30.xxx.x > (2) NAS-Identifier = "IPB-WLC-5520" > (2) Airespace-Wlan-Id = 69 > (2) Service-Type = Framed-User > (2) Framed-MTU = 1300 > (2) NAS-Port-Type = Wireless-802.11 > (2) Tunnel-Type:0 = VLAN > (2) Tunnel-Medium-Type:0 = IEEE-802 > (2) Tunnel-Private-Group-Id:0 = "255" > (2) EAP-Message = 0x0204001119800000000715030100020230 > (2) State = 0x68d16d7c69d57498a8bfbed341c368c9 > (2) Message-Authenticator = 0xfd97ab9dc41ef3ae771c43ad2daa9331 > (2) session-state: No cached attributes > (2) # Executing section authorize from file > /etc/freeradius/3.0/sites-enabled/default > (2) authorize { > (2) policy filter_username { > (2) if (&User-Name) { > (2) if (&User-Name) -> TRUE > (2) if (&User-Name) { > (2) if (&User-Name =~ /@[^@]*@/ ) { > (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE > (2) if (&User-Name =~ /\.\./ ) { > (2) if (&User-Name =~ /\.\./ ) -> FALSE > (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { > (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> > FALSE > (2) if (&User-Name =~ /\.$/) { > (2) if (&User-Name =~ /\.$/) -> FALSE > (2) if (&User-Name =~ /(a)\./) { > (2) if (&User-Name =~ /(a)\./) -> FALSE > (2) } # if (&User-Name) = notfound > (2) } # policy filter_username = notfound > (2) [preprocess] = ok > (2) [chap] = noop > (2) [mschap] = noop > (2) [digest] = noop > (2) suffix: Checking for suffix after "@" > (2) suffix: No '@' in User-Name = "gpler", looking up realm NULL > (2) suffix: No such realm "NULL" > (2) [suffix] = noop > (2) eap: Peer sent EAP Response (code 2) ID 4 length 17 > (2) eap: Continuing tunnel setup > (2) [eap] = ok > (2) } # authorize = ok > (2) Found Auth-Type = eap > (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (2) authenticate { > (2) eap: Expiring EAP session with state 0x68d16d7c69d57498 > (2) eap: Finished EAP session with state 0x68d16d7c69d57498 > (2) eap: Previous EAP request found for state 0x68d16d7c69d57498, released > from the list > (2) eap: Peer sent packet with method EAP PEAP (25) > (2) eap: Calling submodule eap_peap to process data > (2) eap_peap: Continuing EAP-TLS > (2) eap_peap: Peer indicated complete TLS record size will be 7 bytes > (2) eap_peap: Got complete TLS record (7 bytes) > (2) eap_peap: [eaptls verify] = length included > (2) eap_peap: <<< recv TLS 1.0 Alert [length 0002], fatal unknown_ca > *(2) eap_peap: ERROR: TLS Alert read:fatal:unknown CA* > *(2) eap_peap: ERROR: TLS_accept: Failed in unknown state* > *(2) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read)* > *(2) eap_peap: ERROR: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 > alert unknown ca* > *(2) eap_peap: ERROR: error:140940E5:SSL routines:ssl3_read_bytes:ssl > handshake failure* > *(2) eap_peap: ERROR: System call (I/O) error (-1)* > *(2) eap_peap: ERROR: TLS receive handshake failed during operation* > *(2) eap_peap: ERROR: [eaptls process] = fail* > *(2) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module > failed* > (2) eap: Sending EAP Failure (code 4) ID 4 length 4 > (2) eap: Failed in EAP select > (2) [eap] = invalid > (2) } # authenticate = invalid > (2) Failed to authenticate the user > (2) Using Post-Auth-Type Reject > (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (2) Post-Auth-Type REJECT { > (2) attr_filter.access_reject: EXPAND %{User-Name} > (2) attr_filter.access_reject: --> gpler > (2) attr_filter.access_reject: Matched entry DEFAULT at line 11 > (2) [attr_filter.access_reject] = updated > (2) [eap] = noop > (2) policy remove_reply_message_if_eap { > (2) if (&reply:EAP-Message && &reply:Reply-Message) { > (2) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE > (2) else { > (2) [noop] = noop > (2) } # else = noop > (2) } # policy remove_reply_message_if_eap = noop > (2) } # Post-Auth-Type REJECT = updated > (2) Delaying response for 1.000000 seconds > Waking up in 0.3 seconds. > Waking up in 0.6 seconds. > (2) Sending delayed response > (2) Sent Access-Reject Id 62 from 172.29.164.218:1812 to > 172.30.xxx.x:49431 > length 44 > (2) EAP-Message = 0x04040004 > (2) Message-Authenticator = 0x00000000000000000000000000000000 > Waking up in 3.9 seconds. > (0) Cleaning up request packet ID 60 with timestamp +628 > (1) Cleaning up request packet ID 61 with timestamp +628 > (2) Cleaning up request packet ID 62 with timestamp +628 > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list > /users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html

1 0

Netgear NightHawk R8000 X6 as a FreeRadius Cloud Client
by The Doctor 19 Aug '17

19 Aug '17

All right I have a freeradius server on the oterside of the cloud with a Netgear with options of PPPoE, PPTP and L2TP . What do I need to set up on both sides? -- Member - Liberal International This is doctor@@nl2k.ab.ca Ici doctor@@nl2k.ab.ca Yahweh, Queen & country!Never Satan President Republic!Beware AntiChrist rising! https://www.empire.kred/ROOTNK?t=94a1f39b Look at Psalms 14 and 53 on Atheism Talk Sense to a fool and he calls you foolish - Euripides

1 0

Remote users - proxying fails - NPS timeout
by John Horne 18 Aug '17

18 Aug '17

Hello, We have 2 CentOS 7 servers which act solely as RADIUS proxy servers using PEAP. They proxy to backend Microsoft NPS servers. The servers proxy local (wireless) users (to NPS), visiting eduroam users (to NRPS) and our own (eduroam) users (to NPS) who are visting external sites. The eduroam users are proxied to/from the UK national proxy servers (NRPS). Both local radius servers ran the freeradius 3.0.4 CentOS package. This all worked well. However, I have updated freeradius to 3.0.15 (locally built RPM) on one of the servers. Whilst the local and visiting eduroam users are authenticating correctly, the majority of our own eduroam users authenticating to us via the NRPS servers now fail. The radius log shows (for example): ========== Thu Aug 17 23:16:20 2017 : ERROR: (7299) ERROR: Failing proxied request for user "abc(a)students.plymouth.ac.uk", due to lack of any response from home server 141.163.xxx.yyy port 1812 Thu Aug 17 23:16:20 2017 : Auth: (7299) Login incorrect (Home Server failed to respond): [abc(a)students.plymouth.ac.uk] (from client NRPS-0 port 13 cli FC-FC- 48-FF-AA-DD) SSID: eduroam Thu Aug 17 23:16:20 2017 : Auth: (7299) Login incorrect (Failing proxied request for user "abc(a)students.plymouth.ac.uk", due to lack of any response from home server 141.163.xxx.yyy port 1812): [abc(a)students.plymouth.ac.uk] (from client NRPS-0 port 13 cli FC-FC-48-DD-AA-DD) SSID: eduroam ========== For the NRPS clients this occurs nearly 100% of the time. For some reason an occassional user will authenticate successfully. I have captured the debug output for a user who authenticated successfully on the 3.0.4 server, but then failed to authenticate on the 3.0.15 server. Although the last packet sent seemed acceptable, with no reply from the MS NPS server it is difficult to know what happened next. A little googling seemed to indicate that MS NPS is known for just dropping packets rather than rejecting them or even logging them. I asked the sysadmin of the NPS servers if the logs showed anything, but he said not. The servers themselves were not under any particular load, so that was not a reason to drop the packets. Although the freeradius config files have had to be modified a little bit due to differences between 3.0.4 and 3.0.15, they are basically the same. I tried downgrading to an RHEL 7 beta RPM of freeradius 3.0.13, but we got the same timeout problem. I have now gone back to 3.0.4, and the problem has gone. I am a bit stumped with this. My first thought was that we had changed something to cause the MS NPS servers to drop the packets. Filtering seemed possible as I gather if NPS is sent a packet with unrecognised radius attributes then it is likely to drop it. However, the filtering is the same between 3.0.4 and 3.0.15. I have also gone through the changelog from 3.0.5 to 3.0.15, but could not find anything obvious (to me) that might explain this. My thoughts are that perhaps some core part of freeradius has been modified such that it is now causing NPS (for us) a problem. We could start to work through the versions from 3.0.5 upwards to see at what version we hit the problem, and then look further at the commits for that version. However, before that I thought I would ask here if anyone has any thoughts about this? Has anyone had a similar problem? Thanks, John. -- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK ________________________________ [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass> This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, Plymouth University accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. Plymouth University does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.

2 1

Help :: high memory usage with FR 3.0.11 on RHEL66
by Mariano Fons 17 Aug '17

17 Aug '17

Hi everyone, we're running FreeRadius 3.0.11 on RHEL6.6 We have all of this modules enabled: [PRO] [root@pv3il0510 mods-enabled]# ls -l total 0 lrwxrwxrwx 1 root radiusd 24 feb 22 2016 always -> ../mods-available/always lrwxrwxrwx 1 root radiusd 29 feb 22 2016 attr_filter -> ../mods-available/attr_filter lrwxrwxrwx 1 root radiusd 27 feb 22 2016 cache_eap -> ../mods-available/cache_eap lrwxrwxrwx 1 root radiusd 22 feb 22 2016 chap -> ../mods-available/chap lrwxrwxrwx 1 root radiusd 24 feb 22 2016 detail -> ../mods-available/detail lrwxrwxrwx 1 root radiusd 28 feb 22 2016 detail.log -> ../mods-available/detail.log lrwxrwxrwx 1 root radiusd 22 feb 22 2016 dhcp -> ../mods-available/dhcp lrwxrwxrwx 1 root radiusd 24 feb 22 2016 digest -> ../mods-available/digest lrwxrwxrwx 1 root radiusd 33 feb 22 2016 dynamic_clients -> ../mods-available/dynamic_clients lrwxrwxrwx 1 root radiusd 21 feb 22 2016 eap -> ../mods-available/eap lrwxrwxrwx 1 root radiusd 22 feb 22 2016 echo -> ../mods-available/echo lrwxrwxrwx 1 root radiusd 22 feb 22 2016 exec -> ../mods-available/exec lrwxrwxrwx 1 root radiusd 28 feb 22 2016 expiration -> ../mods-available/expiration lrwxrwxrwx 1 root radiusd 22 feb 22 2016 expr -> ../mods-available/expr lrwxrwxrwx 1 root radiusd 23 feb 22 2016 files -> ../mods-available/files lrwxrwxrwx 1 root root 30 feb 22 2016 ldap -> /etc/raddb/mods-available/ldap lrwxrwxrwx 1 root radiusd 25 feb 22 2016 linelog -> ../mods-available/linelog lrwxrwxrwx 1 root radiusd 27 feb 22 2016 logintime -> ../mods-available/logintime lrwxrwxrwx 1 root radiusd 24 feb 22 2016 mschap -> ../mods-available/mschap lrwxrwxrwx 1 root radiusd 27 feb 22 2016 ntlm_auth -> ../mods-available/ntlm_auth lrwxrwxrwx 1 root radiusd 21 feb 22 2016 pap -> ../mods-available/pap lrwxrwxrwx 1 root radiusd 24 feb 22 2016 passwd -> ../mods-available/passwd lrwxrwxrwx 1 root radiusd 28 feb 22 2016 preprocess -> ../mods-available/preprocess lrwxrwxrwx 1 root radiusd 25 feb 22 2016 radutmp -> ../mods-available/radutmp lrwxrwxrwx 1 root radiusd 23 feb 22 2016 realm -> ../mods-available/realm lrwxrwxrwx 1 root radiusd 27 feb 22 2016 replicate -> ../mods-available/replicate lrwxrwxrwx 1 root radiusd 21 feb 22 2016 soh -> ../mods-available/soh lrwxrwxrwx 1 root radiusd 26 feb 22 2016 sradutmp -> ../mods-available/sradutmp lrwxrwxrwx 1 root radiusd 22 feb 22 2016 unix -> ../mods-available/unix lrwxrwxrwx 1 root radiusd 24 feb 22 2016 unpack -> ../mods-available/unpack lrwxrwxrwx 1 root radiusd 22 feb 22 2016 utf8 -> ../mods-available/utf8 [PRO] [root@pv3il0510 mods-enabled]# We validate with: EAP-TLS, PAP and PEAP. We have 2 hosts running the same configuration behind one F5 balancer. Requests go down to any host and the request is attended. This works OK. We are nearly processing 150k requests (accepted & rejected) on each node. But the issue we are showing is high memory usage. Hosts have 4GB RAM and 1vCPU (runs in VMware hosts) The machines are nearly idle all the time, but ram usage increase over the time....sometimes nearly 90% ... The question is, have anyone got in this issue with this version? Is there any known issue in this version for this problem? I have been searching through the changelog of the versions 'til 3.0.15 but I can't see anything clear about this. Thanx in advance! Kind regards, Mariano.

2 2

Freeradius 3.x with LDAP authentication
by Adam Cage 17 Aug '17

17 Aug '17

Hi people, we wanna authenticate WiFi users against a Freeradius 3.x server, these users are defined in a Windows Active Directory remote server. We have the base_dn search defined, and there they are all the valid users who can use the WiFi service. We wanna use LDAP to initially authenticate and in the future authorize the accesses. Please can anybody point to me a detailed howto, because we are confused if we have to use LDAP with MSCHAP, PAP, EAP or whatever??? Aand also we are confused about the AD object we have to use in the filter string: uid, samaccountname, mail...What does this selection depend on ??? And the last question: I'm using a Debian server with the freeradius and freeradius-ldap distribution packages, is it a good idea or maybe it's better to use the tar.gz version??? Thanks to all, good bye. ADAM

5 16