February 2020 - Freeradius-Users - lists.freeradius.org

freeradius DNS issue
by Satish Patel 12 Feb '20

12 Feb '20

I have two DNS entry in /etc/resolve.conf and somehow today 10.10.0.10 DNS went down and result radius fail to authenticate clients, it was bizarre that 1 hour everything was down and as soon as 10.10.0.10 came back radius start working, I have check 10.10.0.11 is totally functional DNS but look like freeradius just doesn't like getting failover to second DNS, is there any timeout or better solution of this issue? # cat /etc/resolv.conf nameserver 10.10.0.10 nameserver 10.10.0.11

3 5

Need help with EAP-MSCHAPv2 config
by Yongqiang He 11 Feb '20

11 Feb '20

Hi, I am new to freeradius and hope someone here can help me with my setup. Thanks a lot! Here is what i got when running radiusd with -X option: (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "testing", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 2 length 66 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x065c081f075e1207 (8) eap: Finished EAP session with state 0x065c081f075e1207 (8) eap: Previous EAP request found for state 0x065c081f075e1207, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/default (8) eap_mschapv2: authenticate { (8) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (8) mschap: Creating challenge hash with username: testing (8) mschap: Client is using MS-CHAPv2 (8) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (8) mschap: ERROR: MS-CHAP2-Response is incorrect (8) eap_mschapv2: [mschap] = reject (8) eap_mschapv2: } # authenticate = reject (8) eap: Sending EAP Failure (code 4) ID 2 length 4 (8) eap: Freeing handler (8) [eap] = reject (8) } # authenticate = reject (8) Failed to authenticate the user If i run: radtest -t mschap ..., everything seems fine and it output 'Received Access-Accept'. I guess its because the radtest is running with mschap, and my client above is using mschapv2. I can't figure out what config i should do with mschapv2. The radius is running with mysql. user and password are insert to with sql: INSERT INTO `radcheck` VALUES (2,'testing','Cleartext-Password',':=','testuser_mypass'); Thanks a lot!

2 4

Freeradius External Script Auth.
by Vertigo Vertigo 07 Feb '20

07 Feb '20

Hi Freeradius people, I want to authorize users that connect to AP with my external script. Because I have multiple data source ( multiple Active Directory, another API etc.) and I want to make authorization by using these data sources as I want. That's why I'm using an external script to authorization. I updated /etc/raddb/sites-enabled/default's authorize section; authorize{ update { control: += `/usr/bin/myauthscript '%{User-Name}' '%{User-Password}' -c` reply: += `/usr/bin/myauthscript '%{User-Name}' '%{User-Password}' -v` } When I run "radtest" with PAP method, everything is OK, I have "User-Name" and "User-Password" attributes, I'm able to authorize users etc. However, when I make tests with an AP with 802.1x EAP method, , there is no cleartext password (User-Password) and I cannot make authorization. My question is how can I make authorization without "User-Password" attribute. As I said, I have cleartext passwords in my data sources, so I can hash them and compare with other hash that a client sent. How can I perform this operation with EAP, CHAP, MSCHAP etc. methods?

5 4

how to reject users which try to login w/o client certificates
by uj2.hahn＠posteo.de 07 Feb '20

07 Feb '20

Hi! Question: What is an easy way to reject users who are going to connect from a machine which does not have the appropriate client certificate? Note: I'm talking about special users only. Background: At school we have a bunch of electronic whiteboards with WLAN. All of them have the same username/passwd with client certs installed. Just to be on safe side I like to make sure that nobody else is abusing this username/passwd from another device. You never know.... Thanks a lot Uwe

2 1

Authorization Computers using MAC address
by James Ngo 07 Feb '20

07 Feb '20

Hello everyone, So I have already setup the Freeradius server, authenticate WIFI users using username and password. All working smoothly so far. Our office also have about 5 desktop computers, sharing the same EdgesSwitch How could I go about authorizing only our office computers using its MAC addresses? This is to prevent outside guests/visitors plug our LAN cables to their laptops I see in the "radcheck", there is "attribute" for user/password is "Cleartext-Password" when using username/password. Can I change this to something that accommodate MAC address? Or I have to come up with a complete new setup? Thank you very much for your helps Kind regards James

2 1

sphinx-build failures
by Aleksey Romanov 06 Feb '20

06 Feb '20

Hi, I am trying to build documentation from .rst files I tried both binary debian package and downloaded freeradius-server-3.0.20.tar.gz one from the website. 1. conf.py file was missing, I added an empty one 2. Then I will get warnings about non-existing entries and finally missing contents.rst ar@xdebian:~/radius-work/freeradius-server/doc$ make -f Makefile.sphinx html sphinx-build -b html -d _build/doctrees . _build/html Running Sphinx v1.8.4 making output directory... building [mo]: targets for 0 po files that are out of date building [html]: targets for 17 source files that are out of date updating environment: 17 added, 0 changed, 0 removed reading sources... [100%] vendor/cisco /home/ar/radius-work/freeradius-server/doc/developer/coding-methods.rst:35: WARNING: Unexpected indentation. /home/ar/radius-work/freeradius-server/doc/developer/coding-methods.rst:35: WARNING: Inline emphasis start-string without end-string. /home/ar/radius-work/freeradius-server/doc/developer/coding-methods.rst:36: WARNING: Block quote ends without a blank line; unexpected unindent. /home/ar/radius-work/freeradius-server/doc/developer/module_interface.rst:20: WARNING: Bullet list ends without a blank line; unexpected unindent. /home/ar/radius-work/freeradius-server/doc/developer/module_interface.rst:22: WARNING: Block quote ends without a blank line; unexpected unindent. /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'aaa' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'ldap_howto' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'load-balance' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'coding-methods' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'DIFFS' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'release-method' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'cisco' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'configurable_failover' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'processing_users_file' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'proxy' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'variables' /home/ar/radius-work/freeradius-server/doc/modules/ldap_howto.rst:977: WARNING: Literal block expected; none found. Sphinx error: master file /home/ar/radius-work/freeradius-server/doc/contents.rst not found make: *** [Makefile.sphinx:35: html] Error 2 Please, help Thanks, Aleksey

2 1

Help Upgrading from 3.0.19 to 3.0.20
by Aurélio de Souza Ribeiro Neto 05 Feb '20

05 Feb '20

Hello All, I'm trying to upgrade from 3.0.19 to 3.0.20 and I'm having this problem: Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql): Processing generate_sql_clients Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql): Reserved connection (0) Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql): Adding client 127.0.0.1 (Local Host) to global clients list Tue Feb 4 10:40:53 2020 : Debug: Adding client 127.0.0.1/32 (127.0.0.1) to prefix tree 32 Tue Feb 4 10:40:53 2020 : Error: Failed to add duplicate client Local Host Tue Feb 4 10:40:53 2020 : Warning: Failed to add client, possible duplicate? Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value Aborted (core dumped) Full log attached. In 3.0.19 I don't have this issue using the same settings and database. Any hint? Thanks

3 7

perl module variable scope question
by P. R.M. 05 Feb '20

05 Feb '20

I'm using the perl module to handle the backend logic between freeradius & a mysql database. * The first step in the authentication/authorization process is to have perl query the database for a given username. * Perl then queries the DB and returns the cleartext password if the username is found & is valid. * next, the cleartext password is handed off to the CHAP module for verification * afterwards, control goes back to the perl module (in post-auth section), when it runs another query in order to pull the reply attributes for the given user I'd like to avoid running the 2nd query in post-auth, and simply run a single query that returns all of the reply attributes if the username is valid. The problem is that the perl module has to exit its context & return control back to the CHAP module in order to verify the password. I don't want to prematurely set the reply attributes in the 'authorize' section if the user will subsequently be rejected due to a bad password. So, I need a way to save&pass the results of the initial query (w/ the attributes data) from the 'authorize' function to the 'post_auth' function. Global variables don't seem like they would be a good idea (not sure how this would work in terms of concurrency/thread safety). Any ideas on how to persist data from one perl module function call to the next? The only other option I considered was having the perl module do the CHAP/PAP authentication, but I would much rather leave this task to freeradius. Please help, thanks

2 1

LDAP group - samaccountname
by Olivier Mahieu 04 Feb '20

04 Feb '20

Hello, Using the LDAP module in post-auth section (PEAP-MSCHAPv2); the correct user group is not found for VLAN assignment. I think it has to do with the samaccountname. 5c5cAdministrator instead of Administrator. Where do I have to look? Thanks! Verzonden vanuit Mail<https://go.microsoft.com/fwlink/?LinkId=550986> voor Windows 10

2 3

OpenDirectory Authentication fails
by Carsten Kirschner 04 Feb '20

04 Feb '20

We have freeradius with the open directory plugin, which accesses a mac server to authenticate users. This works for most users, but we have a few users that experience errors what I cannot understand. In the inner tunnel the OpenDirectory plugin accesses the server and when it fails it logs a weird value for shortUserName (HWeissbrodt7.0.0A?؎???). For the users which can use the radius server username_string and shortUserName are the same. I traced the debug print to https://github.com/ether42/freeradius-ldap-kerberos/blob/master/radius/free… which suggests — for me — that it is a problem with the open directory communication, but I am neither sure nor can I see how the shortUserName can become that strange in the first place. I attached the radiusd -X output and the ldapsearch result. Snippet to highlight the error: (32) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) eap_mschapv2: authenticate { (32) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (32) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (32) mschap: No NT-Password configured. Trying OpenDirectory Authentication (32) mschap: OD username_string = HWeissbrodt, OD shortUserName=HWeissbrodt7.0.0A?؎??? (length = 23) (32) mschap: Stepbuf server challenge : ffffffa0ffffff80235f5efffffff8ffffff8728400551ffffffb60d62ffffff9570 (32) mschap: Stepbuf peer challenge : ffffff9cffffff95ffffff8d2c7e0effffffddffffffad7cffffffa8ffffffefffffffee4cffffff90ffffffe7ffffffca (32) mschap: Stepbuf p24 : 7656ffffffba1743125b11ffffffdb56ffffffd119ffffffa9ffffffa77fffffffbb5b3afffffffcffffffb6ffffffba216834 (32) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError (32) eap_mschapv2: [mschap] = reject Thanks Carsten Kirschner Full -XC output root@server radius # /usr/local/sbin/radiusd -XC FreeRADIUS Version 3.0.19 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/opendirectory including configuration file /usr/local/etc/raddb/mods-enabled/sql including configuration file /usr/local/etc/raddb/mods-config/sql/main/sqlite/queries.conf including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/debug including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = opendirectory radiusd: #### Instantiating modules #### modules { # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no use_open_directory = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_opendirectory # Loading module "opendirectory" from file /usr/local/etc/raddb/mods-enabled/opendirectory # Loaded module rlm_sql # Loading module "sql" from file /usr/local/etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_sqlite" server = "" port = 0 login = "" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } accounting-off { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-date('now')}, %{%{integer:Event-Timestamp}:-date('now')}, NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = %{%{integer:Event-Timestamp}:-date('now')}, acctinterval = 0, framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.intern.corussoft.de.private_key.pem" certificate_file = "/usr/local/etc/raddb/certs/server.intern.corussoft.de.725D267E5DA231F7A889EC58A4D28DE496E1DA15.cert.pem" ca_file = "/usr/local/etc/raddb/certs/server.intern.corussoft.de.725D267E5DA231F7A889EC58A4D28DE496E1DA15.chain.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql rlm_sql_sqlite: libsqlite version: 3.28.0 sqlite { filename = "/var/db/radius/freeradius.db" busy_timeout = 200 } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (0), 1 of 1 pending slots used rlm_sql_sqlite: Opening SQLite database "/var/db/radius/freeradius.db" rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Adding client 192.168.10.15 (Server) to global clients list rlm_sql (192.168.10.15): Client "Server" (sql) added rlm_sql (sql): Adding client 192.168.10.1 (Sophos Firewall) to global clients list rlm_sql (192.168.10.1): Client "Sophos Firewall" (sql) added rlm_sql (sql): Released connection (0) } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:336 } # server inner-tunnel radiusd: #### Skipping IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Configuration appears to be OK Failing connection attempt: (31) Received Access-Request Id 32 from 192.168.10.1:38494 to 192.168.10.15:1812 length 272 (31) User-Name = "HWeissbrodt" (31) NAS-Identifier = "Corussoft" (31) Called-Station-Id = "00-1A-8C-E1-C0-D9:Corussoft" (31) NAS-Port-Type = Wireless-802.11 (31) NAS-Port = 8 (31) Calling-Station-Id = "B0-CA-68-7B-D9-13" (31) Connect-Info = "CONNECT 54Mbps 802.11a" (31) Acct-Session-Id = "5DF89C40-0001C80F" (31) WLAN-Pairwise-Cipher = 1027076 (31) WLAN-Group-Cipher = 1027076 (31) WLAN-AKM-Suite = 1027073 (31) Framed-MTU = 1400 (31) EAP-Message = 0x026d003f15800000003517030300302cac76e0e9b0fccf66f8ebcbb026bcffc0682bca99f353e43849441c60ea8e4cf26a7cbdbf8b563b11a6fc359107ff71 (31) State = 0xf9a2b0edfccfa53d3b7e5de4bf637ef2 (31) Message-Authenticator = 0x6c653166aae32c928b1a52d3f0bdcb8a (31) Restoring &session-state (31) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (31) &session-state:TLS-Session-Version = "TLS 1.2" (31) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (31) authorize { (31) [preprocess] = ok (31) [chap] = noop (31) [mschap] = noop (31) [digest] = noop (31) suffix: Checking for suffix after "@" (31) suffix: No '@' in User-Name = "HWeissbrodt", looking up realm NULL (31) suffix: No such realm "NULL" (31) [suffix] = noop (31) eap: Peer sent EAP Response (code 2) ID 109 length 63 (31) eap: Continuing tunnel setup (31) [eap] = ok (31) } # authorize = ok (31) Found Auth-Type = eap (31) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (31) authenticate { (31) eap: Expiring EAP session with state 0xf9a2b0edfccfa53d (31) eap: Finished EAP session with state 0xf9a2b0edfccfa53d (31) eap: Previous EAP request found for state 0xf9a2b0edfccfa53d, released from the list (31) eap: Peer sent packet with method EAP TTLS (21) (31) eap: Calling submodule eap_ttls to process data (31) eap_ttls: Authenticate (31) eap_ttls: Continuing EAP-TLS (31) eap_ttls: Peer indicated complete TLS record size will be 53 bytes (31) eap_ttls: Got complete TLS record (53 bytes) (31) eap_ttls: [eaptls verify] = length included (31) eap_ttls: [eaptls process] = ok (31) eap_ttls: Session established. Proceeding to decode tunneled attributes (31) eap_ttls: Got tunneled request (31) eap_ttls: EAP-Message = 0x020000100148576569737362726f6474 (31) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (31) eap_ttls: Got tunneled identity of HWeissbrodt (31) eap_ttls: Setting default EAP type for tunneled EAP session (31) eap_ttls: Sending tunneled request (31) Virtual server inner-tunnel received request (31) EAP-Message = 0x020000100148576569737362726f6474 (31) FreeRADIUS-Proxied-To = 127.0.0.1 (31) User-Name = "HWeissbrodt" (31) WARNING: Outer and inner identities are the same. User privacy is compromised. (31) server inner-tunnel { (31) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (31) authorize { (31) policy filter_username { (31) if (&User-Name) { (31) if (&User-Name) -> TRUE (31) if (&User-Name) { (31) if (&User-Name =~ / /) { (31) if (&User-Name =~ / /) -> FALSE (31) if (&User-Name =~ /@[^@]*@/ ) { (31) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (31) if (&User-Name =~ /\.\./ ) { (31) if (&User-Name =~ /\.\./ ) -> FALSE (31) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (31) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (31) if (&User-Name =~ /\.$/) { (31) if (&User-Name =~ /\.$/) -> FALSE (31) if (&User-Name =~ /(a)\./) { (31) if (&User-Name =~ /(a)\./) -> FALSE (31) } # if (&User-Name) = notfound (31) } # policy filter_username = notfound (31) [chap] = noop (31) [mschap] = noop (31) suffix: Checking for suffix after "@" (31) suffix: No '@' in User-Name = "HWeissbrodt", looking up realm NULL (31) suffix: No such realm "NULL" (31) [suffix] = noop (31) update control { (31) &Proxy-To-Realm := LOCAL (31) } # update control = noop (31) eap: Peer sent EAP Response (code 2) ID 0 length 16 (31) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (31) [eap] = ok (31) } # authorize = ok (31) Found Auth-Type = eap (31) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (31) authenticate { (31) eap: Peer sent packet with method EAP Identity (1) (31) eap: Calling submodule eap_mschapv2 to process data (31) eap_mschapv2: Issuing Challenge (31) eap: Sending EAP Request (code 1) ID 1 length 43 (31) eap: EAP session adding &reply:State = 0xe56f92e7e56e8870 (31) [eap] = handled (31) } # authenticate = handled (31) } # server inner-tunnel (31) Virtual server sending reply (31) EAP-Message = 0x0101002b1a0101002610a080235f5ef88728400551b60d629570667265657261646975732d332e302e3139 (31) Message-Authenticator = 0x00000000000000000000000000000000 (31) State = 0xe56f92e7e56e8870040d68add7a0fd37 (31) eap_ttls: Got tunneled Access-Challenge (31) eap: Sending EAP Request (code 1) ID 110 length 91 (31) eap: EAP session adding &reply:State = 0xf9a2b0edffcca53d (31) [eap] = handled (31) } # authenticate = handled (31) Using Post-Auth-Type Challenge (31) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (31) Challenge { ... } # empty sub-section is ignored (31) session-state: Saving cached attributes (31) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (31) TLS-Session-Version = "TLS 1.2" (31) Sent Access-Challenge Id 32 from 192.168.10.15:1812 to 192.168.10.1:38494 length 0 (31) EAP-Message = 0x016e005b158000000051170303004cd2bcac73d14014ac7c20d51e15566d472b0e676b016dc74c0088b5214755fe92916624e6b4427a51f3cf26720f247206252750d4d66ddfaa75953755c3864faf073be832c45cc1a2d67d14fe (31) Message-Authenticator = 0x00000000000000000000000000000000 (31) State = 0xf9a2b0edffcca53d3b7e5de4bf637ef2 (31) Finished request Waking up in 4.8 seconds. (32) Received Access-Request Id 33 from 192.168.10.1:38494 to 192.168.10.15:1812 length 328 (32) User-Name = "HWeissbrodt" (32) NAS-Identifier = "Corussoft" (32) Called-Station-Id = "00-1A-8C-E1-C0-D9:Corussoft" (32) NAS-Port-Type = Wireless-802.11 (32) NAS-Port = 8 (32) Calling-Station-Id = "B0-CA-68-7B-D9-13" (32) Connect-Info = "CONNECT 54Mbps 802.11a" (32) Acct-Session-Id = "5DF89C40-0001C80F" (32) WLAN-Pairwise-Cipher = 1027076 (32) WLAN-Group-Cipher = 1027076 (32) WLAN-AKM-Suite = 1027073 (32) Framed-MTU = 1400 (32) EAP-Message = 0x026e007715800000006d17030300682cac76e0e9b0fcd00aaac7e6a46cd6ac3d3d0ba98ead722f9a387082bb1c83bd9d07535f284a6c410d18ba24342f4c0e114952ba6f3621e39b1ca0de37a0441d887181629d1b02baaf96958e2b06aca8b9e0cbb2b4276cbaabf7059014ee3a33679b7c535d56d9ff (32) State = 0xf9a2b0edffcca53d3b7e5de4bf637ef2 (32) Message-Authenticator = 0x8f766a6554c23d52ff028b06394a64ff (32) Restoring &session-state (32) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (32) &session-state:TLS-Session-Version = "TLS 1.2" (32) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (32) authorize { (32) [preprocess] = ok (32) [chap] = noop (32) [mschap] = noop (32) [digest] = noop (32) suffix: Checking for suffix after "@" (32) suffix: No '@' in User-Name = "HWeissbrodt", looking up realm NULL (32) suffix: No such realm "NULL" (32) [suffix] = noop (32) eap: Peer sent EAP Response (code 2) ID 110 length 119 (32) eap: Continuing tunnel setup (32) [eap] = ok (32) } # authorize = ok (32) Found Auth-Type = eap (32) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (32) authenticate { (32) eap: Expiring EAP session with state 0xe56f92e7e56e8870 (32) eap: Finished EAP session with state 0xf9a2b0edffcca53d (32) eap: Previous EAP request found for state 0xf9a2b0edffcca53d, released from the list (32) eap: Peer sent packet with method EAP TTLS (21) (32) eap: Calling submodule eap_ttls to process data (32) eap_ttls: Authenticate (32) eap_ttls: Continuing EAP-TLS (32) eap_ttls: Peer indicated complete TLS record size will be 109 bytes (32) eap_ttls: Got complete TLS record (109 bytes) (32) eap_ttls: [eaptls verify] = length included (32) eap_ttls: [eaptls process] = ok (32) eap_ttls: Session established. Proceeding to decode tunneled attributes (32) eap_ttls: Got tunneled request (32) eap_ttls: EAP-Message = 0x020100461a02010041319c958d2c7e0eddad7ca8efee4c90e7ca00000000000000007656ba1743125b11db56d119a9a77fbb5b3afcb6ba2168340048576569737362726f6474 (32) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (32) eap_ttls: Sending tunneled request (32) Virtual server inner-tunnel received request (32) EAP-Message = 0x020100461a02010041319c958d2c7e0eddad7ca8efee4c90e7ca00000000000000007656ba1743125b11db56d119a9a77fbb5b3afcb6ba2168340048576569737362726f6474 (32) FreeRADIUS-Proxied-To = 127.0.0.1 (32) User-Name = "HWeissbrodt" (32) State = 0xe56f92e7e56e8870040d68add7a0fd37 (32) WARNING: Outer and inner identities are the same. User privacy is compromised. (32) server inner-tunnel { (32) session-state: No cached attributes (32) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) authorize { (32) policy filter_username { (32) if (&User-Name) { (32) if (&User-Name) -> TRUE (32) if (&User-Name) { (32) if (&User-Name =~ / /) { (32) if (&User-Name =~ / /) -> FALSE (32) if (&User-Name =~ /@[^@]*@/ ) { (32) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (32) if (&User-Name =~ /\.\./ ) { (32) if (&User-Name =~ /\.\./ ) -> FALSE (32) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (32) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (32) if (&User-Name =~ /\.$/) { (32) if (&User-Name =~ /\.$/) -> FALSE (32) if (&User-Name =~ /(a)\./) { (32) if (&User-Name =~ /(a)\./) -> FALSE (32) } # if (&User-Name) = notfound (32) } # policy filter_username = notfound (32) [chap] = noop (32) [mschap] = noop (32) suffix: Checking for suffix after "@" (32) suffix: No '@' in User-Name = "HWeissbrodt", looking up realm NULL (32) suffix: No such realm "NULL" (32) [suffix] = noop (32) update control { (32) &Proxy-To-Realm := LOCAL (32) } # update control = noop (32) eap: Peer sent EAP Response (code 2) ID 1 length 70 (32) eap: No EAP Start, assuming it's an on-going EAP conversation (32) [eap] = updated (32) [files] = noop (32) sql: EXPAND %{User-Name} (32) sql: --> HWeissbrodt (32) sql: SQL-User-Name set to 'HWeissbrodt' rlm_sql (sql): Reserved connection (8) (32) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (32) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'HWeissbrodt' ORDER BY id (32) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'HWeissbrodt' ORDER BY id rlm_sql (sql): Reserved connection (9) rlm_sql (sql): Released connection (9) Need 7 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (11), 1 of 28 pending slots used rlm_sql_sqlite: Opening SQLite database "/var/db/radius/freeradius.db" (32) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (32) sql: --> SELECT groupname FROM radusergroup WHERE username = 'HWeissbrodt' ORDER BY priority (32) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'HWeissbrodt' ORDER BY priority (32) sql: User not found in any groups rlm_sql (sql): Released connection (8) (32) [sql] = notfound (32) [expiration] = noop (32) [logintime] = noop (32) [pap] = noop (32) } # authorize = updated (32) Found Auth-Type = eap (32) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) authenticate { (32) eap: Expiring EAP session with state 0xe56f92e7e56e8870 (32) eap: Finished EAP session with state 0xe56f92e7e56e8870 (32) eap: Previous EAP request found for state 0xe56f92e7e56e8870, released from the list (32) eap: Peer sent packet with method EAP MSCHAPv2 (26) (32) eap: Calling submodule eap_mschapv2 to process data (32) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) eap_mschapv2: authenticate { (32) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (32) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (32) mschap: No NT-Password configured. Trying OpenDirectory Authentication (32) mschap: OD username_string = HWeissbrodt, OD shortUserName=HWeissbrodt7.0.0A?؎??? (length = 23) (32) mschap: Stepbuf server challenge : ffffffa0ffffff80235f5efffffff8ffffff8728400551ffffffb60d62ffffff9570 (32) mschap: Stepbuf peer challenge : ffffff9cffffff95ffffff8d2c7e0effffffddffffffad7cffffffa8ffffffefffffffee4cffffff90ffffffe7ffffffca (32) mschap: Stepbuf p24 : 7656ffffffba1743125b11ffffffdb56ffffffd119ffffffa9ffffffa77fffffffbb5b3afffffffcffffffb6ffffffba216834 (32) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError (32) eap_mschapv2: [mschap] = reject (32) eap_mschapv2: } # authenticate = reject (32) eap: Sending EAP Failure (code 4) ID 1 length 4 (32) eap: Freeing handler (32) [eap] = reject (32) } # authenticate = reject (32) Failed to authenticate the user (32) Using Post-Auth-Type Reject (32) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) Post-Auth-Type REJECT { (32) sql: EXPAND .query (32) sql: --> .query (32) sql: Using query template 'query' rlm_sql (sql): Reserved connection (10) (32) sql: EXPAND %{User-Name} (32) sql: --> HWeissbrodt (32) sql: SQL-User-Name set to 'HWeissbrodt' (32) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (32) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'HWeissbrodt', '', 'Access-Reject', '2020-01-15 14:42:19') (32) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'HWeissbrodt', '', 'Access-Reject', '2020-01-15 14:42:19') (32) sql: SQL query returned: success (32) sql: 1 record(s) updated rlm_sql (sql): Released connection (10) (32) [sql] = ok (32) attr_filter.access_reject: EXPAND %{User-Name} (32) attr_filter.access_reject: --> HWeissbrodt (32) attr_filter.access_reject: Matched entry DEFAULT at line 11 (32) [attr_filter.access_reject] = updated (32) update outer.session-state { (32) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: rlm_mschap: authentication failed - status = eUndefinedError' (32) } # update outer.session-state = noop (32) } # Post-Auth-Type REJECT = updated (32) } # server inner-tunnel (32) Virtual server sending reply (32) EAP-Message = 0x04010004 (32) Message-Authenticator = 0x00000000000000000000000000000000 (32) eap_ttls: Got tunneled Access-Reject (32) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (32) eap: Sending EAP Failure (code 4) ID 110 length 4 (32) eap: Failed in EAP select (32) [eap] = invalid (32) } # authenticate = invalid (32) Failed to authenticate the user (32) Using Post-Auth-Type Reject (32) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (32) Post-Auth-Type REJECT { (32) attr_filter.access_reject: EXPAND %{User-Name} (32) attr_filter.access_reject: --> HWeissbrodt (32) attr_filter.access_reject: Matched entry DEFAULT at line 11 (32) [attr_filter.access_reject] = updated (32) [eap] = noop (32) policy remove_reply_message_if_eap { (32) if (&reply:EAP-Message && &reply:Reply-Message) { (32) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (32) else { (32) [noop] = noop (32) } # else = noop (32) } # policy remove_reply_message_if_eap = noop (32) } # Post-Auth-Type REJECT = updated (32) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (32) Sending delayed response (32) Sent Access-Reject Id 33 from 192.168.10.15:1812 to 192.168.10.1:38494 length 44 (32) EAP-Message = 0x046e0004 (32) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. (25) Cleaning up request packet ID 26 with timestamp +201 (26) Cleaning up request packet ID 27 with timestamp +201 (27) Cleaning up request packet ID 28 with timestamp +201 (28) Cleaning up request packet ID 29 with timestamp +201 (29) Cleaning up request packet ID 30 with timestamp +201 (30) Cleaning up request packet ID 31 with timestamp +201 (31) Cleaning up request packet ID 32 with timestamp +201 (32) Cleaning up request packet ID 33 with timestamp +201 Ldap Search output: administrator@server raddb % ldapsearch -h 127.0.0.1 -vvv -b "uid=hweissbrodt,cn=users,dc=server,dc=intern,dc=corussoft,dc=de" -x -s sub "(objectclass=*)" ldap_initialize( ldap://127.0.0.1 ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <uid=hweissbrodt,cn=users,dc=server,dc=intern,dc=corussoft,dc=de> with scope subtree # filter: (objectclass=*) # requesting: ALL # # HWeissbrodt, users, server.intern.corussoft.de dn: uid=HWeissbrodt,cn=users,dc=server,dc=intern,dc=corussoft,dc=de apple-keyword: CS apple-keyword: Entwickler cn: Hendrik Weissbrodt uid: HWeissbrodt mail: hendrik.weissbrodt(a)corussoft.de givenName: Hendrik uidNumber: 1037 gidNumber: 20 objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top objectClass: extensibleObject objectClass: apple-user apple-generateduid: AF5EBB25-A592-419A-AAE4-32B8D232230C loginShell: /bin/bash sn: Weissbrodt apple-user-homequota: 20000000000 authAuthority: ;ApplePasswordServer;<long hex stuff redacted> root@server.intern.corussoft.de:192.168.10.15 authAuthority: ;Kerberosv5;;HWeissbrodt(a)SERVER.INTERN.CORUSSOFT.DE;SERVER.INTE RN.CORUSSOFT.DE; altSecurityIdentities: Kerberos:HWeissbrodt@SERVER.INTERN.CORUSSOFT.DE apple-user-homeurl:: PGhvbWVfZGlyPjx1cmw+c21iOi8vc2VydmVyLmludGVybi5jb3J1c3NvZ nQuZGUvVXNlcnM8L3VybD48cGF0aD5IV2Vpc3Nicm9kdDwvcGF0aD48L2hvbWVfZGlyPg== homeDirectory: /Network/Servers/server.intern.corussoft.de/Volumes/Macintosh H D/Users/HWeissbrodt # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

2 1