January 2019 - Freeradius-Users - lists.freeradius.org

FreeRadius 3 OpenLDAP and MAC based Auth
by Jürgen Northe 07 Jan '19

07 Jan '19

> On Jan 4, 2019, at 2:35 AM, Jürgen Northe <jn(a)northe-online.de> wrote: > > Hello Alan, > > I have already a running environment with Freeradius2 + OpenLDAP to provide a simple NAC solution but now its time to setup a replacement with version 3. > > Did you follow the instructions in raddb/README.rst? There is detail documentation on how to upgrade. It is not an implace upgrade, I use a fresh installation of CentOS7 1810 with all the packages from the distro. The FR2 is running productive until I swich over. > > > So far everything is working but somehow the "authorize" of the client is not "processed". Compared with the version 2, I am missing the > > rlm_ldap: radiusAuthType -> Auth-Type == Accept > > along with the other attributes stored in the directory. > > What did you change? The default configuration works, and returns all attributes it finds in LDAP. I went through the r2 config and searched for settings I made 7 years ago. Then I searched for the same default values in the FR3 configs and adjusted them with the new settings (IP, hostname, certificate stuff, passwords, ..) . I dumped the LDAP database, copied it to the new server and restored the content. > > And what information is in LDAP? Here is the result of the LDAP query of the testing laptop . As you can see, the information regarding the VLAN-ID is stored in radiusProfileDn which I have posted below the query along with the content of ldap module. ldapsearch -D "cn=Manager,dc=firma,dc=de" -w xxxxxxxxxxxxxxxxxxxx -h radldap1-215 -b "dc=firma,dc=de" -s sub "cn=106530670342" # extended LDIF # # LDAPv3 # base <dc=firma,dc=de> with scope subtree # filter: cn=106530670342 # requesting: ALL # # NBBZ1807-134, 4.notebooks, 172.17.0.0, SUBNET, DHCP Config, firma .de dn: cn=NBBZ1807-134,cn=4.notebooks,cn=172.17.0.0,cn=SUBNET,cn=DHCP Config,dc=j unghans-microtec,dc=de objectClass: radiusprofile objectClass: dhcpHost objectClass: top cn: 10-65-30-67-03-42 cn: 106530670342 cn: NBBZ1807-134 dhcpHWAddress: ethernet 10:65:30:67:03:42 radiusCallingStationId: 10-65-30-67-03-42 radiusReplyMessage: Hello NBBZ1807-134 radiusProfileDn: cn=INTRA,ou=VLAN,ou=profiles,ou=radius,dc=firma,d c=de dhcpStatements: fixed-address 172.17.4.134 # search result search: 2 result: 0 Success ##### LDAP export: dn: cn=INTRA,ou=VLAN,ou=profiles,ou=radius,dc=firma,dc=de objectClass: top objectClass: organizationalRole objectClass: radiusprofile cn: INTRA radiusAuthType: Accept radiusTunnelMediumType: IEEE-802 radiusTunnelPrivateGroupId: 170 radiusTunnelType: VLAN ##### ldap module: ldap ldap1 { server = 'radldap1-215' identity = "cn=Manager,dc=firma,dc=de" password = xxxxxxxxxxxxxxxxxxxxxxxx base_dn = "dc=firma,dc=de" scope = "sub" # filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" filter = "(|(cn=%{%{StrippedUserName}:%{UserName}})(macAddress=%{%{StrippedUserName}:%{UserName}}))" set_auth_type = no sasl { } # update { # control:Password-With-Header += 'userPassword' # control: += 'radiusControlAttribute' # request: += 'radiusRequestAttribute' # reply: += 'radiusReplyAttribute' # } user { base_dn = "${..base_dn}" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' membership_attribute = 'memberOf' } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' template { } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } profile_attribute = "radiusProfileDn" dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } ldap ldap2 { server = 'radldap2-216' identity = "cn=Manager,dc=firma,dc=de" password = xxxxxxxxxxxxxxxxxxxxxxxxxxxxx base_dn = "dc=firma,dc=de" scope = "sub" # filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" filter = "(|(cn=%{%{StrippedUserName}:%{UserName}})(macAddress=%{%{StrippedUserName}:%{UserName}}))" set_auth_type = no sasl { } # update { # control:Password-With-Header += 'userPassword' # control: += 'radiusControlAttribute' # request: += 'radiusRequestAttribute' # reply: += 'radiusReplyAttribute' # } user { base_dn = "${..base_dn}" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" sasl { } } group { base_dn = "${..base_dn}" filter = '(objectClass=posixGroup)' membership_attribute = 'memberOf' } profile { } client { base_dn = "${..base_dn}" filter = '(objectClass=radiusClient)' template { } attribute { ipaddr = 'radiusClientIdentifier' secret = 'radiusClientSecret' } } accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" type { start { update { description := "Online at %S" } } interim-update { update { description := "Last seen at %S" } } stop { update { description := "Offline at %S" } } } } post-auth { update { description := "Authenticated at %S" } } options { chase_referrals = yes rebind = yes res_timeout = 10 srv_timelimit = 3 net_timeout = 1 idle = 60 probes = 3 interval = 3 ldap_debug = 0x0028 } tls { } pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 } } > > > I do have a the dictionary_mapping file and the entries in the enabled ldap module > > There is no "dictionary_mapping" file in the LDAP module configuration for v3. This is one thing that changed... > > You can't just copy your v2 configuration to v3, and expect it to work. That's what major version number changes mean... the configurations are *not* 100% compatible. > > > . I am fighting the whole day with this issue but can't even find hint in he running environment. > > The Laptop exists in the LDAP (bind ok, object can be found) and has the usual radius attributes like Tunnel-Private-Group-Id set as the LDAP database is restored from the running one. > > > > With the following statement in default, I do get an "Accept", but still missing the required attributes like tunnel-type and all the others. > You're making random changes without really understanding what's going on. That's not going to work. 7 years ago I had a 2day training but if you do not need it anymore, you forget things. At the beginning I was very optimistic with a quick success until I reached this state. So I started to force a authorization with the" if" statement to see if the attributes of the ldap will apear in the radius log :) > > radiusd -X > > (1) Received Access-Request Id 186 from 192.168.0.7:3437 to 192.168.0.215:1812 length 240 > > No, that's an *edited* version of the debug output. You've deleted information which may be important. Don't do that. The only thing I replaced is the company name by "firma" and passwords by xxxxx the rest 100% is pure the output I got from "radiusd -X" > > Alan DeKok. Thank you Alan !

3 2

Get number of users logged in via mySQL
by Renato Sousa 07 Jan '19

07 Jan '19

Hello All, I would like to get the number of logged in users on freeradius server (3.0.12). Looking at the mySQL accounting table, the connections with the NULL value for the acctstoptime field, I see some connections with the same user and even device mac-address with the NULL acctstoptime field. How to get this precise value through mySQL tables? How to delete these open sessions? Best Regards

3 5

Radius > HotSpot
by renan＠trixnet.com.br 07 Jan '19

07 Jan '19

Hello everyone, I'm new to radius servers and I'm developing an application for HotSpot, I actually have a lot of referrals to my difficulty in being the time count, eg creating users with connection periods type 1, 2, 3 hours and after this time that user and password are blocked, someone would have some study material to tell me? Thank you.

2 1

FreeRadius 3 OpenLDAP and MAC based Auth
by Jürgen Northe 07 Jan '19

07 Jan '19

Sorry Alan, now the whole output of radiusd -X FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/redundant_ldap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/canonicalization including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.1/32 { ipaddr = 192.168.0.1 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1BB1-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.2/32 { ipaddr = 192.168.0.2 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1BB2-2" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.3/32 { ipaddr = 192.168.0.3 require_message_authenticator = no secret = <<< secret >>> shortname = "SWKFW0SN-3" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.100/32 { ipaddr = 192.168.0.100 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1CEPH-100" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.102/32 { ipaddr = 192.168.0.102 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1VM-102" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.4/32 { ipaddr = 192.168.0.4 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1R1-4" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.5/32 { ipaddr = 192.168.0.5 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1R2-5" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.6/32 { ipaddr = 192.168.0.6 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1R3-6" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.7/32 { ipaddr = 192.168.0.7 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1AP1-7" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.251/32 { ipaddr = 192.168.0.251 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1F1-90" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.252/32 { ipaddr = 192.168.0.252 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1F2-91" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.253/32 { ipaddr = 192.168.0.253 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1F3-92" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.96/32 { ipaddr = 192.168.0.96 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1F6-96" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.97/32 { ipaddr = 192.168.0.97 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1F7-97" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.82/32 { ipaddr = 192.168.0.82 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG2AP1-82" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.81/32 { ipaddr = 192.168.0.81 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1AP1-81" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.80/32 { ipaddr = 192.168.0.80 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG0AP1-80" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.42/32 { ipaddr = 192.168.0.42 require_message_authenticator = no secret = <<< secret >>> shortname = "SWVW1AP1-42" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.40/32 { ipaddr = 192.168.0.40 require_message_authenticator = no secret = <<< secret >>> shortname = "SWVW0AP1-40" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.41/32 { ipaddr = 192.168.0.41 require_message_authenticator = no secret = <<< secret >>> shortname = "SWVW0AP2-41" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.30/32 { ipaddr = 192.168.0.30 require_message_authenticator = no secret = <<< secret >>> shortname = "SWMH0AP1-30" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.31/32 { ipaddr = 192.168.0.31 require_message_authenticator = no secret = <<< secret >>> shortname = "SWMH0AP2-31" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.34/32 { ipaddr = 192.168.0.34 require_message_authenticator = no secret = <<< secret >>> shortname = "SWMH0AP4-34" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.10/32 { ipaddr = 192.168.0.10 require_message_authenticator = no secret = <<< secret >>> shortname = "SWMB0AP1-10" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.20/32 { ipaddr = 192.168.0.20 require_message_authenticator = no secret = <<< secret >>> shortname = "SWPF0AP1-20" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.54/32 { ipaddr = 192.168.0.54 require_message_authenticator = no secret = <<< secret >>> shortname = "SWFH1AP1-54" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.50/32 { ipaddr = 192.168.0.50 require_message_authenticator = no secret = <<< secret >>> shortname = "SWFH0AP1-50" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.51/32 { ipaddr = 192.168.0.51 require_message_authenticator = no secret = <<< secret >>> shortname = "SWFH0AP2-51" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.52/32 { ipaddr = 192.168.0.52 require_message_authenticator = no secret = <<< secret >>> shortname = "SWFH0AP3-52" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.53/32 { ipaddr = 192.168.0.53 require_message_authenticator = no secret = <<< secret >>> shortname = "SWFH0AP4-53" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.70/32 { ipaddr = 192.168.0.70 require_message_authenticator = no secret = <<< secret >>> shortname = "SWKFH0AP1-70" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.60/32 { ipaddr = 192.168.0.60 require_message_authenticator = no secret = <<< secret >>> shortname = "SWLB0AP1-60" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.61/32 { ipaddr = 192.168.0.61 require_message_authenticator = no secret = <<< secret >>> shortname = "SWLB0AP1-61" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.33/32 { ipaddr = 192.168.0.33 require_message_authenticator = no secret = <<< secret >>> shortname = "SWxxxxx-33" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.35/32 { ipaddr = 192.168.0.35 require_message_authenticator = no secret = <<< secret >>> shortname = "SWMH0PK-35" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.36/32 { ipaddr = 192.168.0.36 require_message_authenticator = no secret = <<< secret >>> shortname = "SWMH0QS-36" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.37/32 { ipaddr = 192.168.0.37 require_message_authenticator = no secret = <<< secret >>> shortname = "SWMH0ES-37" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.38/32 { ipaddr = 192.168.0.38 require_message_authenticator = no secret = <<< secret >>> shortname = "SWMH0ES-38" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.45/32 { ipaddr = 192.168.0.45 require_message_authenticator = no secret = <<< secret >>> shortname = "SWVW0EJ-45" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.46/32 { ipaddr = 192.168.0.46 require_message_authenticator = no secret = <<< secret >>> shortname = "SWVW0OJ-46" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.56/32 { ipaddr = 192.168.0.56 require_message_authenticator = no secret = <<< secret >>> shortname = "SWFH0ES-56" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.55/32 { ipaddr = 192.168.0.55 require_message_authenticator = no secret = <<< secret >>> shortname = "SWFH1HJ-55" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.83/32 { ipaddr = 192.168.0.83 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG0AJ-83" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.84/32 { ipaddr = 192.168.0.84 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1KI-84" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.85/32 { ipaddr = 192.168.0.85 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG0KD-85" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.86/32 { ipaddr = 192.168.0.86 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG0KD-86" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.87/32 { ipaddr = 192.168.0.87 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1KI-87" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.88/32 { ipaddr = 192.168.0.88 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1KI-88" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.89/32 { ipaddr = 192.168.0.89 require_message_authenticator = no secret = <<< secret >>> shortname = "SWSG1KI-89" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.95/32 { ipaddr = 192.168.0.95 require_message_authenticator = no secret = <<< secret >>> shortname = "SWMH0PK-95" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.193/32 { ipaddr = 192.168.0.193 require_message_authenticator = no secret = <<< secret >>> shortname = "3C3870-193" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.195/32 { ipaddr = 192.168.0.195 require_message_authenticator = no secret = <<< secret >>> shortname = "3C4500-195" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.196/32 { ipaddr = 192.168.0.196 require_message_authenticator = no secret = <<< secret >>> shortname = "SW4500G48-196" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.198/32 { ipaddr = 192.168.0.198 require_message_authenticator = no secret = <<< secret >>> shortname = "SWDGS3200-198" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.0.101/32 { ipaddr = 192.168.0.101 require_message_authenticator = no secret = <<< secret >>> shortname = "NOTFALL-101" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = LDAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_ldap # Loading module "ldap1" from file /etc/raddb/mods-enabled/redundant_ldap ldap ldap1 { server = "radldap1-215" identity = "cn=Manager,dc=firma,dc=de" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=firma,dc=de" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute ldap1-LDAP-Group # Loading module "ldap2" from file /etc/raddb/mods-enabled/redundant_ldap ldap ldap2 { server = "radldap2-216" identity = "cn=Manager,dc=firma,dc=de" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=firma,dc=de" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute ldap2-LDAP-Group instantiate { # Instantiating module "ldap1" from file /etc/raddb/mods-enabled/redundant_ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20444 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap1): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } # Instantiating module "ldap2" from file /etc/raddb/mods-enabled/redundant_ldap accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap2): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/radldap1-215.key" certificate_file = "/etc/raddb/certs/radldap1-215.crt" ca_file = "/etc/raddb/certs/radldapCA.crt" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel radiusd: #### Skipping IP addresses and Ports #### listen { type = "auth" ipv4addr = * port = 1812 limit { max_connections = 32 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 0 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 }

2 1

Internet Access By Nat
by Ali Arslan 07 Jan '19

07 Jan '19

An ISP need to use NAT to let its subscribers access internet because of limited number of available public IP addresses. The requirements are as follows: 1- In order to reduce the amount of NAT IPDR (Internet Protocol Detail Record) data that will be sent to Telecommunications Communication Presidency, each user in NAT applications should be assigned a certain range of ports. For example, assuming a range of 200 ports is defined by the operator for each user, when a subscriber with a private IP address of 10.0.0.1 wants to make a connection over the actual IP, a port range of 10000: 10200 for that actual IP address is allocated to that user. 2- A port or port range assigned to a user; after being wasted for at least one hour, it is appropriate to allocate it to a different user Is there way to configure this in freeradius or is it purely a nas procedure? Thanks.

3 3

Authentication fails when username contains specific characters.
by Izumi 05 Jan '19

05 Jan '19

Hi dear list. I'm sorry my English is not good. Authentication fails when the username contains the next 23 characters. (like Andy1 and Burt1) 23 chars -> !#$%&()*+,;<=>?[]^`{|}~ However, the authentication not fail when the password contains that 23 characters. (like Eddy) What do I need to do to solve the problem of Andy1 and Burt1 ? I read debug output and tried Andy2 and Burt2. (Enter equals sign and ASCII code in Hex (e.g. '=2B' for '+')) I found out that it will succeed in authentication, but is there any other solution ? Do I have to do this conversion each time I add a user ? I attached .bash_history and all files that may be useful. I think that the location of radtest in .bash_history is strange because of the execution of radtest from another teraterm window. The version is as follows. FreeRADIUS radiusd: FreeRADIUS Version 3.0.12, for host arm-unknown-linux-gnueabihf, built on Aug 10 2017 at 07:05:06 MySQL mysql Ver 15.1 Distrib 10.1.37-MariaDB, for debian-linux-gnueabihf (armv8l) using readline 5.2 Raspberry Pi Linux raspberrypi 4.14.79-v7+ #1159 SMP Sun Nov 4 17:50:20 GMT 2018 armv7l GNU/Linux I wrote the latest image of Raspbian Stretch Lite on the SD card and I was update and upgrade raspbian. select * from radcheck; +----+-------------------------------------------------+--------------------+----+-------------------------------+ | id | username | attribute | op | value | +----+-------------------------------------------------+--------------------+----+-------------------------------+ | 1 | Jack | Cleartext-Password | := | grape | | 2 | Andy1!#$%&()*+,-./ | Cleartext-Password | := | apple1 | | 3 | Burt1:;<=>?@[]^_`{|}~ | Cleartext-Password | := | banana1 | | 4 | Andy2=21=23=24=25=26=28=29=2A=2B=2C-./ | Cleartext-Password | := | apple2 | | 5 | Burt2:=3B=3C=3D=3E=3F@=5B=5D=5E_=60=7B=7C=7D=7E | Cleartext-Password | := | banana2 | | 6 | Eddy | Cleartext-Password | := | !#$%&()*+,-./:;<=>?@[]^_`{|}~ | +----+-------------------------------------------------+--------------------+----+-------------------------------+ Debug Output of Andy1 FreeRADIUS Version 3.0.12 Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/sql including configuration file /etc/freeradius/3.0/mods-config/sql/main/sqlite/queries.conf including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/control including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/3.0/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 0 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } accounting-off { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-date('now')}, %{%{integer:Event-Timestamp}:-date('now')}, NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = %{%{integer:Event-Timestamp}:-date('now')}, acctinterval = 0, framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "sql" from file /etc/freeradius/3.0/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.1.37-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.37-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.37-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.37-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.37-MariaDB-0+deb9u1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.37-MariaDB-0+deb9u1, protocol version 10 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 53664 Listening on proxy address :: port 57471 Ready to process requests (0) Received Access-Request Id 225 from 127.0.0.1:58832 to 127.0.0.1:1812 length 88 (0) User-Name = "Andy1!#$%&()*+,-./" (0) User-Password = "apple1" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 1812 (0) Message-Authenticator = 0x66d8b202154fefbee7ff2b600c3d535c (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "Andy1!#$%&()*+,-./", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> Andy1!#$%&()*+,-./ (0) sql: SQL-User-Name set to 'Andy1!#$%&()*+,-./' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Andy1=21=23=24=25=26=28=29=2A=2B=2C-./' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Andy1=21=23=24=25=26=28=29=2A=2B=2C-./' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'Andy1=21=23=24=25=26=28=29=2A=2B=2C-./' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'Andy1=21=23=24=25=26=28=29=2A=2B=2C-./' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 10.1.37-MariaDB-0+deb9u1, protocol version 10 (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [Andy1!#$%&()*+,-.//apple1] (from client localhost port 1812) (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND %{User-Name} (0) sql: --> Andy1!#$%&()*+,-./ (0) sql: SQL-User-Name set to 'Andy1!#$%&()*+,-./' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Andy1=21=23=24=25=26=28=29=2A=2B=2C-./', 'apple1', 'Access-Reject', '2019-01-04 16:24:35') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Andy1=21=23=24=25=26=28=29=2A=2B=2C-./', 'apple1', 'Access-Reject', '2019-01-04 16:24:35') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> Andy1!#$%&()*+,-./ (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 225 from 127.0.0.1:1812 to 127.0.0.1:58832 length 20 Waking up in 3.9 seconds. Sincerely, Izumi

2 3

How to retain Module-Failure-Message from inner-tunnel when using PEAP
by Peter Steadman 04 Jan '19

04 Jan '19

Hello I am struggling to extract the inner-tunnel reject message to linelog and should be grateful for some help please. Instead of getting; Module-Failure-Message := "Rejected: User-Name contains whitespace" the cached message it is being replaced in the final eap exchange by; The users session was previously rejected: returning reject (again.) I did find this post; http://lists.freeradius.org/pipermail/freeradius-users/2014-December/074957… which is exactly my issue helpfully with a solution, but unfortunately I seem to be struggling to apply the solution. - in inner-tunnel, post-auth-type Reject, do: update outer.session-state { Module-Failure-Message := &request:Module-Failure-Message } This seems to work ok but when I try applying the second part; And then in the “default” virtual server, post-auth section, you can use: %{%{session-state:Module-Failure-Message}:-%{Module-Failure-Message}} I just get the error "Missing attribute value" when trying to start the server which leads me to suspect that I am not putting this in right place or formatting it incorrectly. Could someone please give me an example of this "%{%{session-state:Module-Failure-Message}:-%{Module-Failure-Message}}" in the context of the post-auth section. many thanks Pete -- <https://twitter.com/warwickshirecol> <https://www.facebook.com/WarwickshireCollege> <https://www.linkedin.com/edu/warwickshire-college-group-355076> <https://www.instagram.com/warwickshirecol/> College Email Disclaimer This message and any files transmitted with it is intended for the addressee only and may contain information that is confidential or privileged. Unauthorised use is strictly prohibited and may be unlawful. If you are not the addressee, you should not read, copy, disclose or otherwise use this message, otherwise than to notify the College via postmaster(a)warkscol.ac.uk <mailto:postmaster@warkscol.ac.uk>. You should delete this message and any files transmitted with it from your computer and destroy any copies made. Warwickshire College gives no warranty or representation as to the accuracy or reliability of the message and files and does not necessarily endorse any opinions expressed within it.

3 3

FreeRadius 3 OpenLDAP and MAC based Auth
by Jürgen Northe 04 Jan '19

04 Jan '19

Hi folks, I have already a running environment with Freeradius2 + OpenLDAP to provide a simple NAC solution but now its time to setup a replacement with version 3. So far everything is working but somehow the "authorize" of the client is not "processed". Compared with the version 2, I am missing the rlm_ldap: radiusAuthType -> Auth-Type == Accept along with the other attributes stored in the directory. I do have a the dictionary_mapping file and the entries in the enabled ldap module. I am fighting the whole day with this issue but can't even find hint in he running environment. The Laptop exists in the LDAP (bind ok, object can be found) and has the usual radius attributes like Tunnel-Private-Group-Id set as the LDAP database is restored from the running one. With the following statement in default, I do get an "Accept", but still missing the required attributes like tunnel-type and all the others. ### redundant_ldap{ ok = return } if (!ok) { reject } else { update control { Auth-Type := Accept } } radiusd -X (1) Received Access-Request Id 186 from 192.168.0.7:3437 to 192.168.0.215:1812 length 240 (1) User-Name = "106530670342" (1) User-Password = "106530670342" (1) NAS-IP-Address = 192.168.0.7 (1) NAS-Identifier = "SWSG1AP1-7-v161121" (1) NAS-Port = 16879715 (1) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" (1) NAS-Port-Type = Ethernet (1) Service-Type = Call-Check (1) Framed-Protocol = PPP (1) Calling-Station-Id = "10-65-30-67-03-42" (1) Acct-Session-Id = "10101121726a6010" (1) Huawei-Connect-ID = 675841 (1) Huawei-Product-ID = "H3C S5120-52C-EI" (1) Huawei-Startup-Stamp = 956750420 (1) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) policy rewrite_calling_station_id { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) update request { (1) EXPAND %{toupper:%{1}%{2}%{3}%{4}%{5}%{6}} (1) --> 106530670342 (1) &Calling-Station-Id := 106530670342 (1) } # update request = noop (1) [updated] = updated (1) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (1) ... skipping else: Preceding "if" was taken (1) } # policy rewrite_calling_station_id = updated (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "106530670342", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: users: Matched entry DEFAULT at line 195 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) redundant redundant_ldap { rlm_ldap (ldap1): Reserved connection (1) (1) ldap1: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap1: --> (cn=106530670342) (1) ldap1: Performing search in "dc=firma,dc=de" with filter "(cn=106530670342)", scope "sub" (1) ldap1: Waiting for search result... (1) ldap1: User object found at DN "cn=NBBZ1807-134,cn=4.notebooks,cn=172.17.0.0,cn=SUBNET,cn=DHCP Config,dc=firma,dc=de" rlm_ldap (ldap1): Released connection (1) Need 4 more connections to reach 10 spares rlm_ldap (ldap1): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap1): Connecting to ldap://radldap1-215:389 TLSMC: MozNSS compatibility interception begins. tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. TLSMC: MozNSS compatibility interception ends. rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful (1) [ldap1] = ok (1) } # redundant redundant_ldap = ok (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> 106530670342 (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds

2 1

Use network range in hungroups file
by Daniel Finger 04 Jan '19

04 Jan '19

Hi! I would like to compare the Client-IP-Address to a network in the huntgroup file. Since FreeRADIUS 2 I am using something like this: huntgroup1 Client-IP-Address =~ 192\.168\..* With FR3 I hoped I could use something like: huntgroup1 Client-IP-Address < 192.168/16 But this results in an Error: Error: /etc/raddb/mods-config/preprocess/huntgroups[56]: Parse error (check) for entry huntgroup1: Invalid IPv4 mask length "/16". Only "/32" permitted for non-prefix types Is it somehow possible with FR3 to compare the Client-IP-Address to a network range in the huntgroups file? Sincerely, Daniel

3 2

FreeRadius 3 OpenLDAP and MAC based Auth
by Jürgen Northe 04 Jan '19

04 Jan '19

.. and the output with the statement mentioned below.... Any help appreciated!! Thank you in advance. Jürgen rlm_ldap (ldap1): Waiting for bind result... rlm_ldap (ldap1): Bind successful (0) [ldap1] = ok (0) } # redundant redundant_ldap = ok (0) if (!ok) { (0) if (!ok) -> FALSE (0) else { (0) update control { (0) Auth-Type := Accept (0) } # update control = noop (0) } # else = noop (0) } # authorize = updated (0) Found Auth-Type = Accept (0) Auth-Type = Accept, accepting the user (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 189 from 192.168.0.215:1812 to 192.168.0.7:3437 length 0 (0) Framed-Protocol = PPP (0) Framed-Compression = Van-Jacobson-TCP-IP (0) Finished request Waking up in 4.9 seconds. > Hi folks, > I have already a running environment with Freeradius2 + OpenLDAP to provide a simple NAC solution but now its time to setup a replacement with version 3. > > So far everything is working but somehow the "authorize" of the client is not "processed". Compared with the version 2, I am missing the > rlm_ldap: radiusAuthType -> Auth-Type == Accept > along with the other attributes stored in the directory. > I do have a the dictionary_mapping file and the entries in the enabled ldap module. I am fighting the whole day with this issue but can't even find hint in he running environment. > The Laptop exists in the LDAP (bind ok, object can be found) and has the usual radius attributes like Tunnel-Private-Group-Id set as the LDAP database is restored from the running one. > > With the following statement in default, I do get an "Accept", but also without the required attributes. > redundant_ldap{ > ok = return > } > > if (!ok) { > reject > } > else { > update control { > Auth-Type := Accept > } > } > > > > radiusd -X > (1) Received Access-Request Id 186 from 192.168.0.7:3437 to 192.168.0.215:1812 length 240 > (1) User-Name = "106530670342" > (1) User-Password = "106530670342" > (1) NAS-IP-Address = 192.168.0.7 > (1) NAS-Identifier = "SWSG1AP1-7-v161121" > (1) NAS-Port = 16879715 > (1) NAS-Port-Id = "slot=1;subslot=0;port=25;vlanid=99" > (1) NAS-Port-Type = Ethernet > (1) Service-Type = Call-Check > (1) Framed-Protocol = PPP > (1) Calling-Station-Id = "10-65-30-67-03-42" > (1) Acct-Session-Id = "10101121726a6010" > (1) Huawei-Connect-ID = 675841 > (1) Huawei-Product-ID = "H3C S5120-52C-EI" > (1) Huawei-Startup-Stamp = 956750420 > (1) Attr-26.43.230 = 0x4769676162697445746865726e6574312f302f3235> (1) # Executing section authorize from file /etc/raddb/sites-enabled/default > (1) authorize { > (1) policy filter_username { > (1) if (&User-Name) { > (1) if (&User-Name) -> TRUE > (1) if (&User-Name) { > (1) if (&User-Name =~ / /) { > (1) if (&User-Name =~ / /) -> FALSE > (1) if (&User-Name =~ /@[^@]*@/ ) { > (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE > (1) if (&User-Name =~ /\.\./ ) { > (1) if (&User-Name =~ /\.\./ ) -> FALSE > (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { > (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE > (1) if (&User-Name =~ /\.$/) { > (1) if (&User-Name =~ /\.$/) -> FALSE > (1) if (&User-Name =~ /(a)\./) { > (1) if (&User-Name =~ /(a)\./) -> FALSE > (1) } # if (&User-Name) = notfound > (1) } # policy filter_username = notfound > (1) policy rewrite_calling_station_id { > (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { > (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE > (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { > (1) update request { > (1) EXPAND %{toupper:%{1}%{2}%{3}%{4}%{5}%{6}} > (1) --> 106530670342 > (1) &Calling-Station-Id := 106530670342 > (1) } # update request = noop > (1) [updated] = updated > (1) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated > (1) ... skipping else: Preceding "if" was taken > (1) } # policy rewrite_calling_station_id = updated > (1) [preprocess] = ok > (1) [chap] = noop > (1) [mschap] = noop > (1) suffix: Checking for suffix after "@" > (1) suffix: No '@' in User-Name = "106530670342", looking up realm NULL > (1) suffix: No such realm "NULL" > (1) [suffix] = noop > (1) eap: No EAP-Message, not doing EAP > (1) [eap] = noop > (1) files: users: Matched entry DEFAULT at line 195 > (1) [files] = ok > (1) [expiration] = noop > (1) [logintime] = noop > (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type > (1) pap: WARNING: Authentication will fail unless a "known good" password is available > (1) [pap] = noop > (1) redundant redundant_ldap { > rlm_ldap (ldap1): Reserved connection (1) > (1) ldap1: EXPAND (cn=%{%{Stripped-User-Name}:-%{User-Name}}) > (1) ldap1: --> (cn=106530670342) > (1) ldap1: Performing search in "dc=firma,dc=de" with filter "(cn=106530670342)", scope "sub" > (1) ldap1: Waiting for search result... > (1) ldap1: User object found at DN "cn=NBBZ1807-134,cn=4.notebooks,cn=172.17.0.0,cn=SUBNET,cn=DHCP Config,dc=firma,dc=de" > rlm_ldap (ldap1): Released connection (1) > Need 4 more connections to reach 10 spares > rlm_ldap (ldap1): Opening additional connection (6), 1 of 26 pending slots used > rlm_ldap (ldap1): Connecting to ldap://radldap1-215:389 > TLSMC: MozNSS compatibility interception begins. > tlsmc_convert: INFO: cannot open the NSS DB, expecting PEM configuration is present. > tlsmc_intercept_initialization: INFO: successfully intercepted TLS initialization. Continuing with OpenSSL only. > TLSMC: MozNSS compatibility interception ends. > rlm_ldap (ldap1): Waiting for bind result... > rlm_ldap (ldap1): Bind successful > (1) [ldap1] = ok > (1) } # redundant redundant_ldap = ok > (1) } # authorize = ok > (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject > (1) Failed to authenticate the user > (1) Using Post-Auth-Type Reject > (1) # Executing group from file /etc/raddb/sites-enabled/default > (1) Post-Auth-Type REJECT { > (1) attr_filter.access_reject: EXPAND %{User-Name} > (1) attr_filter.access_reject: --> 106530670342 > (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 > (1) [attr_filter.access_reject] = updated > (1) [eap] = noop > (1) policy remove_reply_message_if_eap { > (1) if (&reply:EAP-Message && &reply:Reply-Message) { > (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE > (1) else { > (1) [noop] = noop > (1) } # else = noop > (1) } # policy remove_reply_message_if_eap = noop > (1) } # Post-Auth-Type REJECT = updated > (1) Delaying response for 1.000000 seconds

1 0