October 2018 - Freeradius-Users - lists.freeradius.org

Several Access Requests after a succesfully authentication
by Tom Yard 24 Oct '18

24 Oct '18

Dear people, I have a Freeradius server that authenticate users against an AD in order to access the WiFi network: Once a user authenticates OK and access the WiFi network, in the debug log of Freeradius I notice that this user has several access requests at the same time he is using the WiFi correctly. The access request frames are as the shown below: rad_recv: Access-Request packet from host 192.168.10.1 port 32768, id=103, length=432 User-Name = "jsmith" Chargeable-User-Identity = "" Location-Capable = Civix-Location Calling-Station-Id = "80:ab:17:46:69:10" Called-Station-Id = "6c:99:89:8b:62:50:Employees" NAS-Port = 13 Cisco-AVPair = "audit-session-id=ac1f0c620001129d5bd059a8" Acct-Session-Id = "5bd059a8/80:ad:16:46:69:10/117467" Cisco-AVPair = "mDNS=true" NAS-IP-Address = 192.168.10.1 NAS-Identifier = "CC-803" Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "803" EAP-Message = 0x0207006b1900170301006097b83712638612527a05475ecd25d67e6076490aee95d35c489925635aee89c40643f7792122452628ac3c6deb27afd73a619069eab529f5afcc4646fa17195991294d33614f549480f045e3a0aba117ff7c4182bdfdbd935055c2577f056d01 State = 0x413cfeec443be7e0d7f6ff4a2526d7aa Message-Authenticator = 0xc54014a6929ff04d4e13b6a8be7b79ad Why is this behaviour? Because I thougth the access requests are used only when the user is going to authenticate and never. Thanks a lot, regards !!!

2 1

Filter-Id in Accounting-Request
by Alessandro Romano 24 Oct '18

24 Oct '18

Dear All, i need to have the attribute Filter-Id in the accounting request packet to replicate it to anoter external server BR Alessandro Romano C.T.O. Cell: 3351402534 Positivo SRL Via San Leonardo 52 84131 Salerno ( Sa )

2 2

set an ldap attribute in the ldap file
by Yaël Rozanes 24 Oct '18

24 Oct '18

Hello, everyone, I would have liked to know if it was possible to "fix" an ldap attr in the ldap file, such as : Tunnel-Type is always equal to VLAN and Tunnel-Medium-Type is always equal to 6 I searched with the operators but I didn't fully understand how they work. for now my file looks like this: [...] update { control:Password-With-Header += 'userPassword' # control:NT-Password := 'ntPassword' # reply:Reply-Message := 'radiusReplyMessage' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' reply:Tunnel-Type := "description" reply:Tunnel-Medium-Type := "textelibre" reply:Tunnel-Private-Group-ID := "givenName" # Where only a list is specified as the RADIUS attribute, # the value of the LDAP attribute is parsed as a valuepair # in the same format as the 'valuepair_attribute' (above). control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } [...] and I would have liked something like this [...] reply:Tunnel-Type == "VLAN" reply:Tunnel-Medium-Type == "6" reply:Tunnel-Private-Group-ID := "givenName [...] in my ldap, description = VLAN and textelibre = 6 but I'd like to free these fields from my ldap thank you in advance for your answers -------------------------------------------------------------------------------------------------------------- Rozanes Yaël Student in License ASUR ( france ;)

2 2

rlm_rest in pre-proxy
by Fabrice Durand 23 Oct '18

23 Oct '18

Hello, just a quick question, is there any reason why rlm_rest module is not available in the pre-proxy section ? (post-proxy too) I would like to use it to be able to add dynamic radius attributes before sending the request to a remote server. Regards Fabrice -- Fabrice Durand fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence (http://packetfence.org)

2 2

Re: Post-Auth LDAP with computer names rather than usernames
by Kevin Virk 22 Oct '18

22 Oct '18

I recently sparked a discussion regarding post-auth with computer names rather than usernames and I did not include complete information, my apologies. I am currently using EAP-TLS and have crafted certificates based on usernames. Alan had responded saying that post-auth via Ldap was possible if you make certs with workstations names included. I can do this my question is then does the stripped username take the computer name and then do my ldap queries just need to change to check workstation groups rather than security groups ? Thank you in advance for any help.

2 1

freeradius3 couldnt connect to mysql-server
by Lukas Nuth 22 Oct '18

22 Oct '18

Hi, FreeRADIUS starts with my virtual machine. Therefore Ubuntu created the file "radiusd.service" itself. I activated "radius.service" with "systemctl enable radiusd.service" so that FR starts with the virtual machine. Now the problem when FR starts with the virtual machine is that the following error message can be found in the log file: Mon Oct 22 08:45:40 2018 : Info: Debugger not attached Mon Oct 22 08:45:41 2018 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Oct 22 08:45:42 2018 : Info: rlm_sql_mysql: libmysql version: 5.7.23 Mon Oct 22 08:45:42 2018 : Info: rlm_sql (sql): Attempting to connect to database "radius" Mon Oct 22 08:45:42 2018 : Info: rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used Mon Oct 22 08:45:42 2018 : Error: rlm_sql_mysql: Couldn't connect to MySQL server radius@localhost:radius Mon Oct 22 08:45:42 2018 : Error: rlm_sql_mysql: MySQL error: Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2) Mon Oct 22 08:45:42 2018 : Error: rlm_sql (sql): Opening connection failed (0) Mon Oct 22 08:45:42 2018 : Error: /etc/raddb/mods-enabled/sql[20]: Instantiation failed for module "sql" If I restart FR with "systemctl restart radiusd.service" this error does not occur. Can anyone help me? regards Lukas

3 4

Add bandwidth to user
by me＠erikthiart.com 21 Oct '18

21 Oct '18

Hello, What is the best way to go about adding additional bandwidth to a user in freeradius? Scenario: I have mikrotik hotspots using mac auth and in freeradius I have a realm setup with a bandwidth limit of 400mb, when some users perform a certain action I want to increase the bandwidth for said users by 200mb for example.

3 2

DB valid fields
by Stephen 20 Oct '18

20 Oct '18

So I'm using freeradius with postgresql and eap-tls. I would love to know where the documentation for the acceptable radreply entries is. The closest thing to documentation that I've found has been: https://wiki.freeradius.org/guide/SQL-HOWTO#populating-sql Aside from the limited and anecdotal references found there to fields like `Framed-IP-Address`, where can I find a comprehensive accounting of the attributes and values I can leverage in my radreply table? Thanks in advance!

4 9

Post-Auth LDAP with computer names rather than usernames
by Kevin Virk 20 Oct '18

20 Oct '18

I currently have dynamic vlans working with post-auth user authentication but my boss would like to do it based off computer name. I have searched and become a little confused as how to proceed. In the LDAP conf do I change stripped username to stripped computer name or is it more complicated than that? ________________________________ From: Freeradius-Users <freeradius-users-bounces+kevin.virk=faithlife.com(a)lists.freeradius.org> on behalf of freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> Sent: Monday, September 3, 2018 10:19 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 161, Issue 2 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users<http://lists.freeradius.org/mailman/listinfo/freeradius-users> or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: VLan affect based on ldap attribute freeradius v3 (jehan procaccia INT) 2. rlm_sql not checking radgroupreply (tomas.meier(a)fettabernett.de) ---------------------------------------------------------------------- Message: 1 Date: Mon, 3 Sep 2018 16:04:11 +0200 From: jehan procaccia INT <jehan.procaccia(a)int-evry.fr> To: FreeRadius users mailing list <Freeradius-Users(a)lists.freeradius.org> Cc: aland(a)deployingradius.com, Christophe GABORET <Christophe.Gaboret(a)tem-tsp.eu> Subject: Re: VLan affect based on ldap attribute freeradius v3 Message-ID: <f6b5995f-5959-a196-5bb0-513525683e5a(a)int-evry.fr> Content-Type: text/plain; charset=utf-8 Hello sucessfull reponses below ... Le 31/08/2018 à 14:59, Alan DeKok a écrit : >> On Aug 31, 2018, at 4:45 AM, jehan procaccia INT >> <jehan.procaccia(a)int-evry.fr> wrote: >> >> unfortunatly it fails, User-Category attribute fetch from ldap >> edupersonPrimaryAffiliation doesn't pass though different >> states/modules apparently > Yes, it does. You should be able to tell what's going on by reading > the debug output. *Or* by posting the ENTIRE debug output here, and > letting someone else read it. > > You're falling into a common trap. You're trying all kinds of random > things. Without really understanding what's going on, or why. > You're posting *small* bits of the debug output, in the hope that > those bits are useful. > > They're not. > > Post the FULL DEBUG OUTPUT. > > And make sure it's for ONE USER. We're not going to read through > thousands of lines of logs about accounting packets, in order to > solve an authentication issue. you're right, after a weekend reading thouroughly http://networkradius.com/doc/FreeRADIUS Technical Guide.pdf<http://networkradius.com/doc/FreeRADIUS Technical Guide.pdf> and wiki thingsget better now , althought it's not easy to get a single user debug output from production . fortunatly you gave me the right answer with "use_tunneled_reply = yes" adding that not only (which was already set) to mods-enabled/eap section: eap { ttls { but moreover to peap { which is our prevalent method used, now makes the attribute correctly flowed in the process chapter 4.3 of the tech guide is important to understand the iteractive / recursive processing of the configuration sections and modules . the debug output seems very repetitive whitout that and https://wiki.freeradius.org/guide/radiusd-X<https://wiki.freeradius.org/guide/radiusd-X> helps a lot to . thanks for your help , now it work fine ;-) Regards PS my connection as an employee (ldap) and associated vlan accordingly : (86) prod: reply:Reply-Message := 'employee' (86) prod: reply:User-Category += 'employee' (86) Virtual server sending reply (86) Reply-Message := "employee" (86) User-Category += "employee" (86) eap_peap: Got tunneled reply RADIUS code 2 (86) eap_peap: Reply-Message := "employee" (86) eap_peap: User-Category += "employee" (88) eap_peap: Using saved attributes from the original Access-Accept (88) eap_peap: Reply-Message := "employee" (88) eap_peap: User-Category += "employee" (88) [eap] = ok (88) } # authenticate = ok (88) # Executing section post-auth from file /etc/raddb/sites-enabled/default (88) post-auth { (88) update { (88) No attributes updated (88) } # update = noop (88) reply_log: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (88) reply_log: --> /var/log/radius/radacct/10.91.10.10/reply-detail-20180903 (88) reply_log: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (88) reply_log: EXPAND %t (88) reply_log: --> Mon Sep 3 09:24:23 2018 (88) [reply_log] = ok (88) [exec] = noop (88) policy remove_reply_message_if_eap { (88) if (&reply:EAP-Message && &reply:Reply-Message) { (88) if (&reply:EAP-Message && &reply:Reply-Message) -> TRUE (88) if (&reply:EAP-Message && &reply:Reply-Message) { (88) update reply { (88) &Reply-Message !* ANY (88) } # update reply = noop (88) } # if (&reply:EAP-Message && &reply:Reply-Message) = noop (88) ... skipping else: Preceding "if" was taken (88) } # policy remove_reply_message_if_eap = noop (88) policy debug_reply { (88) if ("%{debug_attr:reply:}" == '') { (88) Attributes matching "reply:" (88) &reply:User-Category += employee (88) &reply:Stripped-User-Name = procacci (88) if ("%{debug_attr:reply:}" == '') -> TRUE (88) if ("%{debug_attr:reply:}" == '') { (88) [noop] = noop (88) } # if ("%{debug_attr:reply:}" == '') = noop (88) } # policy debug_reply = noop (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) -> TRUE (88) if (( &reply:User-Category == "employee") || (&reply:User-Category == "faculty") || (&reply:User-Category == "staff" ) || (&reply:User-Category == "researcher") || (&reply:User-Category == "member")) { (88) update reply { (88) Tunnel-Private-Group-Id := 903 > >> even with the usage of session-state (replacing "reply") it fails >> >> here's a new radiusd -X experiment : >> >> 1) ldap does find the attribute and associated value (here >> employee) >> >> rlm_ldap (prod): Reserved connection (7) (93) prod: >> reply:Reply-Message := 'employee' (93) prod: reply:User-Category += >> 'employee' >> >> 2) eap-peap has it >> >> (93) post-auth { (93) if (0) { (93) if (0) -> >> FALSE (93) } # post-auth = noop (93) Login OK: [radu/<via >> Auth-Type = eap>] (from client prod port 0 via TLS tunnel) (93) } # >> server inner-tunnel (93) Virtual server sending reply (93) >> Reply-Message := "employee" (93) *User-Category += "employee"* >> (93) eap_peap: Got tunneled reply code 2 (93) eap_peap: >> Reply-Message := "employee" (93) eap_peap: *User-Category += >> "employee"* > Note that's all in packet 93. AND in the "inner tunnel" virtual > server. > >> 3) eap_peap is success >> >> (94)*eap_peap: Success* > Which is packet 94. Note that "94" is NOT THE SAME as "93". > > i.e. it's a different packet. So unless you made sure to get the > attribute from packet 93 inner tunnel reply to packet 94 outer > reply... the attribute won't be in packet 94. > >> should I see something like &reply:User-Category above > No. > >> ? not been present means it's already lost ? > It hasn't been lost. > > All you need to do is read mods-available/eap, and set > "use_tunneled_reply = yes". And read the comments for that > configuration item. They explain what it is, why you need it, and > when you want to use it. > > Alan DeKok. > > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html> ------------------------------ Message: 2 Date: Mon, 3 Sep 2018 19:18:59 +0200 From: tomas.meier(a)fettabernett.de To: freeradius-users(a)lists.freeradius.org Subject: rlm_sql not checking radgroupreply Message-ID: <trinity-fc960aa8-16ac-446d-81e3-a3045449cc19-1535995139876@3c-app-gmx-bs44> Content-Type: text/plain; charset="UTF-8" Hello, I am using FreeRADIUS 3.0.17 in a MySQL setup that seems to not check radgroupreply. "radtest" gets user attributes but does not receive attributes of associated group at all. Complete debug output of radiusd -X: FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/sql including configuration file /usr/local/etc/raddb/mods-config/sql/main/sqlite/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/realm including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/accounting including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_exec # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_radutmp # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet -Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_sql # Loading module "sql" from file /usr/local/etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "sql.mydomain.de<http://sql.mydomain.de>" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND acctstoptime IS NULL" safe_characters = "#@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } accounting-off { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-date('now')}, %{%{integer:Event-Timestamp}:-date('now')}, NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = %{%{integer:Event-Timestamp}:-date('now')}, acctinterval = 0, framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } instantiate { } # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "[1]http://127.0.0.1/ocsp/<http://127.0.0.1/ocsp/>" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/usr/local/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.1.26-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Adding client 10.0.0.1 (RAS1) to global clients list rlm_sql (10.0.0.1): Client "RAS1" (sql) added [...] rlm_sql (sql): Adding client 192.168.100.1 (radius.mydomain.de<http://radius.mydomain.de>) to global clients list rlm_sql (192.168.100.1): Client "radius.mydomain.de<http://radius.mydomain.de>" (sql) added rlm_sql (sql): Adding client 127.0.0.1<http://127.0.0.1> (localhost) to global clients list rlm_sql (127.0.0.1<http://127.0.0.1>: Client "localhost" (sql) added rlm_sql (sql): Released connection (0) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on sql.mydomain.de<http://sql.mydomain.de> via TCP/IP, server version 10.1.26-MariaDB-0+deb9u1, protocol version 10 # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipv4addr = 192.168.100.1 port = 1812 limit { max_connections = 64 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv4addr = 192.168.100.1 port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1<http://127.0.0.1> port = 18120 } Listening on auth address 192.168.100.1 port 1812 bound to server default Listening on acct address 192.168.100.1 port 1813 bound to server default Listening on auth address 127.0.0.1<http://127.0.0.1> port 18120 bound to server inner-tunnel Ready to process requests References 1. http://127.0.0.1/ocsp/<http://127.0.0.1/ocsp/> ------------------------------ Subject: Digest Footer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html> ------------------------------ End of Freeradius-Users Digest, Vol 161, Issue 2 ************************************************

4 9

Re: Compiling with OpenSSL 1.1.1 (Alan DeKok)
by Doug Wussler 19 Oct '18

19 Oct '18

Just FYI, I upgraded to 3.0.17 and compiled with OpenSSL 1.1.1. Debug info still reports UNKNOWN TLS VERSION: FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0092] (1) eap_peap: TLS_accept: SSLv3/TLS read client hello I should also mention that when using OpenSSL 1.1.1 the executable will not launch without this setting in radiusd.conf: allow_vulnerable_openssl = CVE-2016-6304 which should not be necessary with 1.1.1. Also, if interested, when attempting to compile with config setting "--without-dhcp" the compilation fails with: CC src/main/radattr.c build/objs/src/main/radattr.o: In function `process_file': /downloads/freeradius-server-3.0.17/src/main/radattr.c:842: undefined reference to `fr_dhcp_decode_options' /downloads/freeradius-server-3.0.17/src/main/radattr.c:813: undefined reference to `fr_dhcp_encode_option' collect2: error: ld returned 1 exit status make: *** [build/bin/local/radattr] Error 1 This information is not intended as a complaint. I love the freeradius application and am very appreciative of all the work that goes into it. The efforts and responsiveness of both the development team and the community are extremely robust and helpful. Doug On Oct 18, 2018, at 10:09 AM, Doug Wussler <doug.wussler(a)fsu.edu> wrote: > > Compiling FreeRADIUS v 3.0.15 with OpenSSL 1.1.1 works just fine. > Just thought you might like to know the debug info reports an UNKNOWN TLS VERSION: Upgrade to 3.0.17. Alan DeKok.

2 1