March 2020 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Memory leak in FR 3.0.19 ?
by Arnaud LAURIOU 30 Jun '20

30 Jun '20

Hi, We are suspecting memory leak in FR 3.0.19 : process memory status show VmData always keep increasing leading to VmSwap use after a few days which also keep increasing. I have 2 questions : - What are the compile options to use valgrind ? only flag --enable-developper ?|| - In the changelog for version 3.0.20 : some memories problems seems to be solved, do you know when this version will be released ? (if the release date is close, we can wait to test this release rather than 3.0.19) Regards, Arnaud Lauriou

3 5

Vulnerability in FreeRADIUS
by HANCHATE Ravikiran (u5574292) 04 May '20

04 May '20

Dears, we received Vulnerability in FreeRADIUS , Can you please assist here, 1/ How this will impact on our radius infra ? 2/ what steps need to be taken to Apply the Linux Fedora patches regarding the FreeRADIUS vulnerability ? Please provide step by step guides or implement instructions to Apply the Linux Fedora patches ? Please let me know if you need any information on this ? Regards, Ravi *********DISCLAIMER********* This electronic transmission (and any attached document) is intended exclusively for the person or entity to whom it is addressed and may contain confidential and/or privileged material. Any disclosure, copying, distribution or other action based upon the information by persons or entities other than the intended recipient is prohibited. If you receive this message in error, please contact the sender and delete the material from any and all computers. Orange Belgium does not warrant a proper and complete transmission of this information, nor does it accept liability for any delays. Unless clearly and unambiguously stated otherwise, the content of this e-mail and its attachment is provided to you for information purposes only, and nothing herein shall be binding upon, or shall constitute or be construed as a binding offer of Orange Belgium. *****END OF DISCLAIMER*****

4 5

How to integrate Freeradius with Oracle Database XE(18c)?
by Sajib Nandi 03 Apr '20

03 Apr '20

I have installed Freeradius and Oracle Database 18c XE. FreeRADIUS Version 3.0.20 -- it's working fine locally Oracle Database XE working fine. But I can not integrate Freeradius with Oracle Database. I need help regarding this How can I integrate Freeradius with oracle database. anyone can help? Thanks Nandi

5 9

openldap-ltb conflicts with package symas-openldap-servers
by Dave Macias 02 Apr '20

02 Apr '20

Hello, Saw the new 3.0.21 release email and wanted to try instead of the centos pkgs. Used this wiki https://networkradius.com/freeradius-packages/ but get a conflict: $ yum install freeradius Updating: ... ... ... Install ( 3 Dependent packages) Upgrade 1 Package (+2 Dependent packages) Total size: 11 M Is this ok [y/d/N]: y Downloading packages: warning: /var/cache/yum/x86_64/7/networkradius/packages/freeradius-config-3.0.21-1.x86_64.rpm: Header V4 RSA/SHA256 Signature, key ID 41382202: NOKEY Retrieving key from file:///etc/pki/rpm-gpg/packages.networkradius.com.gpg Importing GPG key 0x41382202: Userid : "Network RADIUS Support (package signing) < packages(a)networkradius.com>" Fingerprint: 86e3 c308 3f30 8400 a898 5d2a be18 fc5a 4138 2202 From : /etc/pki/rpm-gpg/packages.networkradius.com.gpg Is this ok [y/N]: y Running transaction check Running transaction test Transaction check error: * file /usr/lib/systemd/system/slapd.service from install of openldap-ltb-2.4.49-1.el7.x86_64 conflicts with file from package symas-openldap-servers-2.4.49-1.el7.x86_64* Error Summary ------------- My current environment: 3.10.0-1062.18.1.el7.x86_64 CentOS Linux release 7.7.1908 (Core) Using centos repo pkg freeradius 3.0.13 How can i resolve? Please let me know if you need more information from me. Any input is much appreciated! Thank you, Dave

3 4

ipv6 address in users file
by Marcin Romanowski 30 Mar '20

30 Mar '20

Hello, I have problem with provide IPv6 from users file. I use files as redundant when sql will broke. in file: 2001:db8:2:8000:: Cleartext-Password := 'cisco' Cisco-Service-info = 'QU;1433600000;D;1433600000', Cisco-Avpair += 'subscriber:accounting-list=FRAD_BRAS_ISG_ACCT', Framed-IPv6-Prefix = '2001:db8:2:8000::/56', Idle-Timeout = 10800, Cisco-Avpair += 'subscriber:idle-timeout-direction=inbound' for ipv4 I have 192.168.1.12 Cleartext-Password := 'cisco' Cisco-Service-info = 'QU;1433600000;D;1433600000', Cisco-Avpair += 'subscriber:accounting-list=FRAD_BRAS_ISG_ACCT', Cisco-Avpair += 'subscriber:keepalive=interval 10', Cisco-Avpair += 'subscriber:idle-timeout-direction=inbound' and it works, but for ipv6 doesn't Debug says that radius can't find user :/ (0) Received Access-Request Id 94 from 10.249.1.202:1645 to 10.249.1.203:1912 length 152 (0) User-Name = "2001:DB8:2:8000::" (0) User-Password = "cisco" (0) Framed-IPv6-Prefix = 2001:db8:2:8000::/56 (0) Calling-Station-Id = "00:00:00:00:00:00" (0) NAS-Port-Type = PPPoEoE (0) NAS-Port = 0 (0) NAS-Port-Id = "0/0/0/0" (0) Service-Type = Outbound-User (0) NAS-IP-Address = 10.249.1.202 (0) Acct-Session-Id = "00001200" (0) NAS-Identifier = "ASR_1" (0) Event-Timestamp = "Mar 30 2020 09:39:28 CEST" (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/ikam-isg.server (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "2001:DB8:2:8000::", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) redundant { (0) ikam-isg: EXPAND %{User-Name} (0) ikam-isg: --> 2001:DB8:2:8000:: (0) ikam-isg: SQL-User-Name set to '2001:DB8:2:8000::' rlm_sql (ikam-isg): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (ikam-isg): Opening additional connection (0), 1 of 64 pending slots used rlm_sql_postgresql: Connecting using parameters: dbname=bcman host=localhost user=bcman password=bcman rlm_sql_postgresql: Connection failed: could not connect to server: Connection refused Is the server running on host "localhost" (127.0.0.1) and accepting TCP/IP connections on port 5432? rlm_sql_postgresql: Socket destructor called, closing socket rlm_sql (ikam-isg): Opening connection failed (0) *(0) [ikam-isg] = fail(0) [files] = noop* (0) } # redundant = noop (0) [expiration] = noop (0) [logintime] = noop *(0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type(0) pap: WARNING: Authentication will fail unless a "known good" password is available* (0) [pap] = noop (0) } # authorize = ok *(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject(0) Failed to authenticate the user* (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/ikam-isg.server (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> 2001:DB8:2:8000:: (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.6 seconds. Waking up in 0.3 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 94 from 10.249.1.203:1912 to 10.249.1.202:1645 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 94 with timestamp +6 FreeRADIUS Version 3.0.16 Where I'm doing mistake? Best regards Marcin

3 4

Logs ip
by Клеусов Владимир Сергеевич 27 Mar '20

27 Mar '20

Hi I have two servers. One of the logs shows the ip address, but the other does not. How to set up logs in the form Auth: (140) Login OK: [ip_10.65.150.1/j0cgtr19MCVH] ?

3 3

Version 3.0.21 has been released
by Matthew Newton 24 Mar '20

24 Mar '20

As promised a couple of weeks or so ago, version 3.0.21 has now been released. Full release notes are available on the web site: https://freeradius.org/release_notes/?br=3.0.x&re=3.0.21 This is mainly a bugfix release, however there have been some new features. Specifically this release has quite a number of database related improvements, with thanks to Terry Burton. Apart from that most other updates were bug fixes, build improvements or dictionaries. Download from the usual places: https://freeradius.org/releases/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_21 Packages are building and will be available on the Network RADIUS web site shortly: https://packages.networkradius.com/ Docker images will also be available on Dockerhub soon: https://hub.docker.com/u/freeradius -- Matthew

1 0

pam_radius_auth with Framed-IP-Address
by António Silva 24 Mar '20

24 Mar '20

Hi, How to get the "Framed-IP-Address" attribute from the Access-Accept replay from the radius server? Is it possible? Thanks. note: not sure if this is the right mailing to ask this question, sorry if is not.. -- Saludos / Regards / Cumprimentos António Silva

2 6

Special character not showing in RADPOSTAUTH
by JAHANZAIB SYED 24 Mar '20

24 Mar '20

WE have enable radpostauth to record unsuccessful dialing attempt. Passwords with special characters are not showing properly in radpostauth table. Example username: zaib password: myp@$$^&*w0rd In radpostauth I see this zaib myp@=3D24=3D24=3D5E=3D26=3D2Aw0rd Access-Reject RADPOSTAUTH config is below: query = "\ INSERT INTO ${..postauth_table} \ (username, pass, reply, reply_msg, authdate, nasipaddress, mac) \ VALUES ( \ '%{SQL-User-Name}', \ '%{%{User-Password}:-%{Chap-Password}}', \ '%{reply:Packet-Type}', \ '%{reply:Reply-Message}', \ '%S', \ '%{NAS-IP-Address}', \ '%{Calling-Station-Id}')" } Regards, J. <http:///>

2 1

Freeradius 3 - Multiple sub-domains - NTLM/SAMBA
by Gregorio Luján Carboneras 23 Mar '20

23 Mar '20

Hello. Could you please give me any advice regarding how to configure freeradius 3 (PEAP-MSCHAP2), to works with multiple sub-domains via NTLM/SAMBA? I need to authenticate users from multiple sub-domains in “User Principal Name (UPN)” format: -Example: user1(a)domain.com<mailto:user1@domain.com> user2(a)it.domain.com<mailto:user2@it.domain.com> user3(a)sales.domain.com<mailto:user3@sales.domain.com> I have joined the freeradius to the active directory. When I request the users informatation via “wbinfo” command, I don´t obtain the domain information (only usernames). And only appears users from the principal domain (domain.com) -Example: Freeradius# wbinfo –u | grep user user1 Actually I don't really understand how the authentication between the freeradius and the AD is performed (via NTLM, SAMBA, Kerberos ... ???) Could someone please provide me with a link to documentation so I can understand it? Thank you very much De manera general, “ANADAT TECHNOLOGY, S. L.” garantiza la adopción de las medidas necesarias para asegurar el tratamiento confidencial de los datos de carácter personal, y le ofrece la posibilidad de ejercer su derecho de acceso, rectificación, supresión, oposición, portabilidad, limitación y decisiones individualizadas al tratamiento de sus datos personales, en los términos y condiciones previstos en el Reglamento General de Protección de Datos (RGPD), a través del correo electrónico info(a)anadat.es<mailto:info@anadat.es> . La información confidencial que pudiera contener este mensaje está destinada para ser leída únicamente por el destinatario. Nadie excepto él podrá leer, usar, publicar o reproducir el contenido parcial o total de este mensaje. En caso de recibir un mensaje por error, por favor notifíquelo al remitente lo antes posible.

3 4

EAP TLS Server certificate error
by Thomas Manninger 23 Mar '20

23 Mar '20

Hi Mailing list, i installed freeradius on debian 9 for X802.1 authentication, which should replace an old freeradius server. For the new radius server, i generated a new CA for the client certificates and deployed the certificate on some clients. I also generated a certificate for the freeradius server (with the same CA): mods-enabled/eap: tls-config tls-common { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.crt dh_file = ${certdir}/dh ca_path = ${cadir} check_cert_cn = %{User-Name} cipher_list = "DEFAULT" .. } When a client tries to authenticate, i get the following radius output: (7) auth_log: --> Mon Mar 23 15:42:14 2020 (7) [auth_log] = ok (7) if (!EAP-Message) { (7) if (!EAP-Message) -> FALSE (7) else { (7) eap: Peer sent EAP Response (code 2) ID 15 length 17 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) files_x802_1_cert_auth: users: Matched entry XXXXXX at line 163 (7) [files_x802_1_cert_auth] = ok (7) } # else = updated (7) } # authorize = updated (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/outer-tunnel (7) authenticate { (7) eap: Expiring EAP session with state 0x5b409518594a9812 (7) eap: Finished EAP session with state 0xfcae8891ffa18542 (7) eap: Previous EAP request found for state 0xfcae8891ffa18542, released from the list (7) eap: Peer sent packet with method EAP TLS (13) (7) eap: Calling submodule eap_tls to process data (7) eap_tls: Continuing EAP-TLS (7) eap_tls: Peer indicated complete TLS record size will be 7 bytes (7) eap_tls: Got complete TLS record (7 bytes) (7) eap_tls: [eaptls verify] = length included (7) eap_tls: <<< recv TLS 1.2 [length 0002] (7) eap_tls: TLS_accept: Need to read more data: SSLv3/TLS write server done (7) eap_tls: ERROR: System call (I/O) error (-1) (7) eap_tls: ERROR: TLS receive handshake failed during operation (7) eap_tls: ERROR: [eaptls process] = fail (7) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed But, when i replace the ${certdir}/server.key and ${certdir}/server.crt with the server certificate from the old server, x802.1 authentication works (why??) Can someone help me? Thanks!

2 1

Auth: Login incorrect: [maxx09/<no User-Password attribute>]
by Sam T 23 Mar '20

23 Mar '20

Hi freeradius community I have been working hard at making our already wonderful freeradius implementation also work with some VPN radius functions. A lot of this is a bit over my head, but i am grasping it as i go. So far, this server config works great for user/pass on PPTP, L2TP, OpenVPN, Soft-ether AAA but I am getting stuck with IKEv2. Ideally we can get ikev2 working on all devices, but it does require a lot of certificate work. I have been able to deal with the cert stuff from client, to router, and get the router to send the radius request, it comes back timeout. I tried it with also loading the cert chain in eap.conf but it didnt make a difference. i saw the <no User-Password attribute> in the radius.log either way. I think the issue is with something with the password being sent from the router, maybe it is hashed, maybe it is not sent, but this is what i see in the radius.log: Sun Mar 22 00:10:28 2020 : Auth: Login incorrect: [user123/<no User-Password attribute>] (from client wificpa port 0 cli 444.555.666.777) Any idea where i should dig, or what i should do to see why we see user123/<no User-Password attribute>? Is this the app not sending it, the router not sending it, or it arriving in some other attribute that radius is not listening for? (hashed, something specific for EAP?) I found that specifying the cert chain didnt make a difference when adding them in eap.conf, but here are some of those configs, and I will also include a -X: THANK YOU! Sam ############################################################################################################################################## I tried to trim this down some for readability and privacy... (in my edits, i changed all 'wificpa' to 'complexcode' knowing that wificpa is also use in other areas, not as a secret. please forgive me for that.) root@cp2dev:~# freeradius -X FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Jul 26 2017 at 15:30:42 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sqlcounter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/custom.rad main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { require_message_authenticator = no secret = "complexcode" shortname = "complexcode" } client 0.0.0.0/0 { require_message_authenticator = no secret = "complexcode" shortname = "complexcode" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql {....removed... } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 11273 rlm_sqlcounter: Check attribute Max-All-Session is number 11274 rlm_sqlcounter: Current Time: 1584839510 [2020-03-22 01:11:50], Next reset 0 [2020-03-22 01:00:00] rlm_sqlcounter: Current Time: 1584839510 [2020-03-22 01:11:50], Prev reset 0 [2020-03-22 01:00:00] Module: Instantiating module "dailycounter" from file /etc/freeradius/sqlcounter.conf sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sqlcca3" query = "...removed" reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute Daily-Session-Time is number 11275 rlm_sqlcounter: Check attribute Max-Daily-Session is number 11276 rlm_sqlcounter: Current Time: 1584839510 [2020-03-22 01:11:50], Next reset 1584921600 [2020-03-23 00:00:00] rlm_sqlcounter: Current Time: 1584839510 [2020-03-22 01:11:50], Prev reset 1584835200 [2020-03-22 00:00:00] Module: Instantiating module "monthlycounter" from file /etc/freeradius/sqlcounter.conf sqlcounter monthlycounter { counter-name = "Monthly-Session-Time" check-name = "Max-Monthly-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sqlcca3" query = "...removed" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute Monthly-Session-Time is number 11277 rlm_sqlcounter: Check attribute Max-Monthly-Session is number 11278 rlm_sqlcounter: Current Time: 1584839510 [2020-03-22 01:11:50], Next reset 1585699200 [2020-04-01 00:00:00] rlm_sqlcounter: Current Time: 1584839510 [2020-03-22 01:11:50], Prev reset 1583020800 [2020-03-01 00:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "...removed" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Instantiating module "sradutmp" from file /etc/freeradius/modules/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 420 callerid = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to authentication address * port 1812: Address already in use /etc/freeradius/radiusd.conf[20]: Error binding to port for 0.0.0.0 port 1812 root@cp2dev:~# ############################################################################################################################################## # -*- text -*- ## ## eap.conf -- Configuration for EAP types (PEAP, TTLS, etc.) ## ## $Id$ ####################################################################### # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # EAP types NOT listed here may be supported via the "eap2" module. # See experimental.conf for documentation. # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = tls # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # # Help prevent DoS attacks by limiting the number of # sessions that the server is tracking. Most systems # can handle ~30 EAP sessions/s, so the default limit # of 4096 should be OK. max_sessions = 4096 # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # leap { } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # auth_type = PAP } ## EAP-TLS # # See raddb/certs/README for additional comments # on certificates. # # If OpenSSL was not found at the time the server was # built, the "tls", "ttls", and "peap" sections will # be ignored. # # Otherwise, when the server first starts in debugging # mode, test certificates will be created. See the # "make_cert_command" below for details, and the README # file in raddb/certs # # These test certificates SHOULD NOT be used in a normal # deployment. They are created only to make it easier # to install the server, and to perform some simple # tests with EAP-TLS, TTLS, or PEAP. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # # Note that you should NOT use a globally known CA here! # e.g. using a Verisign cert as a "known CA" means that # ANYONE who has a certificate signed by them can # authenticate via EAP-TLS! This is likely not what you want. tls { # # These is used to simplify later configurations. # certdir = ${confdir}/certs cadir = ${confdir}/certs ##private_key_password = complexkey ##private_key_file = ${certdir}/server.key private_key_password = serverpasscode private_key_file = ${certdir}/server_key.key # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. ##certificate_file = ${certdir}/server.pem certificate_file = ${certdir}/server_new.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. ##CA_file = ${cadir}/ca.pem CA_file = ${cadir}/root_ca.pem # # For DH cipher suites to work, you have to # run OpenSSL to create the DH file first: # # openssl dhparam -out certs/dh 1024 # dh_file = ${certdir}/dh random_file = /dev/urandom # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) uncomment the line below. # 5) Restart radiusd # check_crl = yes CA_path = ${cadir} # # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate. If the values do not # match, the cerficate verification will fail, # rejecting the user. # # In 2.1.10 and later, this check can be done # more generally by checking the value of the # TLS-Client-Cert-Issuer attribute. This check # can be done via any mechanism you choose. # # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # This check is done only if the previous # "check_cert_issuer" is not set, or if # the check succeeds. # # In 2.1.10 and later, this check can be done # more generally by checking the value of the # TLS-Client-Cert-CN attribute. This check # can be done via any mechanism you choose. # # check_cert_cn = %{User-Name} # # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". cipher_list = "DEFAULT" # # This command creates the initial "snake oil" # certificates when the server is run as root, # and via "radiusd -X". # # As of 2.1.11, it *also* checks the server # certificate for validity, including expiration. # This means that radiusd will refuse to start # when the certificate has expired. The alternative # is to have the 802.1X clients refuse to connect # when they discover the certificate has expired. # # Debugging client issues is hard, so it's better # for the server to print out an error message, # and refuse to start. # make_cert_command = "${certdir}/bootstrap" # # Elliptical cryptography configuration # # Only for OpenSSL >= 0.9.8.f # ecdh_curve = "prime256v1" # # Session resumption / fast reauthentication # cache. # # The cache contains the following information: # # session Id - unique identifier, managed by SSL # User-Name - from the Access-Accept # Stripped-User-Name - from the Access-Request # Cached-Session-Policy - from the Access-Accept # # The "Cached-Session-Policy" is the name of a # policy which should be applied to the cached # session. This policy can be used to assign # VLANs, IP addresses, etc. It serves as a useful # way to re-apply the policy from the original # Access-Accept to the subsequent Access-Accept # for the cached session. # # On session resumption, these attributes are # copied from the cache, and placed into the # reply list. # # You probably also want "use_tunneled_reply = yes" # when using fast session resumption. # cache { # # Enable it. The default is "no". # Deleting the entire "cache" subsection # Also disables caching. # # You can disallow resumption for a # particular user by adding the following # attribute to the control item list: # # Allow-Session-Resumption = No # # If "enable = no" below, you CANNOT # enable resumption for just one user # by setting the above attribute to "yes". # enable = no # # Lifetime of the cached entries, in hours. # The sessions will be deleted after this # time. # lifetime = 24 # hours # # The maximum number of entries in the # cache. Set to "0" for "infinite". # # This could be set to the number of users # who are logged in... which can be a LOT. # max_entries = 255 } # # As of version 2.1.10, client certificates can be # validated via an external command. This allows # dynamic CRLs or OCSP to be used. # # This configuration is commented out in the # default configuration. Uncomment it, and configure # the correct paths below to enable it. # verify { # A temporary directory where the client # certificates are stored. This directory # MUST be owned by the UID of the server, # and MUST not be accessible by any other # users. When the server starts, it will do # "chmod go-rwx" on the directory, for # security reasons. The directory MUST # exist when the server starts. # # You should also delete all of the files # in the directory when the server starts. # tmpdir = /tmp/radiusd # The command used to verify the client cert. # We recommend using the OpenSSL command-line # tool. # # The ${..CA_path} text is a reference to # the CA_path variable defined above. # # The %{TLS-Client-Cert-Filename} is the name # of the temporary file containing the cert # in PEM format. This file is automatically # deleted by the server when the command # returns. # client = "/path/to/openssl verify -CApath ${..CA_path} %{TLS-Client-Cert-Filename}" } # # OCSP Configuration # Certificates can be verified against an OCSP # Responder. This makes it possible to immediately # revoke certificates without the distribution of # new Certificate Revokation Lists (CRLs). # ocsp { # # Enable it. The default is "no". # Deleting the entire "ocsp" subsection # Also disables ocsp checking # enable = no # # The OCSP Responder URL can be automatically # extracted from the certificate in question. # To override the OCSP Responder URL set # "override_cert_url = yes". # override_cert_url = yes # # If the OCSP Responder address is not # extracted from the certificate, the # URL can be defined here. # # Limitation: Currently the HTTP # Request is not sending the "Host: " # information to the web-server. This # can be a problem if the OCSP # Responder is running as a vhost. # url = "http://127.0.0.1/ocsp/" } } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # # The TTLS module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-TTLS does not # require a client certificate. # # You can make TTLS require a client cert by setting # # EAP-TLS-Require-Client-Cert = Yes # # in the control items for a request. # ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. default_eap_type = md5 # The tunneled authentication request does # not usually contain useful attributes # like 'Calling-Station-Id', etc. These # attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to # 'yes', any attribute which NOT in the # tunneled authentication request, but # which IS available outside of the tunnel, # is copied to the tunneled request. # # allowed values: {no, yes} copy_request_to_tunnel = no # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} use_tunneled_reply = no # # The inner tunneled request can be sent # through a virtual server constructed # specifically for this purpose. # # If this entry is commented out, the inner # tunneled request will be sent through # the virtual server that processed the # outer requests. # virtual_server = "inner-tunnel" # This has the same meaning as the # same field in the "tls" module, above. # The default value here is "yes". # include_length = yes } ################################################## # # !!!!! WARNINGS for Windows compatibility !!!!! # ################################################## # # If you see the server send an Access-Challenge, # and the client never sends another Access-Request, # then # # STOP! # # The server certificate has to have special OID's # in it, or else the Microsoft clients will silently # fail. See the "scripts/xpextensions" file for # details, and the following page: # # http://support.microsoft.com/kb/814394/en-us # # For additional Windows XP SP2 issues, see: # # http://support.microsoft.com/kb/885453/en-us # # # If is still doesn't work, and you're using Samba, # you may be encountering a Samba bug. See: # # https://bugzilla.samba.org/show_bug.cgi?id=6563 # # Note that we do not necessarily agree with their # explanation... but the fix does appear to work. # ################################################## # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # # The PEAP module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-PEAP does not # require a client certificate. # # # You can make PEAP require a client cert by setting # # EAP-TLS-Require-Client-Cert = Yes # # in the control items for a request. # peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. default_eap_type = mschapv2 # the PEAP module also has these configuration # items, which are the same as for TTLS. copy_request_to_tunnel = no use_tunneled_reply = no # When the tunneled session is proxied, the # home server may not understand EAP-MSCHAP-V2. # Set this entry to "no" to proxy the tunneled # EAP-MSCHAP-V2 as normal MSCHAPv2. # proxy_tunneled_request_as_eap = yes # # The inner tunneled request can be sent # through a virtual server constructed # specifically for this purpose. # # If this entry is commented out, the inner # tunneled request will be sent through # the virtual server that processed the # outer requests. # virtual_server = "inner-tunnel" # This option enables support for MS-SoH # see doc/SoH.txt for more info. # It is disabled by default. # # soh = yes # # The SoH reply will be turned into a request which # can be sent to a specific virtual server: # # soh_virtual_server = "soh-server" } # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { # Prior to version 2.1.11, the module never # sent the MS-CHAP-Error message to the # client. This worked, but it had issues # when the cached password was wrong. The # server *should* send "E=691 R=0" to the # client, which tells it to prompt the user # for a new password. # # The default is to behave as in 2.1.10 and # earlier, which is known to work. If you # set "send_error = yes", then the error # message will be sent back to the client. # This *may* help some clients work better, # but *may* also cause other clients to stop # working. # # send_error = no } } ##################################################################################################################################################### Android StrongSwan verifies all the cert stuff is ok, but errors and logs: N(Auth_FAILED) >From router log: Mar/21/2020 19:10:27 radius,debug resending 55:3f Mar/21/2020 19:10:27 radius,debug,packet sending Access-Request with id 62 to 162.220.55.231:1812 Mar/21/2020 19:10:27 radius,debug,packet Signature = 0xa5bbb251dc2b562e4dabc73c2e1a9763 Mar/21/2020 19:10:27 radius,debug,packet User-Name = "user123" Mar/21/2020 19:10:27 radius,debug,packet Called-Station-Id = "888.777.666.555" Mar/21/2020 19:10:27 radius,debug,packet Calling-Station-Id = "444.555.666.777" Mar/21/2020 19:10:27 radius,debug,packet NAS-Port-Id = 0x0000000d Mar/21/2020 19:10:27 radius,debug,packet NAS-Port-Type = 5 Mar/21/2020 19:10:27 radius,debug,packet Service-Type = 2 Mar/21/2020 19:10:27 radius,debug,packet Event-Timestamp = 1584835827 Mar/21/2020 19:10:27 radius,debug,packet Framed-MTU = 1400 Mar/21/2020 19:10:27 radius,debug,packet EAP-Message = 0x0200000b016d6178783039 Mar/21/2020 19:10:27 radius,debug,packet Message-Authenticator = 0x661158da6446c07da84cdb95d7ecb0bc Mar/21/2020 19:10:27 radius,debug,packet NAS-Identifier = "server01" Mar/21/2020 19:10:27 radius,debug,packet NAS-IP-Address = 888.777.666.555 Mar/21/2020 19:10:27 radius,debug resending 55:3f Mar/21/2020 19:10:27 radius,debug,packet sending Access-Request with id 62 to 162.220.55.231:1812 Mar/21/2020 19:10:27 radius,debug,packet Signature = 0xa5bbb251dc2b562e4dabc73c2e1a9763 Mar/21/2020 19:10:27 radius,debug,packet User-Name = "user123" Mar/21/2020 19:10:27 radius,debug,packet Called-Station-Id = "888.777.666.555" Mar/21/2020 19:10:27 radius,debug,packet Calling-Station-Id = "444.555.666.777" Mar/21/2020 19:10:27 radius,debug,packet NAS-Port-Id = 0x0000000d Mar/21/2020 19:10:27 radius,debug,packet NAS-Port-Type = 5 Mar/21/2020 19:10:27 radius,debug,packet Service-Type = 2 Mar/21/2020 19:10:27 radius,debug,packet Event-Timestamp = 1584835827 Mar/21/2020 19:10:27 radius,debug,packet Framed-MTU = 1400 Mar/21/2020 19:10:27 radius,debug,packet EAP-Message = 0x0200000b016d6178783039 Mar/21/2020 19:10:27 radius,debug,packet Message-Authenticator = 0x661158da6446c07da84cdb95d7ecb0bc Mar/21/2020 19:10:27 radius,debug,packet NAS-Identifier = "server01" Mar/21/2020 19:10:27 radius,debug,packet NAS-IP-Address = 888.777.666.555 Mar/21/2020 19:10:28 radius,debug timeout for 55:3f Mar/21/2020 19:10:28 ipsec,error radius timeout Mar/21/2020 19:10:28 ipsec reply notify: AUTHENTICATION_FAILED Mar/21/2020 19:10:28 ipsec adding notify: AUTHENTICATION_FAILED Mar/21/2020 19:10:28 ipsec,debug => (size 0x8) Mar/21/2020 19:10:28 ipsec,debug 00000008 00000018 Mar/21/2020 19:10:28 ipsec <- ike2 reply, exchange: AUTH:2 444.555.666.777[40517] Mar/21/2020 19:10:28 ipsec,debug,packet => outgoing plain packet (size 0x24)

2 5

pass parameters to rlm_perl script in a redundant setup
by Cornelius Kölbel 21 Mar '20

21 Mar '20

Hello, The redundant and redundant-load-balance setting is totally awesome. I would like to run perl modules in a redundant configuration. redundant { perl-auth-A perl-auth-B } With both being perl perl-auth-A { filename = /my/perl/script.pl } perl perl-auth-B { filename = /my/perl/script.pl } basically the same script but with two different configurations. So I am wondering how it is even possible to pass the information to the script, if it would run as "A" or "B". I could not figure to add some information maybe using update-control. So I am wondering if it is possible in some way to do perl perl-auth-A { filename = /my/perl/script.pl option = A } perl perl-auth-B { filename = /my/perl/script.pl option = B } Currently I need to create a copy of the perl script and do: perl perl-auth-A { filename = /my/perl/script-A.pl } perl perl-auth-B { filename = /my/perl/script-B.pl } Any hint is highly appreciated. I am running on FreeRADIUS 3.0.16. Thanks a lot Cornelius

3 3

Re: pass parameters to rlm_perl script in a redundant setup
by Cornelius Kölbel 21 Mar '20

21 Mar '20

Hello Jorge, thanks a lot.That was exactly, what I was looking for.Kind regards,Cornelius Am Samstag, den 21.03.2020, 15:29 -0300 schrieb Jorge Pereira: > You could use the section config{} to determine such arguments as can > be seen in > https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/mods-avai… > > On 21 Mar 2020, at 15:05, Cornelius Kölbel via Freeradius-Users < > > freeradius-users(a)lists.freeradius.org> wrote: > > > > Hello, > > > > The redundant and redundant-load-balance setting is totally > > awesome. > > I would like to run perl modules in a redundant configuration. > > > > redundant { > > perl-auth-A > > perl-auth-B > > } > > > > With both being > > > > perl perl-auth-A { > > filename = /my/perl/script.pl > > } > > > > perl perl-auth-B { > > filename = /my/perl/script.pl > > } > > > > basically the same script but with two different configurations. > > So I am wondering how it is even possible to pass the information > > to > > the script, if it would run as "A" or "B". > > I could not figure to add some information maybe using update- > > control. > > > > So I am wondering if it is possible in some way to do > > > > perl perl-auth-A { > > filename = /my/perl/script.pl > > option = A > > } > > > > perl perl-auth-B { > > filename = /my/perl/script.pl > > option = B > > } > > > > Currently I need to create a copy of the perl script and do: > > > > perl perl-auth-A { > > filename = /my/perl/script-A.pl > > } > > > > perl perl-auth-B { > > filename = /my/perl/script-B.pl > > } > > > > Any hint is highly appreciated. > > I am running on FreeRADIUS 3.0.16. > > > > Thanks a lot > > Cornelius > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html

1 0

MongoDB findAndModify() with aggregation
by Benjamin Thompson 21 Mar '20

21 Mar '20

Hi The findAndModify() method was recently updated to support aggregation. This means that the "update" parameter now accepts two different sytaxes: Old syntax (no aggregation): db.collection.findAndModify(query: { ... }, update: { ... } ) New syntax (with aggregation): db.collection.findAndModify(query: { ... }, update: [ ... ] ) The difference being that square bracket are used instead of curly bracktes for the aggregation pipeline. The first syntax works with FreeRADIUS but the second syntax gives the error: rlm_sql_mongo: 'update' does not hold a document. If there is any possiblitly to support the aggregation option then I think this would be very useful as it allows much more complex data processing inside the request. -- Ben Thompson

3 5

Strange Issue with datacounter_acct.sh
by Selahattin ÇİLEK 19 Mar '20

19 Mar '20

I am running FreeRADIUS 3.0.17. I have run into a strange issue with the *datacounter_acct*. It will run the *datacounter_acct.sh* only when it receives an *Interim-Update* packet from the NAS, and *NOT* when it receives a *Start* or *Stop* packet. What am I missing here? This is my datacounter_acct file: exec check_quota { wait = no program = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} %{request:Calling-Station-Id} %{request:NAS-IP-Address} %{request:Class} %{request:Acct-Status-Type} %{request:Called-Station-Id}" } This is a part of my default site: accounting { ... exec ... } -- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 1

3.0.21 installed from source fails to parse /mods-config/files/authorize?
by Gleb Lisikh 19 Mar '20

19 Mar '20

Installed 3.0.21 from source on Ubuntu18 (from scratch) and onCentOS7 over previous working 3.0.20 instance, and in both cases got the following when doing the "Initial Test" radtest testing password 127.0.0.1 0 testing123 as per https://wiki.freeradius.org/guide/Getting-Started (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available Entry in "users" ( /mods-config/files/authorize symlink) file is updated testing Cleartext-Password := "password" users file is still a symlink. Any advice why the radiusd seems to be ignoring the users file? Thank you!

2 2

User and EAP authentication
by Thomas Manninger 18 Mar '20

18 Mar '20

Hi, i am using freeradius 3.0.12+dfsg-5+deb9u1 on a debian 9 server. I confiured two virutal servers, one for X802.1 network authentication (name: inner-tunnel), another virtual server with PAP username/password authentication (name: keycloak). Every incoming request should processed by the virtual_server "keycloak-auth", except all X802.1 request should be processed to the virtual_server "inner-tunnel". But all requests, also the X802.1 requests, are processed by the virtual_server keycloak. If i unterstand it correctly, the eap module should send all EAP requests to the inner-tunnel, but this in not working :-( ... Only if i send all requests to the inner-tunnel virtual-server, then X802.1 auth is working How can i fix the issue? My listen configuration: > listen { > type = auth > ipaddr = * > port = 0 > virtual_server = keycloak > } > listen { > type = acct > ipaddr = * > ipv6addr = :: > port = 0 > virtual_server = keycloak > } My keycloak size: > server keycloak { > authorize { > files > filter_username > filter_password > preprocess > expiration > logintime > keycloak > } > authenticate { > Auth-Type keycloak { > keycloak > } > Auth-Type pap { > pap > } > } > ... > ... Thanks!

2 1

Re: Error 2FA - AD password and external OTP via RADIUS proxy
by Клеусов Владимир Сергее вич 18 Mar '20

18 Mar '20

Configured as follows: One freeradius is configured like this: https://wiki.freeradius.org/guide/2FA-A ... plus-Proxy The second freeradius is configured as follows: https://www.linotp.org/howtos/howto-radius.html That is, the idea is first go for the username /password in LDAP, then get a temporary password and check it The problem is that it doesn't work: Login incorrect (ldap: Bind credentials incorrect: Invalid credentials): [testuser/testpasswordOTP] In other words, passwords are glued together. I don 't understand how to configure it >> The general practice is to put the 6-digit OTP first, then the password. Then, split them via something like this: >> >> if (User-Password =~ /^(......)(.*)$/) { >> update request { >> User-Password := "%{2}" >> OTP-Password := "%{1}" >> } >> } >> >> You will need to edit raddb/dictionary in order to define OTP-Password. > 12 марта 2020 г., в 11:05, Клеусов Владимир Сергеевич <Kleusov.Vladimir(a)wildberries.ru> написал(а): > > Thanks. > In which file do I need to separate the LDAP and OTP password ? > How do I edit a dictionary ? > >> 11 марта 2020 г., в 23:42, Alan DeKok <aland(a)deployingradius.com> написал(а): >> >> On Mar 11, 2020, at 10:31 AM, Клеусов Владимир Сергеевич via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: >>> >>> In freeradius logs, this is ldap: Bind credentials incorrect: Invalid credentials): [testuser/testpasswd2217287 >>> First the request for a normal password and then the otp 2217287 >>> What's wrong ? >> >> The user entered the password followed by the OTP, all as one field. Then, you configured FreeRADIUS to send all that to LDAP. >> >> The general practice is to put the 6-digit OTP first, then the password. Then, split them via something like this: >> >> if (User-Password =~ /^(......)(.*)$/) { >> update request { >> User-Password := "%{2}" >> OTP-Password := "%{1}" >> } >> } >> >> You will need to edit raddb/dictionary in order to define OTP-Password. >> >> This lets you use User-Password as normal to connect to LDAP, and authenticate the user. >> >> You can then check OTP-Password however you want. >> >> Alan DeKok. >> >

2 2

Initial setup error
by Farrell, Jolene 18 Mar '20

18 Mar '20

Hi FreeRADIUS, I am currently a new starter and first timer with building a RADIUS server. My ultimate goal is to set up a RADIUS server for only accounting purposes (storing CDR packets as flat files and then forwarding them to Splunk) but have run into a few problems following simple installation of the freeradius package. Upon running radiusd in debugging mode (following no changes made to the configuration files) I received the output attached at the bottom of the email (Error #1). I understand that this may have something to do with IPv6 compatibility, so I removed the “listen” sections listening for IPv6 addresses but this occurred in another error (Error #2) and I have struggled to find any documentation relating to this. I have also found little documentation on setting up and testing a FreeRADIUS server for accounting only purposes and was wondering if you could at all point me in the right direction? Error #1 [cid:image002.jpg@01D5FD1E.84A32BF0] Error #2 [cid:image004.jpg@01D5FD1E.84A32BF0] Jolene Farrell Graduate Network Software Specialist [/var/folders/jd/17dd5mm57fl5vdjmygpftn8w0000gp/T/com.microsoft.Word/Content.MSO/F5395A8E.tmp] This email may contain confidential information. If I've sent it to you by accident, please delete it immediately

3 4

Freeradius 3.0.19 causes 'acctterminatecause' cannot be null
by Houman 17 Mar '20

17 Mar '20

Hello, I'm using Freeradius 3.0.19 on Ubuntu 19.10. The default schema in /etc/freeradius/3.0/mods-config/sql/main/mysql/schema.sql doesn't seem to work. I get the following error message, when connecting with my NAS. (3) sql: ERROR: rlm_sql_mysql: ERROR 1048 (Column 'acctterminatecause' cannot be null): 23000 I have attached the detailed log. Fun fact, when I drop the radius_db and use the schema.sql from Freeradius 3.0.16 and also replace the queries.sql with the older version. cp queries.conf /etc/freeradius/3.0/mods-config/sql/main/mysql/ It works without any problem. So whatever it is it has something to do with the 3.0.19. I also experience the same problem with the latest Freeradius 3.0.20 Help would be kindly appreciated as I'm really stuck on this, Many Thanks, Houman

2 1

Is there a way to simply not respond to a request?
by adrian.p.smith＠bt.com 17 Mar '20

17 Mar '20

Our network team have asked if we can get FreeRadius to simply not respond under certain circumstances. i.e. if (some condition) { let client time out } Is this possible? TIA Adrian

2 2

Windows 10: EAP-TTLS certificate not trusted
by Joseph 16 Mar '20

16 Mar '20

Hi, I'm trying to get EAP-TTLS set up, but the certificate is always asking for verification. This is failing on Windows 10, but tests out ok (without complaining) with eapol_test, radtest, and Ubuntu 16.04. "Continue connecting? "If you expect to find your-wifi in this location, go ahead and connect. Otherwise, it may be a different network with the same name. "Server thumbprint: 21 4B 37 ED ..." This matches what I expect. The certificate information, on the radius server: $ openssl x509 -in server.pem -noout -text -fingerprint -sha256 Issuer: C = FR, ST = Radius, L = Somewhere, O = Example Inc., emailAddress = admin(a)example.org, CN = Example Certificate Authority Validity Not Before: Mar 4 19:20:40 2020 GMT Not After : May 3 19:20:40 2020 GMT Subject: C = FR, ST = Radius, O = Example Inc., CN = radius.internal.mydomain.com X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 CRL Distribution Points: <present> X509v3 Subject Alternative Name: DNS:radius.internal.mydomain.com SHA256 Fingerprint=21:4B:37:ED:90:D8:... This seems to meet the requirements of https://wiki.freeradius.org/guide/Certificate_Compatibility (extended key usage) and https://wiki.geant.org/display/H2eduroam/EAP+Server+Certificate+considerati… (CN and SAN defined and the same, not wild card, extended key usage: authentication, age). TLS1.2 is enabled and shows to be used (Windows 8+ requirement) The CA certificate is added to Windows, Local computer, Trusted Root Certification Authorities: Example Certification Authority valid from: 3/3/2020 to 5/2/2020 CN = Example Certificate Authority, E = admin(a)example.org, O = Example Inc., L = Somewhere, S = Radius, C = FR Thumbprint: 4758ae7e Verifying this on the radius server, freerad@radius:~/3.0/certs$ openssl verify -verbose -CAfile ca.pem server.pem server.pem: OK $ openssl x509 -noout -in ca.pem -fingerprint -sha1 SHA1 Fingerprint=47:58:AE:7E... The radius server certificate would seem to be trusted. Does anyone know what I might be missing? ldap/eap configuration taken from https://github.com/hacor/unifi-freeradius-ldap, and I substituted in the ssl certificates. (Could the problem originate here?) The only thing missing is MTU/packet fragmentation, but I'm under the impression that's not happening -- or hoping. My network is just APs connected to a switch which routes to FreeRADIUS. FreeRADIUS then uses Google LDAP for authentication as EAP-TTLS/PAP. $ dpkg --list | grep freerad ii freeradius 3.0.16+dfsg-1ubuntu3.1 --- $ sudo -u freerad -g freerad -H freeradius -X FreeRADIUS Version 3.0.16 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/ldap including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/soh including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/dhcp including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm BASE_DOMAIN.DOMAIN_EXTENSION { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius_client_wireless-00 { ipaddr = 10.1.2.60 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius_client_wireless-01 { ipaddr = 10.1.2.61 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius_client_wireless-02 { ipaddr = 10.1.2.62 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius_client_wireless-03 { ipaddr = 10.1.2.63 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius_client_wireless-04 { ipaddr = 10.1.2.64 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius_client_wireless-05 { ipaddr = 10.1.2.65 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius_client_wireless-06 { ipaddr = 10.1.2.66 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius_client_Unifi_Server_01 { ipaddr = 10.1.2.23 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debug state unknown (cap_sys_ptrace capability not set) # Creating Auth-Type = mschap # Creating Auth-Type = ldap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap ldap { server = "ldaps://ldap.google.com" port = 636 identity = "EdibleSilv" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "OU=People,OU=Users,dc=mydomain,dc=com" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { certificate_file = "/etc/freeradius/3.0/certs/ldap-client.crt" private_key_file = "/etc/freeradius/3.0/certs/ldap-client.key" start_tls = no require_cert = "allow" } } Creating attribute LDAP-Group # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } instantiate { } # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/server.pem" certificate_file = "/etc/freeradius/3.0/certs/server.pem" ca_file = "/etc/freeradius/3.0/certs/ca.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no check_cert_issuer = "/C=US/ST=State/L=City/O=My Company, Inc." ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = yes lifetime = 12 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "gtc" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20445 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:338 } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 52559 Listening on proxy address :: port 41814 Ready to process requests (0) Received Access-Request Id 145 from 10.1.2.63:39770 to 10.1.2.25:1812 length 203 (0) User-Name = "aoeueue" (0) NAS-Identifier = "788a2008ac06" (0) Called-Station-Id = "78-8A-20-08-AC-06:your-wifi" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "20-79-18-D6-97-96" (0) Connect-Info = "CONNECT 0Mbps 802.11b" (0) Acct-Session-Id = "10460A9D221FCF77" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027076 (0) WLAN-AKM-Suite = 1027073 (0) Framed-MTU = 1400 (0) EAP-Message = 0x02c7000c01616f6575657565 (0) Message-Authenticator = 0x7894af56d612c3847cc67ac34ce974a4 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "aoeueue", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 199 length 12 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_ttls to process data (0) eap_ttls: Initiating new EAP-TLS session (0) eap_ttls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 200 length 6 (0) eap: EAP session adding &reply:State = 0x9d62a3209daab67e (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 145 from 10.1.2.25:1812 to 10.1.2.63:39770 length 0 (0) EAP-Message = 0x01c800061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x9d62a3209daab67eaf85e9ac41fab325 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 146 from 10.1.2.63:39770 to 10.1.2.25:1812 length 366 (1) User-Name = "aoeueue" (1) NAS-Identifier = "788a2008ac06" (1) Called-Station-Id = "78-8A-20-08-AC-06:your-wifi" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Calling-Station-Id = "20-79-18-D6-97-96" (1) Connect-Info = "CONNECT 0Mbps 802.11b" (1) Acct-Session-Id = "10460A9D221FCF77" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027076 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x02c8009d158000000093160303008e0100008a03035e5fffb222e70c8585fd5cea423796f3b4caf01df65ddd50d9f5a2921440e54c00002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000037000a00080006001d00170018000b000201 (1) State = 0x9d62a3209daab67eaf85e9ac41fab325 (1) Message-Authenticator = 0xdb1ce7e27f2e12e2257dbb305ab6b7dd (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "aoeueue", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 200 length 157 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x9d62a3209daab67e (1) eap: Finished EAP session with state 0x9d62a3209daab67e (1) eap: Previous EAP request found for state 0x9d62a3209daab67e, released from the list (1) eap: Peer sent packet with method EAP TTLS (21) (1) eap: Calling submodule eap_ttls to process data (1) eap_ttls: Authenticate (1) eap_ttls: Continuing EAP-TLS (1) eap_ttls: Peer indicated complete TLS record size will be 147 bytes (1) eap_ttls: Got complete TLS record (147 bytes) (1) eap_ttls: [eaptls verify] = length included (1) eap_ttls: (other): before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: TLS_accept: before SSL initialization (1) eap_ttls: <<< recv UNKNOWN TLS VERSION ?0304? [length 008e] (1) eap_ttls: TLS_accept: SSLv3/TLS read client hello (1) eap_ttls: >>> send TLS 1.2 [length 003d] (1) eap_ttls: TLS_accept: SSLv3/TLS write server hello (1) eap_ttls: >>> send TLS 1.2 [length 041a] (1) eap_ttls: TLS_accept: SSLv3/TLS write certificate (1) eap_ttls: >>> send TLS 1.2 [length 014d] (1) eap_ttls: TLS_accept: SSLv3/TLS write key exchange (1) eap_ttls: >>> send TLS 1.2 [length 0004] (1) eap_ttls: TLS_accept: SSLv3/TLS write server done (1) eap_ttls: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_ttls: In SSL Handshake Phase (1) eap_ttls: In SSL Accept mode (1) eap_ttls: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 201 length 1004 (1) eap: EAP session adding &reply:State = 0x9d62a3209cabb67e (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 146 from 10.1.2.25:1812 to 10.1.2.63:39770 length 0 (1) EAP-Message = 0x01c903ec15c0000005bc160303003d0200003903034f445d4b3ba004eb7388e4b5e12e0173bd44ca258999f6ded22634da1265973000c030000011ff01000100000b00040300010200170000160303041a0b0004160004130004103082040c308202f4a003020102020104300d06092a864886f70d0101 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x9d62a3209cabb67eaf85e9ac41fab325 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 147 from 10.1.2.63:39770 to 10.1.2.25:1812 length 215 (2) User-Name = "aoeueue" (2) NAS-Identifier = "788a2008ac06" (2) Called-Station-Id = "78-8A-20-08-AC-06:your-wifi" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) Calling-Station-Id = "20-79-18-D6-97-96" (2) Connect-Info = "CONNECT 0Mbps 802.11b" (2) Acct-Session-Id = "10460A9D221FCF77" (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027076 (2) WLAN-AKM-Suite = 1027073 (2) Framed-MTU = 1400 (2) EAP-Message = 0x02c900061500 (2) State = 0x9d62a3209cabb67eaf85e9ac41fab325 (2) Message-Authenticator = 0x9720567cc957cdcbb56432840e0750b9 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "aoeueue", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 201 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x9d62a3209cabb67e (2) eap: Finished EAP session with state 0x9d62a3209cabb67e (2) eap: Previous EAP request found for state 0x9d62a3209cabb67e, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: Continuing EAP-TLS (2) eap_ttls: Peer ACKed our handshake fragment (2) eap_ttls: [eaptls verify] = request (2) eap_ttls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 202 length 484 (2) eap: EAP session adding &reply:State = 0x9d62a3209fa8b67e (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 147 from 10.1.2.25:1812 to 10.1.2.63:39770 length 0 (2) EAP-Message = 0x01ca01e41580000005bc71fe0a93c2e2fbd0c480b490189396e814187d8424aef2b8319165605b0b9c9de0278032cc4936a02e1cd54e65e9716755396efa145db5278ae98b9dd3f382b32636bfa9e240467a98f57142f5e701f329571001cd7dcd915517959b84190bc5a9f852a90d0d8b7ed92ad53cf7 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x9d62a3209fa8b67eaf85e9ac41fab325 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 148 from 10.1.2.63:39770 to 10.1.2.25:1812 length 345 (3) User-Name = "aoeueue" (3) NAS-Identifier = "788a2008ac06" (3) Called-Station-Id = "78-8A-20-08-AC-06:your-wifi" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) Calling-Station-Id = "20-79-18-D6-97-96" (3) Connect-Info = "CONNECT 0Mbps 802.11b" (3) Acct-Session-Id = "10460A9D221FCF77" (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027076 (3) WLAN-AKM-Suite = 1027073 (3) Framed-MTU = 1400 (3) EAP-Message = 0x02ca008815800000007e16030300461000004241040930b89367dc50b386787a93395c6e3c427ad8fb7d08a796229af9b6b04556173347967e24642a9392214501b1068fe4fc55d00190e650cce3a15b6ac0fc203014030300010116030300280000000000000000e69bea7456a63b68f8e1cc3bdd8969 (3) State = 0x9d62a3209fa8b67eaf85e9ac41fab325 (3) Message-Authenticator = 0x4a6d6a147abf70cc8516289ebf64f9d8 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "aoeueue", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 202 length 136 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x9d62a3209fa8b67e (3) eap: Finished EAP session with state 0x9d62a3209fa8b67e (3) eap: Previous EAP request found for state 0x9d62a3209fa8b67e, released from the list (3) eap: Peer sent packet with method EAP TTLS (21) (3) eap: Calling submodule eap_ttls to process data (3) eap_ttls: Authenticate (3) eap_ttls: Continuing EAP-TLS (3) eap_ttls: Peer indicated complete TLS record size will be 126 bytes (3) eap_ttls: Got complete TLS record (126 bytes) (3) eap_ttls: [eaptls verify] = length included (3) eap_ttls: TLS_accept: SSLv3/TLS write server done (3) eap_ttls: <<< recv TLS 1.2 [length 0046] (3) eap_ttls: TLS_accept: SSLv3/TLS read client key exchange (3) eap_ttls: TLS_accept: SSLv3/TLS read change cipher spec (3) eap_ttls: <<< recv TLS 1.2 [length 0010] (3) eap_ttls: TLS_accept: SSLv3/TLS read finished (3) eap_ttls: >>> send TLS 1.2 [length 0001] (3) eap_ttls: TLS_accept: SSLv3/TLS write change cipher spec (3) eap_ttls: >>> send TLS 1.2 [length 0010] (3) eap_ttls: TLS_accept: SSLv3/TLS write finished (3) eap_ttls: (other): SSL negotiation finished successfully (3) eap_ttls: SSL Connection Established (3) eap_ttls: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 203 length 61 (3) eap: EAP session adding &reply:State = 0x9d62a3209ea9b67e (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 148 from 10.1.2.25:1812 to 10.1.2.63:39770 length 0 (3) EAP-Message = 0x01cb003d158000000033140303000101160303002870a65b66c2192b62a01caa7fffad2cbb2e33ac17844df277ecf4437404e5db6113ec2d263c1e51c4 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x9d62a3209ea9b67eaf85e9ac41fab325 (3) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 145 with timestamp +9 (1) Cleaning up request packet ID 146 with timestamp +9 (2) Cleaning up request packet ID 147 with timestamp +9 (3) Cleaning up request packet ID 148 with timestamp +9 Ready to process requests logs through when Windows started waiting at the certificate fingerprint.

3 3

Re: Freeradius-Users Digest, Vol 179, Issue 27
by Gleb Lisikh 16 Mar '20

16 Mar '20

Yes, edited it appropriately, and it's a still a simlink Gleb On Mon, Mar 16, 2020 at 7:00 AM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. 3.0.21 installed from source fails to parse > /mods-config/files/authorize? (Gleb Lisikh) > 2. Re: 3.0.21 installed from source fails to parse > /mods-config/files/authorize? (Matthew Newton) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 15 Mar 2020 21:40:13 -0400 > From: Gleb Lisikh <in4bit.general(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: 3.0.21 installed from source fails to parse > /mods-config/files/authorize? > Message-ID: > < > CAKMAD3kWZp1T3ZgAGNS4xCD+h9KXLz+qxi0PqdUiyKzr2XGM1w(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Installed 3.0.21 from source on Ubuntu18 (from scratch) and on CentOS7 > (over previous working 3.0.20 instance), and in both cases got the > following when doing the "Initial Test" > radtest testing password 127.0.0.1 0 testing123 > as per > https://wiki.freeradius.org/guide/Getting-Started > > (0) pap: WARNING: No "known good" password found for the user. Not setting > Auth-Type > (0) pap: WARNING: Authentication will fail unless a "known good" password > is available > (0) [pap] = noop > (0) } # authorize = ok > (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = > Reject > > radiusd -X seems to have launched OK. > > What's wrong? > > T^hank you! > > > ------------------------------ > > Message: 2 > Date: Mon, 16 Mar 2020 02:23:22 +0000 > From: Matthew Newton <mcn(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: 3.0.21 installed from source fails to parse > /mods-config/files/authorize? > Message-ID: > <72f9a65f24ebb6cd2bf5cbc70d61eeb3f7c0d21a.camel(a)freeradius.org> > Content-Type: text/plain; charset="UTF-8" > > On Sun, 2020-03-15 at 21:40 -0400, Gleb Lisikh wrote: > > Installed 3.0.21 from source on Ubuntu18 (from scratch) and on > > CentOS7 > > (over previous working 3.0.20 instance), and in both cases got the > > following when doing the "Initial Test" > > radtest testing password 127.0.0.1 0 testing123 > > as per > > https://wiki.freeradius.org/guide/Getting-Started > > > > (0) pap: WARNING: No "known good" password found for the user. Not > > setting > > Auth-Type > > (0) pap: WARNING: Authentication will fail unless a "known good" > > password > > is available > > No password available. > > Did you add the entry to the "users" file? > > testing Cleartext-Password := "password" > > Make sure the users file is still a symlink. If you edited it but it's > a plain file then that's likely the problem. > > -- > Matthew > > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 179, Issue 27 > ************************************************* >

1 0