February 2019 - Freeradius-Users - lists.freeradius.org

Use expr for reply from sql database
by kai.zemke＠hauni.com 26 Feb '19

26 Feb '19

Hi, I do have freeradius setup with a sql configuration. My mysql server is running the scheme that is proposed on the freeradius wiki. So far everything is doing fine. Now I want to replay with an Egress-VLANID. If I enter the value hexencoded everything works fine. But if I enter the value with the expr function the replied value is always zero and I have the following entry in my radius.log sql: Error parsing value: Unknown or invalid value "%{expr: 0x31000000 + 105}" for attribute Egress-VLANID) Do I have to mask certain characters in order to make this work? Example: Egress-VLANID = `%{expr: 0x31000000 + 105}` Best regards Kai ________________________________ Diese E-Mail kann vertrauliche Informationen enthalten. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Informationen sind nicht gestattet. Sollten Sie diese E-Mail irrt?mlich erhalten haben, informieren Sie bitte den Absender und l?schen diese E-Mail. This e-mail may contain confidential information, which should not be copied or distributed without authorization. If you have received this e-mail message by mistake, please inform the sender and delete it from your system.

2 1

RE: [EXTERNAL] How mitigate mac spoofing in mab
by Carlos Bordon 26 Feb '19

26 Feb '19

The second thing you can do is on the FreeRADIUS side, which is to use a Simultaneous Use database to prevent MAB requests from different ports at near the same time from being accepted. However, this can be problematic. If you are updating the Simultaneous Use database based on edge switch Accounting packets, then the edge switch may leave stale sessions open and continue to send updates after a host is unplugged and moved by the user to another port... especially if a minihub has been attached to the network and the link stays up. Then when the user gets to the place they have moved, they cannot get on the network because Simultaneous Use thinks they are an imposter. this is great! how can I do this? Thanks! ________________________________ De: Freeradius-Users <freeradius-users-bounces+cgermanb=live.com.ar(a)lists.freeradius.org> en nombre de Brian Julin <BJulin(a)clarku.edu> Enviado: jueves, 7 de febrero de 2019 17:20 Para: freeradius-users(a)lists.freeradius.org Asunto: Re: [EXTERNAL] How mitigate mac spoofing in mab Carlos Bordon <cgermanb(a)live.com.ar> wrote: > I have ine server with freeradius, other with dhcp and they are connect to cisco 6800 swicht. We aunthenticate the endpoint with mab, because we cant use 802.1x. the problem that i want to resolve is to mitigate mac spoofing on layer two. > For us is the same mitigate the problem on the radius or the swicht config. With MAB there is absolutely no way to tell if the host using a MAC address is the actual host that has that burned-in-address (BIA). There are a few things you can do. First, use IP DHCP snooping and ARP inspection features on the edge switch. This will at least keep one host from spoofing many IP or MAC addresses without doing a DHCP transaction for each address, which slows an attacker down. You can also use edge switch port security features to limit the number of MAC addresses allowed on a single port to something reasonable. (While you are at it, see if you also have features to prevent DHCP starvation.) The second thing you can do is on the FreeRADIUS side, which is to use a Simultaneous Use database to prevent MAB requests from different ports at near the same time from being accepted. However, this can be problematic. If you are updating the Simultaneous Use database based on edge switch Accounting packets, then the edge switch may leave stale sessions open and continue to send updates after a host is unplugged and moved by the user to another port... especially if a minihub has been attached to the network and the link stays up. Then when the user gets to the place they have moved, they cannot get on the network because Simultaneous Use thinks they are an imposter. You have to check the behavior of your edge switches and do a lot of testing to make sure that this will work without problems. - List info/subscribe/unsubscribe? See https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freerad… - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Google LDAP integration failure
by Phil Grace 26 Feb '19

26 Feb '19

Hi everyone, I’m brand new and having an issue that I haven’t found a clear answer to. I’m running free radius 3.x on ubuntu server 18.10. I have LDAP enabled to auth to google secure LDAP. So far I’m binding to google successfully and with the radtest command my LDAP user gets access-accept. If I do raddest with -t mschap I get access-reject. I’m hoping that someone more experienced can point me in the right direction as to where I can fix the issue. Here’s a snippet of my log in -X mode. Thanks in advance to anyone that can help =================================================================================================================== rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (15) [ldap] = ok (15) [expiration] = noop (15) [logintime] = noop (15) [pap] = noop (15) } # authorize = updated (15) Found Auth-Type = eap (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (15) authenticate { (15) eap: Expiring EAP session with state 0x53c912cb54220b41 (15) eap: Finished EAP session with state 0x313d43603170599a (15) eap: Previous EAP request found for state 0x313d43603170599a, released from the list (15) eap: Peer sent packet with method EAP MSCHAPv2 (26) (15) eap: Calling submodule eap_mschapv2 to process data (15) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (15) eap_mschapv2: authenticate { (15) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (15) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (15) mschap: Creating challenge hash with username: phil.grace(a)hssd.k12.ar.us (15) mschap: Client is using MS-CHAPv2 (15) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (15) mschap: ERROR: MS-CHAP2-Response is incorrect (15) [mschap] = reject (15) } # authenticate = reject (15) eap: Sending EAP Failure (code 4) ID 77 length 4 (15) eap: Freeing handler (15) [eap] = reject (15) } # authenticate = reject (15) Failed to authenticate the user (15) Using Post-Auth-Type Reject (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (15) Post-Auth-Type REJECT { (15) attr_filter.access_reject: EXPAND %{User-Name} (15) attr_filter.access_reject: --> phil.grace(a)hssd.k12.ar.us (15) attr_filter.access_reject: Matched entry DEFAULT at line 11 (15) [attr_filter.access_reject] = updated (15) update outer.session-state { (15) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: FAILED: No NT/LM-Password. Cannot perform authentication' (15) } # update outer.session-state = noop (15) } # Post-Auth-Type REJECT = updated (15) } # server inner-tunnel (15) Virtual server sending reply (15) MS-CHAP-Error = "ME=691 R=1 C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" (15) EAP-Message = 0x044d0004 (15) Message-Authenticator = 0x00000000000000000000000000000000 (15) eap_peap: Got tunneled reply code 3 (15) eap_peap: MS-CHAP-Error = "ME=691 R=1 C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" (15) eap_peap: EAP-Message = 0x044d0004 (15) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (15) eap_peap: Got tunneled reply RADIUS code 3 (15) eap_peap: MS-CHAP-Error = "ME=691 R=1 C=369d22d8c278cfa7667ff5d2ab0bf287 V=3 M=Authentication rejected" (15) eap_peap: EAP-Message = 0x044d0004 (15) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (15) eap_peap: Tunneled authentication was rejected (15) eap_peap: FAILURE (15) eap: Sending EAP Request (code 1) ID 78 length 46 (15) eap: EAP session adding &reply:State = 0x893d3c588e7325ea (15) [eap] = handled (15) } # authenticate = handled (15) Using Post-Auth-Type Challenge (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (15) Challenge { ... } # empty sub-section is ignored (15) session-state: Saving cached attributes (15) Module-Failure-Message := "mschap: FAILED: No NT/LM-Password. Cannot perform authentication" (15) Sent Access-Challenge Id 78 from 10.8.172.26:1812 to 10.8.173.105:38595 length 0 (15) EAP-Message = 0x014e002e1900170303002377d07beda30c6131207f85740de5138af7d4342329fb590ca32ddd8e781256a69c9a3a (15) Message-Authenticator = 0x00000000000000000000000000000000 (15) State = 0x893d3c588e7325ea93a4d1f0a45e4742 (15) Finished request Waking up in 3.4 seconds. (16) Received Access-Request Id 79 from 10.8.173.105:38595 to 10.8.172.26:1812 length 320 (16) User-Name = "phil.grace(a)hssd.k12.ar.us" (16) NAS-IP-Address = 10.8.173.105 (16) Called-Station-Id = "8A-15-54-AB-61-48:Faculty" (16) NAS-Port-Type = Wireless-802.11 (16) Service-Type = Framed-User (16) NAS-Port = 1 (16) Calling-Station-Id = "C8-3C-85-9C-A7-17" (16) Connect-Info = "CONNECT 54.00 Mbps, 802.11ac, RSSI: 26, Channel: 149" (16) Acct-Session-Id = "03D12019BACECB86" (16) WLAN-Pairwise-Cipher = 1027076 (16) WLAN-Group-Cipher = 1027074 (16) WLAN-AKM-Suite = 1027073 (16) Meraki-Device-Name = "Technology Dept" (16) Framed-MTU = 1400 (16) EAP-Message = 0x024e002e1900170303002321d3fee96f33295e5c79085340cadd61fe65772f5ac4bf4fb1b67c9346e8461e546cea (16) State = 0x893d3c588e7325ea93a4d1f0a45e4742 (16) Message-Authenticator = 0x36f2f741b4dbc208756af96049eeda54 (16) Restoring &session-state (16) &session-state:Module-Failure-Message := "mschap: FAILED: No NT/LM-Password. Cannot perform authentication" (16) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (16) authorize { (16) policy filter_username { (16) if (&User-Name) { (16) if (&User-Name) -> TRUE (16) if (&User-Name) { (16) if (&User-Name =~ / /) { (16) if (&User-Name =~ / /) -> FALSE (16) if (&User-Name =~ /@[^@]*@/ ) { (16) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (16) if (&User-Name =~ /\.\./ ) { (16) if (&User-Name =~ /\.\./ ) -> FALSE (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (16) if (&User-Name =~ /\.$/) { (16) if (&User-Name =~ /\.$/) -> FALSE (16) if (&User-Name =~ /(a)\./) { (16) if (&User-Name =~ /(a)\./) -> FALSE (16) } # if (&User-Name) = notfound (16) } # policy filter_username = notfound (16) [preprocess] = ok (16) [chap] = noop (16) [mschap] = noop (16) [digest] = noop (16) suffix: Checking for suffix after "@" (16) suffix: Looking up realm "hssd.k12.ar.us" for User-Name = "phil.grace(a)hssd.k12.ar.us" (16) suffix: No such realm "hssd.k12.ar.us" (16) [suffix] = noop (16) eap: Peer sent EAP Response (code 2) ID 78 length 46 (16) eap: Continuing tunnel setup (16) [eap] = ok (16) } # authorize = ok (16) Found Auth-Type = eap (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (16) authenticate { (16) eap: Expiring EAP session with state 0x53c912cb54220b41 (16) eap: Finished EAP session with state 0x893d3c588e7325ea (16) eap: Previous EAP request found for state 0x893d3c588e7325ea, released from the list (16) eap: Peer sent packet with method EAP PEAP (25) (16) eap: Calling submodule eap_peap to process data (16) eap_peap: Continuing EAP-TLS (16) eap_peap: [eaptls verify] = ok (16) eap_peap: Done initial handshake (16) eap_peap: [eaptls process] = ok (16) eap_peap: Session established. Decoding tunneled attributes (16) eap_peap: PEAP state send tlv failure (16) eap_peap: Received EAP-TLV response (16) eap_peap: ERROR: The users session was previously rejected: returning reject (again.) (16) eap_peap: This means you need to read the PREVIOUS messages in the debug output (16) eap_peap: to find out the reason why the user was rejected (16) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (16) eap_peap: what went wrong, and how to fix the problem (16) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (16) eap: Sending EAP Failure (code 4) ID 78 length 4 (16) eap: Failed in EAP select (16) [eap] = invalid (16) } # authenticate = invalid (16) Failed to authenticate the user (16) Using Post-Auth-Type Reject (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (16) Post-Auth-Type REJECT { (16) attr_filter.access_reject: EXPAND %{User-Name} (16) attr_filter.access_reject: --> phil.grace(a)hssd.k12.ar.us (16) attr_filter.access_reject: Matched entry DEFAULT at line 11 (16) [attr_filter.access_reject] = updated (16) [eap] = noop (16) policy remove_reply_message_if_eap { (16) if (&reply:EAP-Message && &reply:Reply-Message) { (16) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (16) else { (16) [noop] = noop (16) } # else = noop (16) } # policy remove_reply_message_if_eap = noop (16) } # Post-Auth-Type REJECT = updated (16) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (16) Sending delayed response (16) Sent Access-Reject Id 79 from 10.8.172.26:1812 to 10.8.173.105:38595 length 44 (16) EAP-Message = 0x044e0004 (16) Message-Authenticator = 0x00000000000000000000000000000000 =================================================================================== Phil Grace Director of Technology Heber Springs School District phil.grace(a)hssd.k12.ar.us Arkansas LEA Rep to the NCES Forum National Center for Education Statistics https://nces.ed.gov/forum/

3 6

Version 3.0.18 has been released
by Alan DeKok 25 Feb '19

25 Feb '19

After many delays, we've finally managed to release version 3.0.18. This version fixes all known issues in the server. The long delay between 3.0.17 and 3.0.18 was in large part due to a few complex issues which were difficult to track down. Thanks to Graham Clinch and Matthew Newton for tracking down two different issues. A full list of feature improvements and bug fixes is listed below. We try to keep major new features to a minimum in the "stable" lease of FreeRADIUS. However, we have included a lot of minor feature enhancements in the FEATURE IMPROVEMENTS • cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss. • Do-Not-Respond policies can now be set in the "post-auth" section. • Encode / Decode ADSL Forum DHCP options. • Fix module ordering issues. e.g. when "sqlippool" needs "sql". See the "instantiate" section of radiusd.conf. • Add Big Switch dictionary. Fixes #2252. • Add sql_session_start policy (raddb/policy.d/accounting) This minimizes race conditions when using Simultaneous-Use Patch from Philippe Wooding (#2257). • For rlm_perl, all variables are now tainted by default. See raddb/mods-available/perl, and the "perl_flags" configuration item. This change should only affect people who are using variables in insecure ways. • Allow "sqlcounter" module to be listed in "post-auth". • Add support for IPv6 attributes in SQL. Fixes #2280 Patches from Michael Ducharme. • The server is better at handling fail-over for outbound RadSec and TCP connections. Fixes #2284. • The server is now more aggressive about retrying failed outbound RadSec and TCP connections. Fixes #2284. • Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list. • Add expansion for Radsec connections. "%{listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. • Add notes on running "ldapsearch" using the parameters from the LDAP module. • "ipaddr" attributes can now be cast to "integer" type attributes in an "update" section. • Move main thread queue to using atomic queues. This should help with contention in high load scenarios. • Add "recv_buff" setting to listeners. For more details, see sites-available/default. • The sqlippool module can now use attributes other than "Pool-Name" to assign IP pools. The "Pool-Name" attribute is still the default. • The "unpack" expansion can now unpack substrings. See mods-available/unpack for documentation and examples. • The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE. • Allow for <instance>-LDAP-UserDN. See mods-available/ldap for more information. • Add sanitizing of control list for moonshot. Fixes #2318. • Update rlm_sql_mysql to be compatible with MySQL 8 Fixes https://bugs.launchpad.net/bugs/1795310. • Allow logging of only Access-Accept or Access-Reject messages See radiusd.conf, "auth_accept" and "auth_reject". • Removed Connect-Rate comparison. It was unused and broken. • Add dictionary.infinera. • RPMs can now change raddb location with rpmbuild parameter --define '_sysconfdir /etc'. • OpenDirectory module now points to Apple documentation for help with build and configuration. • Use OpenSSL HMAC functions instead of local ones. • Some SQL modules can now use "auto_escape" to escape unsafe strings See mods-config/sql/main/mysql/queries.conf. • Add wispr2date conversion in mods-available/date. • Implement dictionary-based handling in rlm_python. Fixes #2334 See mods-available/python for details. • Add support for SKIP LOCKED in sqlippool. This can improve performance by an order of magnitude or more. See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383. Patch from Nathan Ward. • Updated Debian packages to allow for libssl1.1 Fixes #2384. Patch from Alejandro Perez. • Allow PSK and certificates at the same time Except for TLS 1.3 which does not support that. • Update Debian packages for newer releases Fixes #2391. Patch from Matthew Newton. • Update docker scripts. Fixes #2306 Patch from Matthew Newton. • Add crypt xlat. • MySQL connections can now skip verifying the server certificate. Fixes #2481. See mods-available/sql. • Add better mechanism to detect MariaDB (Old MySQL). • Add RFC 7532 "bang path" support for realms Fixes #2492. • Update dictionary.ukerna documentation. Fixes #2493. • Add support for systemd service and watchdogs Fixes #2499. • Check for openss/rand.h, and allow building without OpenSSL engine. Patch from Eneas U de Queiroz Fixes #2517. • The default PosgtreSQL queries now use "ON CONFLICT" to better deal with issues. This requires PostgreSQL 9.5 or later. Please use a recent version of PostgreSQL, or edit the default queries to remove "ON CONFLICT". BUG FIXES • The session-state list is no longer cleaned in the inner-tunnel. This lets the outer Access-Reject section access session-state. • Fix typo in lock initialization for TLS sockets Found by Sergio NNX. • Add check for crash when home server down Fixes #2233. • Add username key for postauth table. • Better libpcap checks, when the header files or libraries are missing. Fixes #2245. • Allow building with old versions of OpenSSL Fixes #2247. • Allow non-FreeRADIUS State attributes to be used with the "session-state" list. i.e. State length != 16. • Be more aggressive about cleaning up zombie children when running in debug mode. • Use LTDL_DEEPBIND, which fixes issues with Oracle libraries exporting LDAP API functions. • unlock files when asked to unlock them. • return error instead of asserting in map code. • Don't write 0 bytes to SSL. Fixes #2270. • Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262. • Various dictionary cleanups and consistency checks Fixes #2281. Patches from Peter Lemenkov. • rlm_python has stronger thread locking to prevent reported issues. Performance may be affected. • Don't allow Message-Authenticator to overflow past the end of a large packet. • Fix crash in sqlippool when SQL server goes away Fixes #2300. • Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303. • Check for correct OpenSSL version in vulnerability list. Patch from Christian Hesse. • Fix crash with CoA packets/ Fixes #2304. • Fix crash in rlm_exec with CoA. Fixes #2328. • Print errors while parsing the log config, and don't quit when deprecated log settings are found. • Fix DHCP encoder xlat so that it can be used with a list of attributes. It previously only encoded the first member of the list, and now encodes all members. • The "expr" module now skips more whitespace. • Remove internal FreeRADIUS-Response-Delay attributes from attr_filter Access-Reject. • Don't send junk to redis when maximum args reached. • Small updates to IPv6 for accounting schema Fixes #2364. • Fix OpenDirectory integration in rlm_mschap. • Fix slow memory leak with dynamic clients. • Don't artificially truncate debug output for long strings. • Fix memory leak in EAP-PWD. • Fix crash in "hints" file with Fall-Through = yes. • Fix crash / timer issues with many CoA packets. • Fix attr_filter so that it does not treat vendor attributes of number 26 as Vendor-Specific. • Fix reconnect correctly in rlm_sql_mysql. • Fix rlm_cache to properly use Cache-TTL < 0 Fixes #2485. • Fix rare occurance of bad xlat expansion. • Check for rare race condition when a proxy reply arrives too late.

1 0

Re: Migration from GNU Radius to FreeRadius
by Aditya Vijjan 25 Feb '19

25 Feb '19

HI Team, We have old GNU Radius and have decided migration to Freeradius, we are using Mysql as db need help in migration. Do we have any documentation for the same. On Mon, Feb 25, 2019 at 9:40 AM Aditya Vijjan <aditya.vijjan(a)gmail.com> wrote: > HI Team, > > We have old GNU Radius and have decided migration to Freeradius, we are > using Mysql as db need help in migration. > > Do we have any documentation for the same. > > -- > Thanks & Regards > Aditya Vijjan > > > -- Thanks & Regards Aditya Vijjan MBA- IT Mcsa,Rhce,Mcts,Cmss,Sts,Ccnsp,Gca,Itil,Aws,Azure. 9930830957 aditya.vijjan(a)gmail.com

2 1

Reading dynamic clients from "clients" files in /etc/raddb/dynamic-clients doesn't work
by smith john 23 Feb '19

23 Feb '19

Hello, I'm trying to set up dynamic clients for freeradius 2.2.6 on centos 6.9. Following the documentation in /etc/raddb/mods-available/dynamic_clients, I linked /etc/raddb/sites-enabled/dynamic_clients to /etcraddb/sites-available/dynamic_clients. The contents of /etc/raddb/sites-enabled/dynamic_clients is changed to : client dynamic { ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server directory = ${confdir}/dynamic-clients/ lifetime = 3600 } server dynamic_client_server { authorize { # # Example 2: Read the clients from "clients" files # in a directory. # # This requires you to uncomment the # "directory" configuration in the # "client dynamic" configuration above, # and then put one file per IP address in # that directory. # dynamic_clients # # Tell the caller that the client was defined properly. # # If the authorize section does NOT return "ok", then # the new client is ignored. ok } } I also created the /etc/raddb/dynamic-clients directory and changed its ownership to root:radiusd Below is how I test the config: 1. Run "radiusd -X" in one shell 2. Open another shell and create a file named "18.220.171.233" under etc/raddb/dynamic-clients. client mynas { ipaddr = 18.220.171.233 secret = testing456 } 3. ssh to the nas server at 18.220.171.233, and run the radtest command to test the setup. 4. The debug gives the following result: rad_recv: Access-Request packet from host 18.220.171.233 port 33477, id=170, length=76 server dynamic_client_server { } # server dynamic_client_server - Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing. Ignoring request to authentication address * port 1812 from unknown client 18.220.171.233 port 33477 I can't figure out what I am missing. Can somebody help me with this? Thank you. This is the complete debug output: radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Jul 18 2017 at 12:13:14 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/dynamic-clients including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client dynamic { ipaddr = 0.0.0.0 netmask = 0 require_message_authenticator = no dynamic_clients = "dynamic_client_server" lifetime = 3600 } including dynamic clients in /etc/raddb/dynamic-clients/ radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 32 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{%{Acct-Session-Time}:-0}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{%{Acct-Session-Time}:-0}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): starting 5 rlm_sql (sql): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql): Connected new DB handle, #5 rlm_sql (sql): starting 6 rlm_sql (sql): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql): Connected new DB handle, #6 rlm_sql (sql): starting 7 rlm_sql (sql): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql): Connected new DB handle, #7 rlm_sql (sql): starting 8 rlm_sql (sql): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql): Connected new DB handle, #8 rlm_sql (sql): starting 9 rlm_sql (sql): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql): Connected new DB handle, #9 rlm_sql (sql): starting 10 rlm_sql (sql): Attempting to connect rlm_sql_mysql #10 rlm_sql_mysql: Starting connect to MySQL server for #10 rlm_sql (sql): Connected new DB handle, #10 rlm_sql (sql): starting 11 rlm_sql (sql): Attempting to connect rlm_sql_mysql #11 rlm_sql_mysql: Starting connect to MySQL server for #11 rlm_sql (sql): Connected new DB handle, #11 rlm_sql (sql): starting 12 rlm_sql (sql): Attempting to connect rlm_sql_mysql #12 rlm_sql_mysql: Starting connect to MySQL server for #12 rlm_sql (sql): Connected new DB handle, #12 rlm_sql (sql): starting 13 rlm_sql (sql): Attempting to connect rlm_sql_mysql #13 rlm_sql_mysql: Starting connect to MySQL server for #13 rlm_sql (sql): Connected new DB handle, #13 rlm_sql (sql): starting 14 rlm_sql (sql): Attempting to connect rlm_sql_mysql #14 rlm_sql_mysql: Starting connect to MySQL server for #14 rlm_sql (sql): Connected new DB handle, #14 rlm_sql (sql): starting 15 rlm_sql (sql): Attempting to connect rlm_sql_mysql #15 rlm_sql_mysql: Starting connect to MySQL server for #15 rlm_sql (sql): Connected new DB handle, #15 rlm_sql (sql): starting 16 rlm_sql (sql): Attempting to connect rlm_sql_mysql #16 rlm_sql_mysql: Starting connect to MySQL server for #16 rlm_sql (sql): Connected new DB handle, #16 rlm_sql (sql): starting 17 rlm_sql (sql): Attempting to connect rlm_sql_mysql #17 rlm_sql_mysql: Starting connect to MySQL server for #17 rlm_sql (sql): Connected new DB handle, #17 rlm_sql (sql): starting 18 rlm_sql (sql): Attempting to connect rlm_sql_mysql #18 rlm_sql_mysql: Starting connect to MySQL server for #18 rlm_sql (sql): Connected new DB handle, #18 rlm_sql (sql): starting 19 rlm_sql (sql): Attempting to connect rlm_sql_mysql #19 rlm_sql_mysql: Starting connect to MySQL server for #19 rlm_sql (sql): Connected new DB handle, #19 rlm_sql (sql): starting 20 rlm_sql (sql): Attempting to connect rlm_sql_mysql #20 rlm_sql_mysql: Starting connect to MySQL server for #20 rlm_sql (sql): Connected new DB handle, #20 rlm_sql (sql): starting 21 rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 rlm_sql (sql): starting 25 rlm_sql (sql): Attempting to connect rlm_sql_mysql #25 rlm_sql_mysql: Starting connect to MySQL server for #25 rlm_sql (sql): Connected new DB handle, #25 rlm_sql (sql): starting 26 rlm_sql (sql): Attempting to connect rlm_sql_mysql #26 rlm_sql_mysql: Starting connect to MySQL server for #26 rlm_sql (sql): Connected new DB handle, #26 rlm_sql (sql): starting 27 rlm_sql (sql): Attempting to connect rlm_sql_mysql #27 rlm_sql_mysql: Starting connect to MySQL server for #27 rlm_sql (sql): Connected new DB handle, #27 rlm_sql (sql): starting 28 rlm_sql (sql): Attempting to connect rlm_sql_mysql #28 rlm_sql_mysql: Starting connect to MySQL server for #28 rlm_sql (sql): Connected new DB handle, #28 rlm_sql (sql): starting 29 rlm_sql (sql): Attempting to connect rlm_sql_mysql #29 rlm_sql_mysql: Starting connect to MySQL server for #29 rlm_sql (sql): Connected new DB handle, #29 rlm_sql (sql): starting 30 rlm_sql (sql): Attempting to connect rlm_sql_mysql #30 rlm_sql_mysql: Starting connect to MySQL server for #30 rlm_sql (sql): Connected new DB handle, #30 rlm_sql (sql): starting 31 rlm_sql (sql): Attempting to connect rlm_sql_mysql #31 rlm_sql_mysql: Starting connect to MySQL server for #31 rlm_sql (sql): Connected new DB handle, #31 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server server dynamic_client_server { # from file /etc/raddb/sites-enabled/dynamic-clients modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_dynamic_clients Module: Instantiating module "dynamic_clients" from file /etc/raddb/modules/dynamic_clients Module: Linked to module rlm_always Module: Instantiating module "ok" from file /etc/raddb/modules/always always ok { rcode = "ok" simulcount = 0 mpp = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 40163 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 18.220.171.233 port 33477, id=170, length=76 server dynamic_client_server { } # server dynamic_client_server - Cannot add client 18.220.171.233: Required attribute "FreeRADIUS-Client-Secret" is missing. Ignoring request to authentication address * port 1812 from unknown client 18.220.171.233 port 33477 Ready to process requests.

2 1

How mitigate mac spoofing in mab
by Carlos Bordon 23 Feb '19

23 Feb '19

Hi! i have a problem with this vulnerability, i need mitigate it. I have ine server with freeradius, other with dhcp and they are connect to cisco 6800 swicht. We aunthenticate the endpoint with mab, because we cant use 802.1x. the problem that i want to resolve is to mitigate mac spoofing on layer two. For us is the same mitigate the problem on the radius or the swicht config. Do you guys know any idea? Best regards, Say hi for your sisters!

5 4

Mac-auth
by Dmitriy Andryashin 22 Feb '19

22 Feb '19

Hi everyone! I'm working with Freeradius 3.0.15 And trying to implement authentification by MAC and NAS-Port and NAS-IP-Address and files module. The solution i found by now is to assign key variable in mods-available/files files authorized_macs { key = "%{Calling-Station-ID}-%{NAS-Port}-%{NAS-IP-Address}" usersfile = ${confdir}/authorized_macs } And in authorized_macs have string 00-24-54-05-8D-CB-5002-192.168.100.2 It works. Is there a neat way to do it? Check attributes separetelly. For example: authorized_macs contents: 00-24-54-05-8D-CB Cleartext-Password := 00-24-54-05-8D-CB NAS-Port == 5002 NAS-IP-Address = 192.168.100.2 Reply-Message = "Device with MAC Address %{Calling-Station-Id} authorized for network access" I appreciate any help) -- Best regards, Dmitri

3 4

Re: Freeradius-Users Digest, Vol 166, Issue 48
by Greg Stuart 22 Feb '19

22 Feb '19

Hello Alan, Thank you, I am sorry I put to much info there, I was just thinking to put everything out there just in case. Greg S On Fri, Feb 22, 2019 at 12:10 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Cisco IOS authentication to Freeradius that is linked to AD > (Greg Stuart) > 2. Re: Cisco IOS authentication to Freeradius that is linked to > AD (Alan DeKok) > 3. Re: Mac-auth (Dave Macias) > 4. Use expr for reply from sql database (kai.zemke(a)hauni.com) > 5. Re: Mac-auth (Dmitriy Andryashin) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 22 Feb 2019 11:00:21 -0500 > From: Greg Stuart <gstuart(a)portageps.org> > To: freeradius-users(a)lists.freeradius.org > Subject: Cisco IOS authentication to Freeradius that is linked to AD > Message-ID: > <CAJuGZELCJhm3mA4+ZjohGJnzKU9y9Vit_KNO9gH4UCVo= > T5mfw(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hello, > > I am new to freeradius so please go easy on me :) Here is what I am trying > to do. I am trying to get my Cisco switches to authenticate a user with > full permissions "lvl 15" by using freeradius that is linked to AD. Using > AD credentials > > Below are the configs: > > Switch Config: > > aaa group server radius FreeRadius > server name ppsauth1 > ip radius source-interface GigabitEthernet1/0/50 > ! > > ! > ! > radius-server attribute 6 mandatory > ! > radius server ppsauth1 > address ipv4 10.15.0.51 auth-port 1812 acct-port 1813 > key 7 15060E1F107B7977 > ! > > Switch Debugs: > test aaa group FreeRadius username password legacy > Attempting authentication test to server-group FreeRadius using radius > > 000175: Feb 22 10:47:38: AAA: parse name=<no string> idb type=-1 tty=-1 > 000176: Feb 22 10:47:38: AAA/MEMORY: create_user (0x8C41E4C) > user='username' ruser='NULL' ds0=0 port='' rem_addr='NULL' > authen_type=ASCII servi) > 000177: Feb 22 10:47:38: RADIUS: Pick NAS IP for u=0x8C41E4C tableid=0 > cfg_addr=0.0.0.0 > 000178: Feb 22 10:47:38: RADIUS(00000000): Config NAS IPv6: :: > 000179: Feb 22 10:4User authentication request was rejected by server. > > TTC-GREG2#7:38: RADIUS: ustruct sharecount=1 > 000180: Feb 22 10:47:38: Radius: radius_port_info() success=0 > radius_nas_port=1 > 000181: Feb 22 10:47:38: RADIUS/ENCODE: Best Local IP-Address > 192.168.160.47 for Radius-Server 10.15.0.51 > 000182: Feb 22 10:47:38: RADIUS(00000000): Send Access-Request to > 10.15.0.51:1812 onvrf(0) id 1645/8, len 59 > 000183: Feb 22 10:47:38: RADIUS: authenticator 5F D8 9A 26 5E 67 09 AC - > E8 D9 4F 9C F9 36 D5 24 > 000184: Feb 22 10:47:38: RADIUS: NAS-IP-Address [4] 6 > 192.168.160.47 > TTC-GREG2# > 000185: Feb 22 10:47:38: RADIUS: NAS-Port-Type [61] 6 Async > [0] > 000186: Feb 22 10:47:38: RADIUS: User-Name [1] 9 "username" > 000187: Feb 22 10:47:38: RADIUS: User-Password [2] 18 * > 000188: Feb 22 10:47:38: RADIUS(00000000): Sending a IPv4 Radius Packet > 000189: Feb 22 10:47:38: RADIUS(00000000): Started 5 sec timeout > 000190: Feb 22 10:47:39: RADIUS: Received from id 1645/8 10.15.0.51:1812, > Access-Reject, len 20 > 000191: Feb 22 10:47:39: > TTC-GREG2# RADIUS: authenticator FC F7 1D 2F 38 08 3A 52 - 80 4D 13 7C 9A > E9 C1 B7 > 000192: Feb 22 10:47:39: RADIUS: saved authorization data for user 8C41E4C > at 0 > 000193: Feb 22 10:47:39: AAA/MEMORY: free_user (0x8C41E4C) user='username' > ruser='NULL' port='' rem_addr='NULL' authen_type=ASCII service=LOGIN) > > > Server Info:FreeRadius server running on Ubuntu 18.04 LTS > > tcpdump: > tcpdump -i ens160 -vvv port 1812 > tcpdump: listening on ens160, link-type EN10MB (Ethernet), capture size > 262144 bytes > 10:52:36.760284 IP (tos 0x0, ttl 254, id 338, offset 0, flags [none], proto > UDP (17), length 87) > TTC-GREG.portageps.org.datametrics > ppsauth1.portageps.org.radius: > [udp > sum ok] RADIUS, length: 59 > Access-Request (1), id: 0x0a, Authenticator: > d77adf09bca33bbc3c9a22d8e057b5d0 > NAS-IP-Address Attribute (4), length: 6, Value: > TTC-GREG.portageps.org > 0x0000: c0a8 a02f > NAS-Port-Type Attribute (61), length: 6, Value: Async > 0x0000: 0000 0000 > User-Name Attribute (1), length: 9, Value: username > 0x0000: 6773 7475 6172 74 > User-Password Attribute (2), length: 18, Value: > 0x0000: 40ee d3ca 65d6 b7a6 48fe 9f81 3460 b73f > 10:52:37.761280 IP (tos 0x0, ttl 64, id 64656, offset 0, flags [none], > proto UDP (17), length 48) > ppsauth1.portageps.org.radius > TTC-GREG.portageps.org.datametrics: > [bad > udp cksum 0x6b47 -> 0xf8e3!] RADIUS, length: 20 > Access-Reject (3), id: 0x0a, Authenticator: > 096e874b36ae47c55b81fa012f1ff749 > > > Tail of Radius Log: > > tail -f radius.log > ri Feb 22 10:49:38 2019 : Auth: (77) Login incorrect (No Auth-Type found: > rejecting the user via Post-Auth-Type = Reject): [username/password] (from > client LabSwitch por > t 0) > Fri Feb 22 10:49:54 2019 : Auth: (78) Login incorrect (No Auth-Type found: > rejecting the user via Post-Auth-Type = Reject): [username/password] (from > client LabSw > itch port 0) > Fri Feb 22 10:50:02 2019 : Auth: (79) Login incorrect (No Auth-Type found: > rejecting the user via Post-Auth-Type = Reject): [username/password] (from > client LabSw > itch port 0) > Fri Feb 22 10:51:58 2019 : Auth: (80) Login incorrect (No Auth-Type found: > rejecting the user via Post-Auth-Type = Reject): [username/password] (from > client LabSw > itch port 0) > Fri Feb 22 10:52:36 2019 : Auth: (81) Login incorrect (No Auth-Type found: > rejecting the user via Post-Auth-Type = Reject): [username/password] (from > client LabSw > itch port 0) > > freeradius -X output: > eady to process requests > (0) Received Access-Request Id 11 from 192.168.160.47:1645 to > 10.15.0.51:1812 length 59 > (0) NAS-IP-Address = 192.168.160.47 > (0) NAS-Port-Type = Async > (0) User-Name = "username" > (0) User-Password = "password" > (0) # Executing section authorize from file > /etc/freeradius/3.0/sites-enabled/default > (0) authorize { > (0) policy filter_username { > (0) if (&User-Name) { > (0) if (&User-Name) -> TRUE > (0) if (&User-Name) { > (0) if (&User-Name =~ / /) { > (0) if (&User-Name =~ / /) -> FALSE > (0) if (&User-Name =~ /@[^@]*@/ ) { > (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE > (0) if (&User-Name =~ /\.\./ ) { > (0) if (&User-Name =~ /\.\./ ) -> FALSE > (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { > (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> > FALSE > (0) if (&User-Name =~ /\.$/) { > (0) if (&User-Name =~ /\.$/) -> FALSE > (0) if (&User-Name =~ /(a)\./) { > (0) if (&User-Name =~ /(a)\./) -> FALSE > (0) } # if (&User-Name) = notfound > (0) } # policy filter_username = notfound > (0) [preprocess] = ok > (0) [chap] = noop > (0) [mschap] = noop > (0) [digest] = noop > (0) suffix: Checking for suffix after "@" > (0) suffix: No '@' in User-Name = "username", looking up realm NULL > (0) suffix: No such realm "NULL" > (0) [suffix] = noop > (0) eap: No EAP-Message, not doing EAP > (0) [eap] = noop > (0) [files] = noop > (0) [expiration] = noop > (0) [logintime] = noop > (0) pap: WARNING: No "known good" password found for the user. Not setting > Auth-Type > (0) pap: WARNING: Authentication will fail unless a "known good" password > is available > (0) [pap] = noop > (0) } # authorize = ok > (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = > Reject > (0) Failed to authenticate the user > (0) Using Post-Auth-Type Reject > (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default > (0) Post-Auth-Type REJECT { > (0) attr_filter.access_reject: EXPAND %{User-Name} > (0) attr_filter.access_reject: --> username > (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 > (0) [attr_filter.access_reject] = updated > (0) [eap] = noop > (0) policy remove_reply_message_if_eap { > (0) if (&reply:EAP-Message && &reply:Reply-Message) { > (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE > (0) else { > (0) [noop] = noop > (0) } # else = noop > (0) } # policy remove_reply_message_if_eap = noop > (0) } # Post-Auth-Type REJECT = updated > (0) Login incorrect (No Auth-Type found: rejecting the user via > Post-Auth-Type = Reject): [username/password] (from client LabSwitch port > 0) > (0) Delaying response for 1.000000 seconds > Waking up in 0.3 seconds. > Waking up in 0.6 seconds. > (0) Sending delayed response > (0) Sent Access-Reject Id 11 from 10.15.0.51:1812 to 192.168.160.47:1645 > length 20 > Waking up in 3.9 seconds. > (0) Cleaning up request packet ID 11 with timestamp +5 > > > Any help would be appreciated. Again what I am trying to do, is log into > a cisco switch using my AD credentials. I have a freeradius server that is > linked to AD. The link to AD has been confirmed to work. > > Thank you. > > > ------------------------------ > > Message: 2 > Date: Fri, 22 Feb 2019 11:08:41 -0500 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Cisco IOS authentication to Freeradius that is linked to > AD > Message-ID: <CB17EFE7-91F3-4FEA-AE9F-C9B26475FD56(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On Feb 22, 2019, at 11:00 AM, Greg Stuart <gstuart(a)portageps.org> wrote: > > I am new to freeradius so please go easy on me :) Here is what I am > trying > > to do. I am trying to get my Cisco switches to authenticate a user with > > full permissions "lvl 15" by using freeradius that is linked to AD. > Using > > AD credentials > > > > Below are the configs: > > We don't need to see the switch config or debug output. The FreeRADIUS > debug log shows everything we need. > > > Server Info:FreeRadius server running on Ubuntu 18.04 LTS > > > > tcpdump: > ... > > Tail of Radius Log: > > We don't need those, either. > > You get a message when you join the list. That message tells you what > we *do* need, and what you *should not* post. Please read it. > > > freeradius -X output: > > eady to process requests > > (0) Received Access-Request Id 11 from 192.168.160.47:1645 to > > With lots of stuff deleted... > > > Any help would be appreciated. Again what I am trying to do, is log > into > > a cisco switch using my AD credentials. I have a freeradius server that > is > > linked to AD. The link to AD has been confirmed to work. > > What do you mean "linked to AD"? That the FreeRADIUS machine has joined > the AD domain? > > That's nice, but FreeRADIUS doesn't know that. There's no magic in the > server (or OS) saying "look users up in AD" > > The issuer here is that you haven't configured FreeRADIUS to do anything > with AD. i.e. it doesn't use LDAP or ntlm_auth to authenticate the users. > That's why it's rejecting the users. > > Please read my documentation on AD integration: > http://deployingradius.com/documents/configuration/active_directory.html > > If you look through the config files for "Active Directory", you will > see a number of comments with what to do, and what to configure. Those > should help, too. > > Alan DeKok. > > > > > ------------------------------ > > Message: 3 > Date: Fri, 22 Feb 2019 11:46:37 -0500 > From: Dave Macias <davama(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Mac-auth > Message-ID: > <CA+nFYV-cedRFGS-c5-CdVO93sWBEVdkb+7Ww5zvee= > LyfbWxfw(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > My 2 cents, > > your authorized_macs looks closer to a DB. > Thought of sql? Might be neater maybe > > First time i see mac-auth in this way. It is interesting. Though if not too > many clients a flat file should be ok. > If you want a custom reply msg you could do that in the default config. Or > if a log use the linelog module. > > Not sure if you authorized_macs file which you "suggest/think" is possible. > Maybe someone more experience could chime in. > Be patient > > Hope this helps > Dave > > On Fri, Feb 22, 2019 at 2:40 AM Dmitriy Andryashin < > safokoi.sikrone(a)gmail.com> wrote: > > > Help everyone! > > > > I'm working with Freeradius 3.0.15 > > And trying to implement authentification by MAC and NAS-Port and > > NAS-IP-Address and files module. > > > > The solution i found by now is to assign key variable in > > mods-available/files > > > > files authorized_macs { > > key = "%{Calling-Station-ID}-%{NAS-Port}-%{NAS-IP-Address}" > > usersfile = ${confdir}/authorized_macs > > } > > > > And in authorized_macs have string > > 00-24-54-05-8D-CB-5002-192.168.100.2 > > > > It works. > > > > Is there a neat way to do it? Check attributes separetelly. > > > > For example: > > authorized_macs contents: > > > > 00-24-54-05-8D-CB > > Cleartext-Password := 00-24-54-05-8D-CB > > NAS-Port == 5002 > > NAS-IP-Address = 192.168.100.2 > > Reply-Message = "Device with MAC Address %{Calling-Station-Id} > > authorized for network access" > > > > I appreciate any help) > > > > -- > > Best regards, Dmitri > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > ------------------------------ > > Message: 4 > Date: Fri, 22 Feb 2019 16:57:58 +0000 > From: <kai.zemke(a)hauni.com> > To: <freeradius-users(a)lists.freeradius.org> > Subject: Use expr for reply from sql database > Message-ID: <021f782c6aec40a8b5aa9a735ebe70ac(a)KNS102.HAUNI.KOERBER.DE> > Content-Type: text/plain; charset="us-ascii" > > Hi, > > I do have freeradius setup with a sql configuration. My mysql server is > running the scheme that is proposed on the freeradius wiki. > > So far everything is doing fine. Now I want to replay with an > Egress-VLANID. > > If I enter the value hexencoded everything works fine. > > But if I enter the value with the expr function the replied value is > always zero and I have the following entry in my radius.log > > sql: Error parsing value: Unknown or invalid value "%{expr: 0x31000000 + > 105}" for attribute Egress-VLANID) > > Do I have to mask certain characters in order to make this work? > > Example: > Egress-VLANID = `%{expr: 0x31000000 + 105}` > > Best regards > Kai > > > > ________________________________ > > Diese E-Mail kann vertrauliche Informationen enthalten. Das unerlaubte > Kopieren sowie die unbefugte Weitergabe dieser Informationen sind nicht > gestattet. Sollten Sie diese E-Mail irrt?mlich erhalten haben, informieren > Sie bitte den Absender und l?schen diese E-Mail. > This e-mail may contain confidential information, which should not be > copied or distributed without authorization. If you have received this > e-mail message by mistake, please inform the sender and delete it from your > system. > > > ------------------------------ > > Message: 5 > Date: Sat, 23 Feb 2019 01:08:45 +0800 > From: Dmitriy Andryashin <safokoi.sikrone(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Mac-auth > Message-ID: > < > CAAGcXdyZGzDMZh+fhurxxSp4YOsSTm7+fBdb7GRce+vDoj1-jg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Flat text file seems to be acceptable, it's a lightweight and can be used > without need of another packages, and also can be gererated by a script. > > Is there a way to check 3 attributes separately in files module, to make > file became readible? Or it can only make decisions on a single key > parameter? > > Thank you. > > On Sat, Feb 23, 2019 at 12:46 AM Dave Macias <davama(a)gmail.com> wrote: > > > My 2 cents, > > > > your authorized_macs looks closer to a DB. > > Thought of sql? Might be neater maybe > > > > First time i see mac-auth in this way. It is interesting. Though if not > too > > many clients a flat file should be ok. > > If you want a custom reply msg you could do that in the default config. > Or > > if a log use the linelog module. > > > > Not sure if you authorized_macs file which you "suggest/think" is > possible. > > Maybe someone more experience could chime in. > > Be patient > > > > Hope this helps > > Dave > > > > On Fri, Feb 22, 2019 at 2:40 AM Dmitriy Andryashin < > > safokoi.sikrone(a)gmail.com> wrote: > > > > > Help everyone! > > > > > > I'm working with Freeradius 3.0.15 > > > And trying to implement authentification by MAC and NAS-Port and > > > NAS-IP-Address and files module. > > > > > > The solution i found by now is to assign key variable in > > > mods-available/files > > > > > > files authorized_macs { > > > key = "%{Calling-Station-ID}-%{NAS-Port}-%{NAS-IP-Address}" > > > usersfile = ${confdir}/authorized_macs > > > } > > > > > > And in authorized_macs have string > > > 00-24-54-05-8D-CB-5002-192.168.100.2 > > > > > > It works. > > > > > > Is there a neat way to do it? Check attributes separetelly. > > > > > > For example: > > > authorized_macs contents: > > > > > > 00-24-54-05-8D-CB > > > Cleartext-Password := 00-24-54-05-8D-CB > > > NAS-Port == 5002 > > > NAS-IP-Address = 192.168.100.2 > > > Reply-Message = "Device with MAC Address %{Calling-Station-Id} > > > authorized for network access" > > > > > > I appreciate any help) > > > > > > -- > > > Best regards, Dmitri > > > - > > > List info/subscribe/unsubscribe? See > > > http://www.freeradius.org/list/users.html > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > -- > С уважением к Вам, Дмитрий. > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 166, Issue 48 > ************************************************* > -- *Greg Stuart* Infrastructure Operations Specialist Portage Public Schools P:269.323.5103

1 0

Cisco IOS authentication to Freeradius that is linked to AD
by Greg Stuart 22 Feb '19

22 Feb '19

Hello, I am new to freeradius so please go easy on me :) Here is what I am trying to do. I am trying to get my Cisco switches to authenticate a user with full permissions "lvl 15" by using freeradius that is linked to AD. Using AD credentials Below are the configs: Switch Config: aaa group server radius FreeRadius server name ppsauth1 ip radius source-interface GigabitEthernet1/0/50 ! ! ! radius-server attribute 6 mandatory ! radius server ppsauth1 address ipv4 10.15.0.51 auth-port 1812 acct-port 1813 key 7 15060E1F107B7977 ! Switch Debugs: test aaa group FreeRadius username password legacy Attempting authentication test to server-group FreeRadius using radius 000175: Feb 22 10:47:38: AAA: parse name=<no string> idb type=-1 tty=-1 000176: Feb 22 10:47:38: AAA/MEMORY: create_user (0x8C41E4C) user='username' ruser='NULL' ds0=0 port='' rem_addr='NULL' authen_type=ASCII servi) 000177: Feb 22 10:47:38: RADIUS: Pick NAS IP for u=0x8C41E4C tableid=0 cfg_addr=0.0.0.0 000178: Feb 22 10:47:38: RADIUS(00000000): Config NAS IPv6: :: 000179: Feb 22 10:4User authentication request was rejected by server. TTC-GREG2#7:38: RADIUS: ustruct sharecount=1 000180: Feb 22 10:47:38: Radius: radius_port_info() success=0 radius_nas_port=1 000181: Feb 22 10:47:38: RADIUS/ENCODE: Best Local IP-Address 192.168.160.47 for Radius-Server 10.15.0.51 000182: Feb 22 10:47:38: RADIUS(00000000): Send Access-Request to 10.15.0.51:1812 onvrf(0) id 1645/8, len 59 000183: Feb 22 10:47:38: RADIUS: authenticator 5F D8 9A 26 5E 67 09 AC - E8 D9 4F 9C F9 36 D5 24 000184: Feb 22 10:47:38: RADIUS: NAS-IP-Address [4] 6 192.168.160.47 TTC-GREG2# 000185: Feb 22 10:47:38: RADIUS: NAS-Port-Type [61] 6 Async [0] 000186: Feb 22 10:47:38: RADIUS: User-Name [1] 9 "username" 000187: Feb 22 10:47:38: RADIUS: User-Password [2] 18 * 000188: Feb 22 10:47:38: RADIUS(00000000): Sending a IPv4 Radius Packet 000189: Feb 22 10:47:38: RADIUS(00000000): Started 5 sec timeout 000190: Feb 22 10:47:39: RADIUS: Received from id 1645/8 10.15.0.51:1812, Access-Reject, len 20 000191: Feb 22 10:47:39: TTC-GREG2# RADIUS: authenticator FC F7 1D 2F 38 08 3A 52 - 80 4D 13 7C 9A E9 C1 B7 000192: Feb 22 10:47:39: RADIUS: saved authorization data for user 8C41E4C at 0 000193: Feb 22 10:47:39: AAA/MEMORY: free_user (0x8C41E4C) user='username' ruser='NULL' port='' rem_addr='NULL' authen_type=ASCII service=LOGIN) Server Info:FreeRadius server running on Ubuntu 18.04 LTS tcpdump: tcpdump -i ens160 -vvv port 1812 tcpdump: listening on ens160, link-type EN10MB (Ethernet), capture size 262144 bytes 10:52:36.760284 IP (tos 0x0, ttl 254, id 338, offset 0, flags [none], proto UDP (17), length 87) TTC-GREG.portageps.org.datametrics > ppsauth1.portageps.org.radius: [udp sum ok] RADIUS, length: 59 Access-Request (1), id: 0x0a, Authenticator: d77adf09bca33bbc3c9a22d8e057b5d0 NAS-IP-Address Attribute (4), length: 6, Value: TTC-GREG.portageps.org 0x0000: c0a8 a02f NAS-Port-Type Attribute (61), length: 6, Value: Async 0x0000: 0000 0000 User-Name Attribute (1), length: 9, Value: username 0x0000: 6773 7475 6172 74 User-Password Attribute (2), length: 18, Value: 0x0000: 40ee d3ca 65d6 b7a6 48fe 9f81 3460 b73f 10:52:37.761280 IP (tos 0x0, ttl 64, id 64656, offset 0, flags [none], proto UDP (17), length 48) ppsauth1.portageps.org.radius > TTC-GREG.portageps.org.datametrics: [bad udp cksum 0x6b47 -> 0xf8e3!] RADIUS, length: 20 Access-Reject (3), id: 0x0a, Authenticator: 096e874b36ae47c55b81fa012f1ff749 Tail of Radius Log: tail -f radius.log ri Feb 22 10:49:38 2019 : Auth: (77) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [username/password] (from client LabSwitch por t 0) Fri Feb 22 10:49:54 2019 : Auth: (78) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [username/password] (from client LabSw itch port 0) Fri Feb 22 10:50:02 2019 : Auth: (79) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [username/password] (from client LabSw itch port 0) Fri Feb 22 10:51:58 2019 : Auth: (80) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [username/password] (from client LabSw itch port 0) Fri Feb 22 10:52:36 2019 : Auth: (81) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [username/password] (from client LabSw itch port 0) freeradius -X output: eady to process requests (0) Received Access-Request Id 11 from 192.168.160.47:1645 to 10.15.0.51:1812 length 59 (0) NAS-IP-Address = 192.168.160.47 (0) NAS-Port-Type = Async (0) User-Name = "username" (0) User-Password = "password" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "username", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> username (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [username/password] (from client LabSwitch port 0) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 11 from 10.15.0.51:1812 to 192.168.160.47:1645 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 11 with timestamp +5 Any help would be appreciated. Again what I am trying to do, is log into a cisco switch using my AD credentials. I have a freeradius server that is linked to AD. The link to AD has been confirmed to work. Thank you.

2 1