May 2021 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

RE: EAP-TLS Signature Check Failure
by nabble＠felix.world 12 Jul '22

12 Jul '22

Hi Together, we finally got the issue and for the anyone else, how will face the issue, the fix is quite simple. Update your TPM Firmware! In fact, during the authentication the client is sending a signature which only includes nulls. The packet itself is intact, sizes of the packets are valid and the signature algorithm is also well. The only thing that's not in the tls authentication is a signature. : ```` (4) eap_tls: <<< recv TLS 1.2 (type: 0016) [length 0108] handshake_type: 0f, alert_level: 00, alert_description: 00 0f000104 TLS handshake certificate_verify len 0x000104 = 260 0804 signature algorithm: rsa_pss_rsae_sha256 0100 signature size: 0x0100 = 256 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 000000000000 ```` That's also the reason why some of our clients are able to authenticate and some not, with the key, stored in TPM. Intel ships end customer TPM updater, STM as we know not. We also don't have clients with Infineon chips but they should also ship updates to the end customer. FYI: This was a team operation and thanks to all that helped here. Regards, Lineconnnect <quote author='Users mailing list'> 2 months later, a quick update on this topic (apologies, I may have broken the threading as I don't have a copy of the original e-mails any more!), just so there's an online reference here for anyone encountering the same error. Turns out I was wrong about it being Windows and OpenSSL getting muddled over TLS 1.2 vs. 1.3... To recap: Windows 10 clients, corporate WiFi network using EAP-TLS to RADIUS with machine certificate (SCEP) authentication only. Error in Freeradius logs: (6) eap_tls: ERROR: TLS Alert write:fatal:decrypt error tls: TLS_accept: Error in error (6) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read) (6) eap_tls: ERROR: error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid (6) eap_tls: ERROR: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature (6) eap_tls: ERROR: System call (I/O) error (-1) (6) eap_tls: ERROR: TLS receive handshake failed during operation (6) eap_tls: ERROR: [eaptls process] = fail After encountering the error on a few machines again, even with "tls_max_version" set, I delved into the guts of Windows again, and found the error (which isn't helpful or descriptive) was actually caused because: * Some machine certificates had were stored/managed by the "Microsoft Platform Crypto Provider" (TPM-backed) * Built-in security measures control access to keys in that CSP, and it cannot be used non-interactively * Windows WiFi profile was set to auto-join (non-interactive) * Windows couldn't get the key, so $deity knows what signature it was sending * OpenSSL rightly got confused The solution: Ensure machine certificate keys are stored in the "Microsoft Software Key Storage Provider" (or another CSP/KSP that permits non-interactive use). All is well again, and I'm close to shutting down NPS :-) -- Peter Bance Information Security Adviser Alan DeKok wrote: > A final update on this, in case anyone here's interested (or to "wrap > up" for anyone stumbling across this thread online) - I fixed it, and > Windows clients are now happily joining WiFi. It's a beautiful thing to > behold :-) > > In the end, I had to force OpenSSL on FreeRADIUS to stop offering > TLS1.3 ciphers using the mods/eap config: > > tls_max_version = "1.2" Good to hear. > It seems there may be a bug in OpenSSL 1.1.1 such that even though the > negotiation resulted in a TLS 1.2 session, the weird back-port of TLS > 1.3 ciphers into TLS 1.2 confused things (a lot), and it tried checking > for TLS 1.3 style signatures inappropriately. Weird, but OK. It's OpenSSL :( Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </quote> Quoted from: http://freeradius.1045715.n5.nabble.com/RE-EAP-TLS-Signature-Check-Failure-… _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com

3 4

FreeRADIUS Authentication with AD Without Joining AD
by Vertigo Altair 18 Jun '21

18 Jun '21

Hi! I'm trying to use FreeRADIUS with an Active Directory Server. I've read the documentations but the server that FreeRADIUS runs has to join the Active Directory as a client. Is there any way to authenticate users with AD without joining the AD server? P.S.: I'm using MSCHAP protocol.

4 5

EAP-TLS PKI management
by Munroe Sollog 17 Jun '21

17 Jun '21

Has anyone deployed EAP-TLS in concert with BYOD? This Android 11 change that removes the ability for the user to "Do Not Validate" the CA certificate has forced us to re-evaluate our .1x PEAP solution. EAP-TLS seems like the best option, however the onboarding of user-brought devices seems tricky. With MDM or AD-joined devices pushing the certificates out are easy. In an environment where "bring your own device" is encouraged, I'm curious how network admins are making client certificate installations easy enough for end users to do. Android 11 change article for reference: https://www.xda-developers.com/android-11-break-enterprise-wifi-connection/ -- Munroe Sollog (He/Him/His) Senior Network Engineer munroe(a)lehigh.edu

5 7

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

TLS 1.3
by HERCEK, Marián 09 Jun '21

09 Jun '21

Hello, after upgrading to 3.0.22 I can see many authentication problems with old devices (e.g. Android 4.4) Using EAP + MSCHAPv2. I configured tls_min_version to 1.0 and tls_max_version to 1.3. Debug log: (32) eap_peap: (TLS) EAP Got all data (198 bytes) (32) eap_peap: (TLS) Handshake state - before SSL initialization (0) (32) eap_peap: (TLS) Handshake state - Server before SSL initialization (0) (32) eap_peap: (TLS) Handshake state - Server before SSL initialization (0) (32) eap_peap: (TLS) recv TLS 1.3 Handshake, ClientHello (32) eap_peap: (TLS) send TLS 1.0 Alert, fatal protocol_version (32) eap_peap: ERROR: (TLS) Alert write:fatal:protocol version (32) eap_peap: ERROR: (TLS) Server : Error in error (32) eap_peap: ERROR: (TLS) Failed reading from OpenSSL: error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (32) eap_peap: ERROR: (TLS) System call (I/O) error (-1) (32) eap_peap: ERROR: (TLS) EAP Receive handshake failed during operation freeradius -Xxv Mon May 31 12:00:32 2021 : Info: radiusd: FreeRADIUS Version 3.0.22 (git #7c658e1c0), for host x86_64-pc-linux-gnu Mon May 31 12:00:32 2021 : Debug: Server was built with: Mon May 31 12:00:32 2021 : Debug: accounting : yes Mon May 31 12:00:32 2021 : Debug: authentication : yes Mon May 31 12:00:32 2021 : Debug: ascend-binary-attributes : yes Mon May 31 12:00:32 2021 : Debug: coa : yes Mon May 31 12:00:32 2021 : Debug: control-socket : yes Mon May 31 12:00:32 2021 : Debug: detail : yes Mon May 31 12:00:32 2021 : Debug: dhcp : yes Mon May 31 12:00:32 2021 : Debug: dynamic-clients : yes Mon May 31 12:00:32 2021 : Debug: osfc2 : no Mon May 31 12:00:32 2021 : Debug: proxy : yes Mon May 31 12:00:32 2021 : Debug: regex-pcre : no Mon May 31 12:00:32 2021 : Debug: regex-posix : yes Mon May 31 12:00:32 2021 : Debug: regex-posix-extended : yes Mon May 31 12:00:32 2021 : Debug: session-management : yes Mon May 31 12:00:32 2021 : Debug: stats : yes Mon May 31 12:00:32 2021 : Debug: systemd : yes Mon May 31 12:00:32 2021 : Debug: tcp : yes Mon May 31 12:00:32 2021 : Debug: threads : yes Mon May 31 12:00:32 2021 : Debug: tls : yes Mon May 31 12:00:32 2021 : Debug: unlang : yes Mon May 31 12:00:32 2021 : Debug: vmps : yes Mon May 31 12:00:32 2021 : Debug: developer : no Mon May 31 12:00:32 2021 : Debug: Server core libs: Mon May 31 12:00:32 2021 : Debug: freeradius-server : 3.0.22 Mon May 31 12:00:32 2021 : Debug: talloc : 2.1.* Mon May 31 12:00:32 2021 : Debug: ssl : 1.1.1d release openssl ciphers -s -v -tls1 ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 openssl ciphers -s -v -tls1_2 ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256 ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256 AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1 openssl ciphers -s -v -tls1_3 TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD

4 8

Changing format for $RAD_REQUEST{'Event-Timestamp'} in Perl module
by Юрий Иванов 04 Jun '21

04 Jun '21

Hi, I need to change $RAD_REQUEST{'Event-Timestamp'} format before inserting to database. Looks like $RAD_REQUEST{'date:Event-Timestamp'}, $RAD_REQUEST{'integer:Event-Timestamp'} are not working. Is there any method to use date module or standard keywords in perl code or I should do it manually.

3 4

Problems with Samba
by Klemen forneci 04 Jun '21

04 Jun '21

Hello. I hope someone can shine a light on my problem with Freeradius 3 and mschap (running on centos7 with samba/winbind) So long story short, I notice that every ~5 minutes there is a problem with NTLM_AUTH. Even with testing with radtest -t mscahp at the same time, I get: (10) Auth-Type MS-CHAP { (10) if (Realm == "um.si") { (10) if (Realm == "um.si") -> TRUE (10) if (Realm == "um.si") { (10) mschap_thor: Client is using MS-CHAPv1 with NT-Password (10) mschap_thor: Executing: /usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-THOR} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (10) mschap_thor: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (10) mschap_thor: --> --username=****** (10) mschap_thor: ERROR: No NT-Domain was found in the User-Name (10) mschap_thor: EXPAND --domain=%{%{mschap:NT-Domain}:-THOR} (10) mschap_thor: --> --domain=THOR (10) mschap_thor: mschap1: 31 (10) mschap_thor: EXPAND --challenge=%{%{mschap:Challenge}:-00} (10) mschap_thor: --> --challenge=316c3b72847b74c7 (10) mschap_thor: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (10) mschap_thor: --> --nt-response=273c482ad6ee3eeb8c21239368764a42d66c1b6ca8f0e98e Child PID 5238 is taking too much time: forcing failure and killing child. (10) mschap_thor: ERROR: Failed to read from child output (10) mschap_thor: External script failed (10) mschap_thor: ERROR: External script says: (10) mschap_thor: ERROR: MS-CHAP2-Response is incorrect I know this may not be a radius issue, beause of the fact that in-between the system works as expected and the line: Child PID 5238 is taking too much time: forcing failure and killing child, but I have my hopes up someone can point me in the right direction. On the backend there is a Windows AD, multiple DC (tried setting only 1 in samba, same issue), the server is domain joined. I have multiple servers with the same issue (in the same environment) What allso puzzles me, are the logs: Server 1: Fri May 28 14:35:27 2021 : ERROR: (59476) mschap_thor: ERROR: Failed to read from child output Fri May 28 14:35:31 2021 : ERROR: (59508) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:35:35 2021 : ERROR: (59534) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:03 2021 : ERROR: (60960) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:08 2021 : ERROR: (60993) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:12 2021 : ERROR: (61017) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:14 2021 : ERROR: (61030) mschap_loki: ERROR: Failed to read from child output Fri May 28 14:40:15 2021 : ERROR: (61040) mschap_loki: ERROR: Failed to read from child output Server 2: Fri May 28 14:38:29 2021 : ERROR: (4) mschap_thor: ERROR: Failed to read from child output Fri May 28 14:38:44 2021 : ERROR: (5) mschap_thor: ERROR: Failed to read from child output It's like a blinker. One works, the other doesnt. Thank you for any tips. Klemen

4 4

eduroam howto log failure mschapv2
by Francesco Malvezzi 02 Jun '21

02 Jun '21

> Fix the samba parts to this and you should be good. > > Read : > https://wiki.samba.org/index.php/Authenticating_Freeradius_against_Active_D… > > Might help. > > Greetz, > > Louis > > Yes, it would definitely work to log the event on the Directory (it's OpenLDAP here, I wouldn't be able to log anything more than the authentication attempt, but I get it). But it is a lot friendlier to be able to collect all radius logs on radius server, isn'it? Thank you for the hint, Francesco

2 1

TLS Alert read:fatal:internal error
by Piotr Rudzki 30 May '21

30 May '21

I've strange problem with freeradius. It was working as expected and suddenly stopped authenticate wpa2-eap users to active directory. I've recreated whole VM with freeradius server without success. Same credentials work for ikev2 mschapv2 authentication but not for wireless wpa2-eap (android and windows clients). Am I missing something? Below debug log with error: (9) eap: Expiring EAP session with state 0x977b062a947f1f7c (9) eap: Finished EAP session with state 0x977b062a947f1f7c (9) eap: Previous EAP request found for state 0x977b062a947f1f7c, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: Peer indicated complete TLS record size will be 7 bytes (9) eap_peap: Got complete TLS record (7 bytes) (9) eap_peap: [eaptls verify] = length included (9) eap_peap: <<< recv TLS 1.2 [length 0002] (9) eap_peap: ERROR: TLS Alert read:fatal:internal error (9) eap_peap: TLS_accept: Need to read more data: error (9) eap_peap: ERROR: Failed in __FUNCTION__ (SSL_read): error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error (9) eap_peap: TLS - In Handshake Phase (9) eap_peap: TLS - Application data. (9) eap_peap: ERROR: TLS failed during operation (9) eap_peap: ERROR: [eaptls process] = fail (9) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (9) eap: Sending EAP Failure (code 4) ID 4 length 4 (9) eap: Failed in EAP select (9) [eap] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) Post-Auth-Type REJECT { (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> some_domain\\some_user (9) attr_filter.access_reject: Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) } # Post-Auth-Type REJECT = updated

2 3

Some Random Questions
by mohamed almeshal 28 May '21

28 May '21

dear all , Thanks For you kind to support us . I have some issues about freeRadius installation * First : I discover issue may be mislead , but I will descript it to yours , if I connect the mikrotik NAS with my freeradius service and the users being auth before with other freeradius service my server open session in radacct and consider them valid even if some of them have not radcheck data .(strange) . * Second : how I can run external script that run by freeradius in the sites-available default to acct as cron job , I know how to run cron job but I would to like to sync it with freeradius .

2 1

help
by Aravind Voonna 28 May '21

28 May '21

Hello Saver, I am setting up freeradius on aws and using jumpcloud ldap server for authorization. I am able to successfully test from Ruckus wireless controller and radius sever with PAP protocol. I am struck when user try to connect to SSID and it is getting fail(Based on logs able to find the issue but unable to fix it). The below are the output 1. The first output Successful from wireless controller 2. The Second output is failing from the end user. The user using EAP-EPAP-MS-CHAPV2 protocol. The below logs shows Successful when tested from the wireless controller Received Access-Request Id 24 from 10.101.0.11:48304 to 10.92.8.117:1812 length 98 (0) NAS-Port-Type = Virtual (0) NAS-Port = 8443 (0) User-Name = "jbravo" (0) NAS-IP-Address = 10.101.0.11 (0) User-Password = "test123" (0) Message-Authenticator = 0xc1a60741181e7bc02db76b6f69ebc9e2 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@ [^@]*@/ ) { (0) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=jbravo) (0) ldap: Performing search in "o=605d181e43609a22cde87434,dc=jumpcloud,dc=com" with filter "(uid=jbravo)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=jbravo,ou=Users,o=605d181e43609a22cde87434,dc=jumpcloud,dc=com" (0) ldap: Processing user attributes (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap.jumpcloud.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) if ((ok || updated) && User-Password) { (0) if ((ok || updated) && User-Password) -> TRUE (0) if ((ok || updated) && User-Password) { (0) update { (0) control:Auth-Type := LDAP (0) } # update = noop (0) } # if ((ok || updated) && User-Password) = noop (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Auth-Type LDAP { rlm_ldap (ldap): Reserved connection (1) (0) ldap: Login attempt by "jbravo" (0) ldap: Using user DN from request "uid=jbravo,ou=Users,o=605d181e43609a22cde87434,dc=jumpcloud,dc=com" (0) ldap: Waiting for bind result... (0) ldap: Bind successful (0) ldap: Bind as user "uid=jbravo,ou=Users,o=605d181e43609a22cde87434,dc=jumpcloud,dc=com" was successful rlm_ldap (ldap): Released connection (1) (0) [ldap] = ok (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Login OK: [jbravo/test123] (from client 10.101.0.11 port 8443) (0) Sent Access-Accept Id 24 from 10.92.8.117:1812 to 10.101.0.11:48304 length 0 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 24 with timestamp +6 Ready to process requests The below logs shows un Successful when tested from the End users. (0) Received Access-Request Id 24 from 10.101.0.11:52709 to 10.92.8.117:1812 length 402 (0) Acct-Session-Id = "60AFFFDC-63EDA801" (0) User-Name = "jbravo" (0) NAS-IP-Address = 10.101.0.200 (0) NAS-Identifier = "34-FA-9F-1E-F3-9D" (0) NAS-Port = 1 (0) Called-Station-Id = "34-FA-9F-1E-F3-9D:Test-SSID" (0) Calling-Station-Id = "38-F9-D3-49-E4-A7" (0) Location-Data = 0x313055531708466c6578706f7274 (0) Location-Data = 0x323055531628373630204d61726b6574205374726565742c2053616e204672616e636973636f2c20434120555341 (0) Service-Type = Framed-User (0) Chargeable-User-Identity = 0x00 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = "CONNECT 802.11a/n" (0) EAP-Message = 0x0200000b016a627261766f (0) Ruckus-SSID = "Test-SSID" (0) Ruckus-BSSID = 0x34fa9f1ef39d (0) Ruckus-Location = "Flexport" (0) Ruckus-VLAN-ID = 120 (0) Ruckus-SCG-CBlade-IP = 174391307 (0) Attr-26.25053.155 = 0x41646d696e697374726174696f6e20446f6d61696e (0) Ruckus-Zone-Name = "Default Zone" (0) Ruckus-Wlan-Name = "Test-SSID" (0) Message-Authenticator = 0x1bf0f80960b3b00bf9719408806d4923 (0) Event-Timestamp = "May 27 2021 20:23:57 UTC" (0) Proxy-State = 0x3538 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@ [^@]*@/ ) { (0) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 0 length 11 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 1 length 22 (0) eap: EAP session adding &reply:State = 0xf9bf494bf9be4d72 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 24 from 10.92.8.117:1812 to 10.101.0.11:52709 length 0 (0) EAP-Message = 0x01010016041077b76baf88936949dd8dd946f20208d7 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xf9bf494bf9be4d728434925772015f5c (0) Proxy-State = 0x3538 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 114 from 10.101.0.11:52709 to 10.92.8.117:1812 length 417 (1) Acct-Session-Id = "60AFFFDC-63EDA801" (1) User-Name = "jbravo" (1) NAS-IP-Address = 10.101.0.200 (1) NAS-Identifier = "34-FA-9F-1E-F3-9D" (1) NAS-Port = 1 (1) Called-Station-Id = "34-FA-9F-1E-F3-9D:Test-SSID" (1) Calling-Station-Id = "38-F9-D3-49-E4-A7" (1) Location-Data = 0x313055531708466c6578706f7274 (1) Location-Data = 0x323055531628373630204d61726b6574205374726565742c2053616e204672616e636973636f2c20434120555341 (1) Service-Type = Framed-User (1) Chargeable-User-Identity = 0x00 (1) NAS-Port-Type = Wireless-802.11 (1) Connect-Info = "CONNECT 802.11a/n" (1) EAP-Message = 0x020100080319152b (1) State = 0xf9bf494bf9be4d728434925772015f5c (1) Ruckus-SSID = "Test-SSID" (1) Ruckus-BSSID = 0x34fa9f1ef39d (1) Ruckus-Location = "Flexport" (1) Ruckus-VLAN-ID = 120 (1) Ruckus-SCG-CBlade-IP = 174391307 (1) Attr-26.25053.155 = 0x41646d696e697374726174696f6e20446f6d61696e (1) Ruckus-Zone-Name = "Default Zone" (1) Ruckus-Wlan-Name = "Test-SSID" (1) Message-Authenticator = 0x2643fdb096ce639704bee8f89e2b537f (1) Event-Timestamp = "May 27 2021 20:23:57 UTC" (1) Proxy-State = 0x3539 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@ [^@]*@/ ) { (1) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 1 length 8 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop rlm_ldap (ldap): Reserved connection (0) (1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap: --> (uid=jbravo) (1) ldap: Performing search in "o=605d181e43609a22cde87434,dc=jumpcloud,dc=com" with filter "(uid=jbravo)", scope "sub" (1) ldap: Waiting for search result... (1) ldap: User object found at DN "uid=jbravo,ou=Users,o=605d181e43609a22cde87434,dc=jumpcloud,dc=com" (1) ldap: Processing user attributes (1) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (1) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap.jumpcloud.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) [ldap] = ok (1) if ((ok || updated) && User-Password) { (1) if ((ok || updated) && User-Password) -> FALSE (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xf9bf494bf9be4d72 (1) eap: Finished EAP session with state 0xf9bf494bf9be4d72 (1) eap: Previous EAP request found for state 0xf9bf494bf9be4d72, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Initiating new EAP-TLS session (1) eap_peap: [eaptls start] = request (1) eap: Sending EAP Request (code 1) ID 2 length 6 (1) eap: EAP session adding &reply:State = 0xf9bf494bf8bd5072 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 114 from 10.92.8.117:1812 to 10.101.0.11:52709 length 0 (1) EAP-Message = 0x010200061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xf9bf494bf8bd50728434925772015f5c (1) Proxy-State = 0x3539 (1) Finished request Waking up in 4.8 seconds. (2) Received Access-Request Id 33 from 10.101.0.11:52709 to 10.92.8.117:1812 length 570 (2) Acct-Session-Id = "60AFFFDC-63EDA801" (2) User-Name = "jbravo" (2) NAS-IP-Address = 10.101.0.200 (2) NAS-Identifier = "34-FA-9F-1E-F3-9D" (2) NAS-Port = 1 (2) Called-Station-Id = "34-FA-9F-1E-F3-9D:Test-SSID" (2) Calling-Station-Id = "38-F9-D3-49-E4-A7" (2) Location-Data = 0x313055531708466c6578706f7274 (2) Location-Data = 0x323055531628373630204d61726b6574205374726565742c2053616e204672616e636973636f2c20434120555341 (2) Service-Type = Framed-User (2) Chargeable-User-Identity = 0x00 (2) NAS-Port-Type = Wireless-802.11 (2) Connect-Info = "CONNECT 802.11a/n" (2) EAP-Message = 0x020200a119800000009716030100920100008e030360afff874559f23a4fe2eb589086b11fcf6123898607062be507bf6fbec6637c00002c00ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000a01000039000a00080006001700180019000b00 (2) State = 0xf9bf494bf8bd50728434925772015f5c (2) Ruckus-SSID = "Test-SSID" (2) Ruckus-BSSID = 0x34fa9f1ef39d (2) Ruckus-Location = "Flexport" (2) Ruckus-VLAN-ID = 120 (2) Ruckus-SCG-CBlade-IP = 174391307 (2) Attr-26.25053.155 = 0x41646d696e697374726174696f6e20446f6d61696e (2) Ruckus-Zone-Name = "Default Zone" (2) Ruckus-Wlan-Name = "Test-SSID" (2) Message-Authenticator = 0x2b5e7aadb650ab3d487a3f6ef7362b16 (2) Event-Timestamp = "May 27 2021 20:23:57 UTC" (2) Proxy-State = 0x3630 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@ [^@]*@/ ) { (2) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 2 length 161 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xf9bf494bf8bd5072 (2) eap: Finished EAP session with state 0xf9bf494bf8bd5072 (2) eap: Previous EAP request found for state 0xf9bf494bf8bd5072, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 151 bytes (2) eap_peap: Got complete TLS record (151 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0092] (2) eap_peap: TLS_accept: SSLv3/TLS read client hello (2) eap_peap: >>> send TLS 1.2 [length 003d] (2) eap_peap: TLS_accept: SSLv3/TLS write server hello (2) eap_peap: >>> send TLS 1.2 [length 031d] (2) eap_peap: TLS_accept: SSLv3/TLS write certificate (2) eap_peap: >>> send TLS 1.2 [length 014d] (2) eap_peap: TLS_accept: SSLv3/TLS write key exchange (2) eap_peap: >>> send TLS 1.2 [length 0004] (2) eap_peap: TLS_accept: SSLv3/TLS write server done (2) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (2) eap_peap: In SSL Handshake Phase (2) eap_peap: In SSL Accept mode (2) eap_peap: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 3 length 1004 (2) eap: EAP session adding &reply:State = 0xf9bf494bfbbc5072 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 33 from 10.92.8.117:1812 to 10.101.0.11:52709 length 0 (2) EAP-Message = 0x010303ec19c0000004bf160303003d02000039030327db8c0f6ee41fab75087da76489fc2d9bfc89e57d2944216132b1eaf5ab1f3300c030000011ff01000100000b00040300010200170000160303031d0b0003190003160003133082030f308201f7a00302010202143ca230b5bc4180f9d6a6723cb5 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xf9bf494bfbbc50728434925772015f5c (2) Proxy-State = 0x3630 (2) Finished request Waking up in 4.7 seconds. (3) Received Access-Request Id 22 from 10.101.0.11:52709 to 10.92.8.117:1812 length 415 (3) Acct-Session-Id = "60AFFFDC-63EDA801" (3) User-Name = "jbravo" (3) NAS-IP-Address = 10.101.0.200 (3) NAS-Identifier = "34-FA-9F-1E-F3-9D" (3) NAS-Port = 1 (3) Called-Station-Id = "34-FA-9F-1E-F3-9D:Test-SSID" (3) Calling-Station-Id = "38-F9-D3-49-E4-A7" (3) Location-Data = 0x313055531708466c6578706f7274 (3) Location-Data = 0x323055531628373630204d61726b6574205374726565742c2053616e204672616e636973636f2c20434120555341 (3) Service-Type = Framed-User (3) Chargeable-User-Identity = 0x00 (3) NAS-Port-Type = Wireless-802.11 (3) Connect-Info = "CONNECT 802.11a/n" (3) EAP-Message = 0x020300061900 (3) State = 0xf9bf494bfbbc50728434925772015f5c (3) Ruckus-SSID = "Test-SSID" (3) Ruckus-BSSID = 0x34fa9f1ef39d (3) Ruckus-Location = "Flexport" (3) Ruckus-VLAN-ID = 120 (3) Ruckus-SCG-CBlade-IP = 174391307 (3) Attr-26.25053.155 = 0x41646d696e697374726174696f6e20446f6d61696e (3) Ruckus-Zone-Name = "Default Zone" (3) Ruckus-Wlan-Name = "Test-SSID" (3) Message-Authenticator = 0x29446b16c3fd7c269aebcd968068c141 (3) Event-Timestamp = "May 27 2021 20:23:57 UTC" (3) Proxy-State = 0x3631 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@ [^@]*@/ ) { (3) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 3 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0xf9bf494bfbbc5072 (3) eap: Finished EAP session with state 0xf9bf494bfbbc5072 (3) eap: Previous EAP request found for state 0xf9bf494bfbbc5072, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: Continuing EAP-TLS (3) eap_peap: Peer ACKed our handshake fragment (3) eap_peap: [eaptls verify] = request (3) eap_peap: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 4 length 227 (3) eap: EAP session adding &reply:State = 0xf9bf494bfabb5072 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 22 from 10.92.8.117:1812 to 10.101.0.11:52709 length 0 (3) EAP-Message = 0x010400e3190043108c5e37fc5173a1eab3da1681e33c5ff2e6723860364c7ab878f9d2a5fc2e330717fa22a1db4a165c52675c18f002510d1c2a94ec228a7ce43690e58a3caae2ff74351d68680fda9ea37abea83ce32323150c45010b6fa2deeca32c20684dc1e1f9544b8e24fc846d013832fada5f10 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xf9bf494bfabb50728434925772015f5c (3) Proxy-State = 0x3631 (3) Finished request Waking up in 4.6 seconds. (4) Received Access-Request Id 15 from 10.101.0.11:52709 to 10.92.8.117:1812 length 545 (4) Acct-Session-Id = "60AFFFDC-63EDA801" (4) User-Name = "jbravo" (4) NAS-IP-Address = 10.101.0.200 (4) NAS-Identifier = "34-FA-9F-1E-F3-9D" (4) NAS-Port = 1 (4) Called-Station-Id = "34-FA-9F-1E-F3-9D:Test-SSID" (4) Calling-Station-Id = "38-F9-D3-49-E4-A7" (4) Location-Data = 0x313055531708466c6578706f7274 (4) Location-Data = 0x323055531628373630204d61726b6574205374726565742c2053616e204672616e636973636f2c20434120555341 (4) Service-Type = Framed-User (4) Chargeable-User-Identity = 0x00 (4) NAS-Port-Type = Wireless-802.11 (4) Connect-Info = "CONNECT 802.11a/n" (4) EAP-Message = 0x0204008819800000007e16030300461000004241046adff3f70658dacfa5fb7077bfa6de6c4b8dfb03c7af28f644517b3cd892a3bc4bcf98ffab473240e01e0825efd4121a571286bfff3fa4c4533656d66ca6f59c1403030001011603030028fceea2d46915019fef16258537f3489befc01ab1f735a9 (4) State = 0xf9bf494bfabb50728434925772015f5c (4) Ruckus-SSID = "Test-SSID" (4) Ruckus-BSSID = 0x34fa9f1ef39d (4) Ruckus-Location = "Flexport" (4) Ruckus-VLAN-ID = 120 (4) Ruckus-SCG-CBlade-IP = 174391307 (4) Attr-26.25053.155 = 0x41646d696e697374726174696f6e20446f6d61696e (4) Ruckus-Zone-Name = "Default Zone" (4) Ruckus-Wlan-Name = "Test-SSID" (4) Message-Authenticator = 0x090fbde536e5b852dd9be889d43a8ae5 (4) Event-Timestamp = "May 27 2021 20:23:58 UTC" (4) Proxy-State = 0x3632 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@ [^@]*@/ ) { (4) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 4 length 136 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0xf9bf494bfabb5072 (4) eap: Finished EAP session with state 0xf9bf494bfabb5072 (4) eap: Previous EAP request found for state 0xf9bf494bfabb5072, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer indicated complete TLS record size will be 126 bytes (4) eap_peap: Got complete TLS record (126 bytes) (4) eap_peap: [eaptls verify] = length included (4) eap_peap: TLS_accept: SSLv3/TLS write server done (4) eap_peap: <<< recv TLS 1.2 [length 0046] (4) eap_peap: TLS_accept: SSLv3/TLS read client key exchange (4) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec (4) eap_peap: <<< recv TLS 1.2 [length 0010] (4) eap_peap: TLS_accept: SSLv3/TLS read finished (4) eap_peap: >>> send TLS 1.2 [length 0001] (4) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec (4) eap_peap: >>> send TLS 1.2 [length 0010] (4) eap_peap: TLS_accept: SSLv3/TLS write finished (4) eap_peap: (other): SSL negotiation finished successfully (4) eap_peap: SSL Connection Established (4) eap_peap: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 5 length 57 (4) eap: EAP session adding &reply:State = 0xf9bf494bfdba5072 (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 15 from 10.92.8.117:1812 to 10.101.0.11:52709 length 0 (4) EAP-Message = 0x010500391900140303000101160303002844d27775faa9562ee90f3dc59b42d509f8ba7db956978a9b8f06854def617762d2bd1315ee4f2fad (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xf9bf494bfdba50728434925772015f5c (4) Proxy-State = 0x3632 (4) Finished request Waking up in 4.4 seconds. (5) Received Access-Request Id 28 from 10.101.0.11:52709 to 10.92.8.117:1812 length 415 (5) Acct-Session-Id = "60AFFFDC-63EDA801" (5) User-Name = "jbravo" (5) NAS-IP-Address = 10.101.0.200 (5) NAS-Identifier = "34-FA-9F-1E-F3-9D" (5) NAS-Port = 1 (5) Called-Station-Id = "34-FA-9F-1E-F3-9D:Test-SSID" (5) Calling-Station-Id = "38-F9-D3-49-E4-A7" (5) Location-Data = 0x313055531708466c6578706f7274 (5) Location-Data = 0x323055531628373630204d61726b6574205374726565742c2053616e204672616e636973636f2c20434120555341 (5) Service-Type = Framed-User (5) Chargeable-User-Identity = 0x00 (5) NAS-Port-Type = Wireless-802.11 (5) Connect-Info = "CONNECT 802.11a/n" (5) EAP-Message = 0x020500061900 (5) State = 0xf9bf494bfdba50728434925772015f5c (5) Ruckus-SSID = "Test-SSID" (5) Ruckus-BSSID = 0x34fa9f1ef39d (5) Ruckus-Location = "Flexport" (5) Ruckus-VLAN-ID = 120 (5) Ruckus-SCG-CBlade-IP = 174391307 (5) Attr-26.25053.155 = 0x41646d696e697374726174696f6e20446f6d61696e (5) Ruckus-Zone-Name = "Default Zone" (5) Ruckus-Wlan-Name = "Test-SSID" (5) Message-Authenticator = 0x408947a0e4706e031992986fd472d3aa (5) Event-Timestamp = "May 27 2021 20:23:58 UTC" (5) Proxy-State = 0x3633 (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@ [^@]*@/ ) { (5) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 5 length 6 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0xf9bf494bfdba5072 (5) eap: Finished EAP session with state 0xf9bf494bfdba5072 (5) eap: Previous EAP request found for state 0xf9bf494bfdba5072, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer ACKed our handshake fragment. handshake is finished (5) eap_peap: [eaptls verify] = success (5) eap_peap: [eaptls process] = success (5) eap_peap: Session established. Decoding tunneled attributes (5) eap_peap: PEAP state TUNNEL ESTABLISHED (5) eap: Sending EAP Request (code 1) ID 6 length 40 (5) eap: EAP session adding &reply:State = 0xf9bf494bfcb95072 (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 28 from 10.92.8.117:1812 to 10.101.0.11:52709 length 0 (5) EAP-Message = 0x010600281900170303001d44d27775faa9562f860a214332a8b88cb56b78b1dc45b513fc809cd0de (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0xf9bf494bfcb950728434925772015f5c (5) Proxy-State = 0x3633 (5) Finished request Waking up in 4.3 seconds. (6) Received Access-Request Id 246 from 10.101.0.11:52709 to 10.92.8.117:1812 length 451 (6) Acct-Session-Id = "60AFFFDC-63EDA801" (6) User-Name = "jbravo" (6) NAS-IP-Address = 10.101.0.200 (6) NAS-Identifier = "34-FA-9F-1E-F3-9D" (6) NAS-Port = 1 (6) Called-Station-Id = "34-FA-9F-1E-F3-9D:Test-SSID" (6) Calling-Station-Id = "38-F9-D3-49-E4-A7" (6) Location-Data = 0x313055531708466c6578706f7274 (6) Location-Data = 0x323055531628373630204d61726b6574205374726565742c2053616e204672616e636973636f2c20434120555341 (6) Service-Type = Framed-User (6) Chargeable-User-Identity = 0x00 (6) NAS-Port-Type = Wireless-802.11 (6) Connect-Info = "CONNECT 802.11a/n" (6) EAP-Message = 0x0206002a1900170303001ffceea2d4691501a0215f206a094377d092a0b457d517ce021dabbf5a874639 (6) State = 0xf9bf494bfcb950728434925772015f5c (6) Ruckus-SSID = "Test-SSID" (6) Ruckus-BSSID = 0x34fa9f1ef39d (6) Ruckus-Location = "Flexport" (6) Ruckus-VLAN-ID = 120 (6) Ruckus-SCG-CBlade-IP = 174391307 (6) Attr-26.25053.155 = 0x41646d696e697374726174696f6e20446f6d61696e (6) Ruckus-Zone-Name = "Default Zone" (6) Ruckus-Wlan-Name = "Test-SSID" (6) Message-Authenticator = 0xc155f5983b76b93cd094c25343ba3cba (6) Event-Timestamp = "May 27 2021 20:23:58 UTC" (6) Proxy-State = 0x3634 (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@ [^@]*@/ ) { (6) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 6 length 42 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0xf9bf494bfcb95072 (6) eap: Finished EAP session with state 0xf9bf494bfcb95072 (6) eap: Previous EAP request found for state 0xf9bf494bfcb95072, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: [eaptls verify] = ok (6) eap_peap: Done initial handshake (6) eap_peap: [eaptls process] = ok (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state WAITING FOR INNER IDENTITY (6) eap_peap: Identity - jbravo (6) eap_peap: Got inner identity 'jbravo' (6) eap_peap: Setting default EAP type for tunneled EAP session (6) eap_peap: Got tunneled request (6) eap_peap: EAP-Message = 0x0206000b016a627261766f (6) eap_peap: Setting User-Name to jbravo (6) eap_peap: Sending tunneled request to inner-tunnel (6) eap_peap: EAP-Message = 0x0206000b016a627261766f (6) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (6) eap_peap: User-Name = "jbravo" (6) Virtual server inner-tunnel received request (6) EAP-Message = 0x0206000b016a627261766f (6) FreeRADIUS-Proxied-To = 127.0.0.1 (6) User-Name = "jbravo" (6) WARNING: Outer and inner identities are the same. User privacy is compromised. (6) server inner-tunnel { (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@ [^@]*@/ ) { (6) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [chap] = noop (6) [mschap] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) update control { (6) &Proxy-To-Realm := LOCAL (6) } # update control = noop (6) eap: Peer sent EAP Response (code 2) ID 6 length 11 (6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) authenticate { (6) eap: Peer sent packet with method EAP Identity (1) (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: Issuing Challenge (6) eap: Sending EAP Request (code 1) ID 7 length 43 (6) eap: EAP session adding &reply:State = 0x5142877d51459d3b (6) [eap] = handled (6) } # authenticate = handled (6) } # server inner-tunnel (6) Virtual server sending reply (6) EAP-Message = 0x0107002b1a010700261064a3e73203b60a5e6a284e0cae57c6ff667265657261646975732d332e302e3136 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x5142877d51459d3bd1da68a4da6421df (6) eap_peap: Got tunneled reply code 11 (6) eap_peap: EAP-Message = 0x0107002b1a010700261064a3e73203b60a5e6a284e0cae57c6ff667265657261646975732d332e302e3136 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0x5142877d51459d3bd1da68a4da6421df (6) eap_peap: Got tunneled reply RADIUS code 11 (6) eap_peap: EAP-Message = 0x0107002b1a010700261064a3e73203b60a5e6a284e0cae57c6ff667265657261646975732d332e302e3136 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0x5142877d51459d3bd1da68a4da6421df (6) eap_peap: Got tunneled Access-Challenge (6) eap: Sending EAP Request (code 1) ID 7 length 74 (6) eap: EAP session adding &reply:State = 0xf9bf494bffb85072 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) Sent Access-Challenge Id 246 from 10.92.8.117:1812 to 10.101.0.11:52709 length 0 (6) EAP-Message = 0x0107004a1900170303003f44d27775faa9563083be65c4a5fe6097f85bcc0bb900708c0b5715ce1728ce226d72b48d9e3fde97c1450e68cc03bf2bdd15662a74350183c4ee4d9b973751 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0xf9bf494bffb850728434925772015f5c (6) Proxy-State = 0x3634 (6) Finished request Waking up in 4.2 seconds. (7) Received Access-Request Id 13 from 10.101.0.11:52709 to 10.92.8.117:1812 length 505 (7) Acct-Session-Id = "60AFFFDC-63EDA801" (7) User-Name = "jbravo" (7) NAS-IP-Address = 10.101.0.200 (7) NAS-Identifier = "34-FA-9F-1E-F3-9D" (7) NAS-Port = 1 (7) Called-Station-Id = "34-FA-9F-1E-F3-9D:Test-SSID" (7) Calling-Station-Id = "38-F9-D3-49-E4-A7" (7) Location-Data = 0x313055531708466c6578706f7274 (7) Location-Data = 0x323055531628373630204d61726b6574205374726565742c2053616e204672616e636973636f2c20434120555341 (7) Service-Type = Framed-User (7) Chargeable-User-Identity = 0x00 (7) NAS-Port-Type = Wireless-802.11 (7) Connect-Info = "CONNECT 802.11a/n" (7) EAP-Message = 0x0207006019001703030055fceea2d4691501a1420d27eba2857973934506cbf68a3331771c94b497d83ed6cac928f0c4c6d96c101904ac2006409f84425776da4f7490a56477ced0121f87f5deccdafbbfd831f8a4158de7e5b929aa65fce0ff (7) State = 0xf9bf494bffb850728434925772015f5c (7) Ruckus-SSID = "Test-SSID" (7) Ruckus-BSSID = 0x34fa9f1ef39d (7) Ruckus-Location = "Flexport" (7) Ruckus-VLAN-ID = 120 (7) Ruckus-SCG-CBlade-IP = 174391307 (7) Attr-26.25053.155 = 0x41646d696e697374726174696f6e20446f6d61696e (7) Ruckus-Zone-Name = "Default Zone" (7) Ruckus-Wlan-Name = "Test-SSID" (7) Message-Authenticator = 0x381e04b0e75ba71bc96bf8ff666637f9 (7) Event-Timestamp = "May 27 2021 20:23:58 UTC" (7) Proxy-State = 0x3635 (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@ [^@]*@/ ) { (7) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) eap: Peer sent EAP Response (code 2) ID 7 length 96 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x5142877d51459d3b (7) eap: Finished EAP session with state 0xf9bf494bffb85072 (7) eap: Previous EAP request found for state 0xf9bf494bffb85072, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state phase2 (7) eap_peap: EAP method MSCHAPv2 (26) (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x020700411a0207003c31bc81337089bbc2b31b3a7539bb08f38b0000000000000000bbeaf4504cbbfdc66d26cdd91abada9c56c5dc800abb1c62006a627261766f (7) eap_peap: Setting User-Name to jbravo (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x020700411a0207003c31bc81337089bbc2b31b3a7539bb08f38b0000000000000000bbeaf4504cbbfdc66d26cdd91abada9c56c5dc800abb1c62006a627261766f (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "jbravo" (7) eap_peap: State = 0x5142877d51459d3bd1da68a4da6421df (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x020700411a0207003c31bc81337089bbc2b31b3a7539bb08f38b0000000000000000bbeaf4504cbbfdc66d26cdd91abada9c56c5dc800abb1c62006a627261766f (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "jbravo" (7) State = 0x5142877d51459d3bd1da68a4da6421df (7) WARNING: Outer and inner identities are the same. User privacy is compromised. (7) server inner-tunnel { (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@ [^@]*@/ ) { (7) if (&User-Name =~ /@ [^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [chap] = noop (7) [mschap] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "jbravo", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) update control { (7) &Proxy-To-Realm := LOCAL (7) } # update control = noop (7) eap: Peer sent EAP Response (code 2) ID 7 length 65 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [files] = noop rlm_ldap (ldap): Reserved connection (1) (7) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (7) ldap: --> (uid=jbravo) (7) ldap: Performing search in "o=605d181e43609a22cde87434,dc=jumpcloud,dc=com" with filter "(uid=jbravo)", scope "sub" (7) ldap: Waiting for search result... (7) ldap: User object found at DN "uid=jbravo,ou=Users,o=605d181e43609a22cde87434,dc=jumpcloud,dc=com" (7) ldap: Processing user attributes (7) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (7) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (1) Need 4 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap.jumpcloud.com:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (7) [ldap] = ok (7) if ((ok || updated) && User-Password) { (7) if ((ok || updated) && User-Password) -> FALSE (7) [expiration] = noop (7) [logintime] = noop (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authenticate { (7) eap: Expiring EAP session with state 0x5142877d51459d3b (7) eap: Finished EAP session with state 0x5142877d51459d3b (7) eap: Previous EAP request found for state 0x5142877d51459d3b, released from the list (7) eap: Peer sent packet with method EAP MSCHAPv2 (26) (7) eap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) eap_mschapv2: authenticate { (7) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (7) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (7) mschap: Creating challenge hash with username: jbravo (7) mschap: Client is using MS-CHAPv2 (7) mschap: ERROR: FAILED: No NT/LM-Password. Cannot perform authentication (7) mschap: ERROR: MS-CHAP2-Response is incorrect (7) [mschap] = reject (7) } # authenticate = reject (7) eap: Sending EAP Failure (code 4) ID 7 length 4 (7) eap: Freeing handler (7) [eap] = reject (7) } # authenticate = reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject: EXPAND %{User-Name} (7) attr_filter.access_reject: --> jbravo (7) attr_filter.access_reject: Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) update outer.session-state { (7) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: FAILED: No NT/LM-Password. Cannot perform authentication' (7) } # update outer.session-state = noop (7) } # Post-Auth-Type REJECT = updated (7) } # server inner-tunnel (7) Virtual server sending reply (7) MS-CHAP-Error = "\007E=691 R=1 C=d9508c1d006920be86d71572e179b79d V=3 M=Authentication rejected" (7) EAP-Message = 0x04070004 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: Got tunneled reply code 3 (7) eap_peap: MS-CHAP-Error = "\007E=691 R=1 C=d9508c1d006920be86d71572e179b79d V=3 M=Authentication rejected" (7) eap_peap: EAP-Message = 0x04070004 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: Got tunneled reply RADIUS code 3 (7) eap_peap: MS-CHAP-Error = "\007E=691 R=1 C=d9508c1d006920be86d71572e179b79d V=3 M=Authentication rejected" (7) eap_peap: EAP-Message = 0x04070004 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: Tunneled authentication was rejected (7) eap_peap: FAILURE (7) eap: Sending EAP Request (code 1) ID 8 length 46 (7) eap: EAP session adding &reply:State = 0xf9bf494bfeb75072 (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) Challenge { ... } # empty sub-section is ignored (7) session-state: Saving cached attributes (7) Module-Failure-Message := "mschap: FAILED: No NT/LM-Password. Cannot perform authentication" (7) Sent Access-Challenge Id 13 from 10.92.8.117:1812 to 10.101.0.11:52709 length 0 (7) EAP-Message = 0x0108002e1900170303002344d27775faa956313f2966d9d96073e4fcd307c85f8a982c8da2272f49b17679a2f207 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0xf9bf494bfeb750728434925772015f5c (7) Proxy-State = 0x3635 (7) Finished request Waking up in 4.1 seconds. ([image: 😎] Received Access-Request Id 230 from 10.101.0.11:52709 to 10.92.8.117:1812 length 455 ([image: 😎] Acct-Session-Id = "60AFFFDC-63EDA801" ([image: 😎] User-Name = "jbravo" ([image: 😎] NAS-IP-Address = 10.101.0.200 ([image: 😎] NAS-Identifier = "34-FA-9F-1E-F3-9D" ([image: 😎] NAS-Port = 1 ([image: 😎] Called-Station-Id = "34-FA-9F-1E-F3-9D:Test-SSID" ([image: 😎] Calling-Station-Id = "38-F9-D3-49-E4-A7" ([image: 😎] Location-Data = 0x313055531708466c6578706f7274 ([image: 😎] Location-Data = 0x323055531628373630204d61726b6574205374726565742c2053616e204672616e636973636f2c20434120555341 ([image: 😎] Service-Type = Framed-User ([image: 😎] Chargeable-User-Identity = 0x00 ([image: 😎] NAS-Port-Type = Wireless-802.11 ([image: 😎] Connect-Info = "CONNECT 802.11a/n" ([image: 😎] EAP-Message = 0x0208002e19001703030023fceea2d4691501a20ff900ac9ad31d7825db7d504078b003ff3b13dd143cfbfc596087 ([image: 😎] State = 0xf9bf494bfeb750728434925772015f5c ([image: 😎] Ruckus-SSID = "Test-SSID" ([image: 😎] Ruckus-BSSID = 0x34fa9f1ef39d ([image: 😎] Ruckus-Location = "Flexport" ([image: 😎] Ruckus-VLAN-ID = 120 ([image: 😎] Ruckus-SCG-CBlade-IP = 174391307 ([image: 😎] Attr-26.25053.155 = 0x41646d696e697374726174696f6e20446f6d61696e ([image: 😎] Ruckus-Zone-Name = "Default Zone" ([image: 😎] Ruckus-Wlan-Name = "Test-SSID" ([image: 😎] Message-Authenticator = 0x8c8011a8a3ff2640ac0c0dc915695f42 ([image: 😎] Event-Timestamp = "May 27 2021 20:23:58 UTC" ([image: 😎] Proxy-State = 0x3636 ([image: 😎] Restoring &session-state ([image: 😎] &session-state:Module-Failure-Message := "mschap: FAILED: No NT/LM-Password. Cannot perform authentication" ([image: 😎] # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default ([image: 😎] authorize { ([image: 😎] policy filter_username { ([image: 😎] if (&User-Name) { ([image: 😎] if (&User-Name) -> TRUE ([image: 😎] if (&User-Name) { ([image: 😎] if (&User-Name =~ / /) { ([image: 😎] if (&User-Name =~ / /) -> FALSE ([image: 😎] if (&User-Name =~ /@ [^@]*@/ ) { ([image: 😎] if (&User-Name =~ /@ [^@]*@/ ) -> FALSE ([image: 😎] if (&User-Name =~ /\.\./ ) { ([image: 😎] if (&User-Name =~ /\.\./ ) -> FALSE ([image: 😎] if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { ([image: 😎] if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE ([image: 😎] if (&User-Name =~ /\.$/) { ([image: 😎] if (&User-Name =~ /\.$/) -> FALSE ([image: 😎] if (&User-Name =~ /(a)\./) { ([image: 😎] if (&User-Name =~ /(a)\./) -> FALSE ([image: 😎] } # if (&User-Name) = notfound ([image: 😎] } # policy filter_username = notfound ([image: 😎] [preprocess] = ok ([image: 😎] [chap] = noop ([image: 😎] [mschap] = noop ([image: 😎] [digest] = noop ([image: 😎] suffix: Checking for suffix after "@" ([image: 😎] suffix: No '@' in User-Name = "jbravo", looking up realm NULL ([image: 😎] suffix: No such realm "NULL" ([image: 😎] [suffix] = noop ([image: 😎] eap: Peer sent EAP Response (code 2) ID 8 length 46 ([image: 😎] eap: Continuing tunnel setup ([image: 😎] [eap] = ok ([image: 😎] } # authorize = ok ([image: 😎] Found Auth-Type = eap ([image: 😎] # Executing group from file /etc/freeradius/3.0/sites-enabled/default ([image: 😎] authenticate { ([image: 😎] eap: Expiring EAP session with state 0xf9bf494bfeb75072 ([image: 😎] eap: Finished EAP session with state 0xf9bf494bfeb75072 ([image: 😎] eap: Previous EAP request found for state 0xf9bf494bfeb75072, released from the list ([image: 😎] eap: Peer sent packet with method EAP PEAP (25) ([image: 😎] eap: Calling submodule eap_peap to process data ([image: 😎] eap_peap: Continuing EAP-TLS ([image: 😎] eap_peap: [eaptls verify] = ok ([image: 😎] eap_peap: Done initial handshake ([image: 😎] eap_peap: [eaptls process] = ok ([image: 😎] eap_peap: Session established. Decoding tunneled attributes ([image: 😎] eap_peap: PEAP state send tlv failure ([image: 😎] eap_peap: Received EAP-TLV response ([image: 😎] eap_peap: ERROR: The users session was previously rejected: returning reject (again.) ([image: 😎] eap_peap: This means you need to read the PREVIOUS messages in the debug output ([image: 😎] eap_peap: to find out the reason why the user was rejected ([image: 😎] eap_peap: Look for "reject" or "fail". Those earlier messages will tell you ([image: 😎] eap_peap: what went wrong, and how to fix the problem ([image: 😎] eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed ([image: 😎] eap: Sending EAP Failure (code 4) ID 8 length 4 ([image: 😎] eap: Failed in EAP select ([image: 😎] [eap] = invalid ([image: 😎] } # authenticate = invalid ([image: 😎] Failed to authenticate the user ([image: 😎] Using Post-Auth-Type Reject ([image: 😎] # Executing group from file /etc/freeradius/3.0/sites-enabled/default ([image: 😎] Post-Auth-Type REJECT { ([image: 😎] attr_filter.access_reject: EXPAND %{User-Name} ([image: 😎] attr_filter.access_reject: --> jbravo ([image: 😎] attr_filter.access_reject: Matched entry DEFAULT at line 11 ([image: 😎] [attr_filter.access_reject] = updated ([image: 😎] [eap] = noop ([image: 😎] policy remove_reply_message_if_eap { ([image: 😎] if (&reply:EAP-Message && &reply:Reply-Message) { ([image: 😎] if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE ([image: 😎] else { ([image: 😎] [noop] = noop ([image: 😎] } # else = noop ([image: 😎] } # policy remove_reply_message_if_eap = noop ([image: 😎] } # Post-Auth-Type REJECT = updated ([image: 😎] Delaying response for 1.000000 seconds

1 0

Check local before LDAP Authentication
by Matteo Raffa 28 May '21

28 May '21

I’ve found some old posts about this on the mailing list, but all of those were 10+ years old and using v1 or v2. Further to that, I am using LDAP for authentication (Google doesn’t send passwords). So, in my authorize {} I have set this before pap to set the proper auth method: if (User-Password) { update control { Auth-Type := ldap } } Now I believe that I should just need to add another condition to check for files module returning notfound code, so that it only sets ldap in case the user is not found in files, otherwise it will just go on to pap. Something like if (User-Password && files == notfound) {...} But I can’t find the correct way to do this check. What is the attribute name corresponding to “files module return code” that I should check? I checked man unlang for that, but it only says that I can check for a module return code just after its execution. It doesn’t tell anything about a variable storing each module’s return code. Thanks!

5 7

ARTICLE: FreeRADIUS is your new DHCP server (if you want)
by marketing＠networkradius.com 28 May '21

28 May '21

** FreeRADIUS: a high performance and flexible DHCP server --------------------------------------------- We are happy to announce that FreeRADIUS 3 is now fully compliant with the base DHCP standards. Previous versions supported the base DORA exchange, but lacked some features such as Decline packets. With greater flexibility and performance that is as fast or faster than the ISC DHCP server, FreeRADIUS is now a compelling option if you find yourself limited by your current implementation. For the last twenty years, FreeRADIUS has been known as the world’s leading open source RADIUS server. At Network RADIUS, we have a long history of leading the maintenance and development of FreeRADIUS. During that time, FreeRADIUS has been focused on the RADIUS standards, with other protocols being a secondary consideration. One of the other protocols it has supported for over a decade is DHCP. We decided that it was time to take a closer look at the DHCP implementation. Our goal was to evaluate its stability and performance, to meet or exceed industry standards, to make adjustments where necessary, and to beef up support for edge cases in the protocol. The results of our work are included in FreeRADIUS 3.0.22 which is available now. Read the full article… https://networkradius.com/articles/2021/05/20/does-freeRADIUS-support-DHCP.… ** Sign up to get this content directly --------------------------------------------- Want to get these articles in all their HTML glory? Sign up here: http://eepurl.com/hwuWrn ** Need RADIUS help? --------------------------------------------- Get commercial support from the team behind FreeRADIUS. https://networkradius.com/contact/ ** What is the relationship between Network RADIUS and FreeRADIUS? ---------------------------------------------- FreeRADIUS is an open source implementation of the RADIUS protocol and was written by Alan DeKok in 1999. Network RADIUS is a private, for-profit company founded by Alan DeKok which provides commercial support for FreeRADIUS. The Network RADIUS team has been the primary contributor to FreeRADIUS for the last 20 years. The FreeRADIUS mailing list, wiki, and documentation are all moderated and maintained by the Network RADIUS team. FreeRADIUS has always been, and will always continue to be, open source. The Network RADIUS team provides commercial support to paying clients, and free product development for the FreeRADIUS community at large. All of our software development for FreeRADIUS is integrated into the Open Source platform, and will always continue to be.

1 0

eduroam howto log failure mschapv2
by Francesco Malvezzi 28 May '21

28 May '21

I have been using a freeradius following the guides at: https://wiki.freeradius.org/guide/eduroam and https://wiki.freeradius.org/guide/eduroam-logging since quite some time, without a glitch. Sometimes we are missing the logs of failed attempts in particular in the wrong password case. We suppose that some clients prompt users to re-insert password a few times after password failure: if the user gives up and interrupts the flow, nothing is logged on the server side. We can quite simulate this issue if we modify the test script at: https://wiki.freeradius.org/guide/eduroam#testing_test-files_eapol_test-pea… and replace the line: phase2="auth=MSCHAPV2 mschapv2_retry=0" with: phase2="auth=MSCHAPV2" If you try the modified test script with a wrong password the failure is not logged. Can you help me to make the help desk happy by collecting also those logs? Can you suggest me a strategy? Do I need to log the connect packet (does it include the username?)? Is it possible to get failure log from mschap? Can you share details? Thank you, Francesco

3 2

Pass attributes from inner-tunnel to outer Access-Accept reply
by Matteo Raffa 28 May '21

28 May '21

Hello, I have set up EAP-TTLS with authentication against Google Secure LDAP. I am now trying to pass LDAP attributes together with other attributes in Access-Accept reply back to the NAS. Specifically, I have set Tunnel-Private-Group-ID on LDAP for each user, so I need to pass this together with Tunnel-Type := 13 and Tunnel-Medium-Type := 6. I am able to get Tunnel-Private-Group-ID from LDAP and to assign it to inner-tunnel reply in ldap: update { control:Password-With-Header += 'userPassword' # control:NT-Password := 'ntPassword' # reply:Reply-Message := 'radiusReplyMessage' # reply:Tunnel-Type := 'radiusTunnelType' # reply:Tunnel-Medium-Type := 'radiusTunnelMediumType' # reply:Tunnel-Private-Group-ID := 'radiusTunnelPrivategroupId' reply:Tunnel-Private-Group-ID := 'vlan-id-colverde' # Where only a list is specified as the RADIUS attribute, # the value of the LDAP attribute is parsed as a valuepair # in the same format as the 'valuepair_attribute' (above). control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } So, when testing inner tunnel with this setting (radtest username userpass 127.0.0.1:18120 0 testing123), authentication works (see first debug log attached) At this point I went in inner-tunnel in post-auth and tried to have the above mentioned attributes passed to outer reply # # Instead of "use_tunneled_reply", change this "if (0)" to an # "if (1)". # if (1) { # # These attributes are for the inner-tunnel only, # and MUST NOT be copied to the outer reply. # update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY Tunnel-Type := 13 Tunnel-Medium-Type := 6 Tunnel-Private-Group-ID := &reply:Tunnel-Private-Group-ID } # # Copy the inner reply attributes to the outer # session-state list. The post-auth policy will take # care of copying the outer session-state list to the # outer reply. # update { &outer.session-state: += &reply: } } And that’s where I start to get errors (see the second debug log). The update outer session-state block returns this error: ERROR: Mapping "&reply:" -> "&outer.session-state:" invalid in this context I tried to sort that out and did various tests for the past day, but I really couldn’t understand what that is due to. I get the same error even if I remove the attribute assignment from ldap module and keep the default in update reply block in inner tunnel (so without the Tunnel-* stuff I added), so I can’t really understand where it comes from. It seems that the problem only arise when the reply gets copied to the outer session-state, in fact, if I comment that update block out, the inner-tunnel reply is correctly built and sent with Access-Accept (See third debug log). Can you point me in the right direction? Many thanks —FIRST DEBUG LOG FOR INNER-TUNNEL WITHOUT ATTRIBUTES— FreeRADIUS Version 3.0.22 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/ldap including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/rfc7542 including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm DOMAIN.EXT { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client user_defined_clients { ipaddr = 172.17.0.0/16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debug state unknown (cap_sys_ptrace capability not set) systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = LDAP # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap ldap { server = "ldaps://ldap.google.com" port = 636 identity = “IDENTITY" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = “dc=DOMAIN,dc=EXT" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { certificate_file = "/etc/freeradius/certs/ldap-client.crt" private_key_file = "/etc/freeradius/certs/ldap-client.key" start_tls = no require_cert = "allow" } } Creating attribute LDAP-Group instantiate { } # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/coa # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "gtc" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20445 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type Compiling Auth-Type LDAP for attr Auth-Type # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type } # server default server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type Compiling Auth-Type LDAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:353 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 127.0.0.1 client user_defined_clients { ipaddr = 172.17.0.0/16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 172.17.0.0 client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client ::1 } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 37289 Listening on proxy address :: port 41236 Ready to process requests (0) Received Access-Request Id 4 from 127.0.0.1:41917 to 127.0.0.1:18120 length 82 (0) User-Name = “username" (0) User-Password = “userpass" (0) NAS-IP-Address = 172.17.0.2 (0) NAS-Port = 0 (0) Message-Authenticator = 0x9031f009a212bcfceb3d342e3bbe592d (0) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = “username", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) update control { (0) &Proxy-To-Realm := LOCAL (0) } # update control = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=username) (0) ldap: Performing search in “dc=DOMAIN,dc=EXT" with filter "(uid=username)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=username,ou=OU,ou=OU,ou=OU,dc=DOMAIN,dc=EXT" (0) ldap: Processing user attributes (0) ldap: reply:Tunnel-Private-Group-ID := '10' (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = updated (0) [expiration] = noop (0) [logintime] = noop (0) if (User-Password) { (0) if (User-Password) -> TRUE (0) if (User-Password) { (0) update control { (0) Auth-Type := LDAP (0) } # update control = noop (0) } # if (User-Password) = noop (0) [pap] = noop (0) } # authorize = updated (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (0) Auth-Type LDAP { rlm_ldap (ldap): Reserved connection (1) (0) ldap: Login attempt by "username" (0) ldap: Using user DN from request "uid=username,ou=OU,ou=OU,ou=OU,dc=DOMAIN,dc=EXT" (0) ldap: Waiting for bind result... (0) ldap: Bind successful (0) ldap: Bind as user "uid=username,ou=OU,ou=OU,ou=OU,dc=DOMAIN,dc=EXT" was successful rlm_ldap (ldap): Released connection (1) Need 4 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (0) post-auth { (0) if (0) { (0) if (0) -> FALSE (0) } # post-auth = noop (0) Sent Access-Accept Id 4 from 127.0.0.1:18120 to 127.0.0.1:41917 length 0 (0) Tunnel-Private-Group-Id := "10" (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 4 with timestamp +0 Ready to process requests —SECOND DEBUG LOG FOR INNER-TUNNEL WITH ATTRIBUTES TO BE SENT IN OUTER REPLY— FreeRADIUS Version 3.0.22 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/ldap including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/rfc7542 including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm DOMAIN.EXT { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client user_defined_clients { ipaddr = 172.17.0.0/16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debug state unknown (cap_sys_ptrace capability not set) systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = LDAP # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap ldap { server = "ldaps://ldap.google.com" port = 636 identity = “IDENTITY" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = “dc=DOMAIN,dc=EXT" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { certificate_file = "/etc/freeradius/certs/ldap-client.crt" private_key_file = "/etc/freeradius/certs/ldap-client.key" start_tls = no require_cert = "allow" } } Creating attribute LDAP-Group instantiate { } # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/coa # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "gtc" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20445 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type Compiling Auth-Type LDAP for attr Auth-Type # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type } # server default server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type Compiling Auth-Type LDAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 127.0.0.1 client user_defined_clients { ipaddr = 172.17.0.0/16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 172.17.0.0 client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client ::1 } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 35770 Listening on proxy address :: port 38092 Ready to process requests (0) Received Access-Request Id 177 from 127.0.0.1:50596 to 127.0.0.1:18120 length 82 (0) User-Name = "username" (0) User-Password = “userpass" (0) NAS-IP-Address = 172.17.0.2 (0) NAS-Port = 0 (0) Message-Authenticator = 0x400747564d18d6c97c64443a0305daad (0) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "username", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) update control { (0) &Proxy-To-Realm := LOCAL (0) } # update control = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=username) (0) ldap: Performing search in “dc=DOMAIN,dc=EXT" with filter "(uid=username)", scope "sub" (0) ldap: Waiting for search result... rlm_ldap (ldap): Reconnecting (0) rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) ldap: WARNING: Search failed: Timed out while waiting for server to respond. Got new socket, retrying... (0) ldap: Waiting for search result... (0) ldap: User object found at DN “uid=username,ou=OU,ou=OU,ou=OU,dc=DOMAIN,dc=EXT" (0) ldap: Processing user attributes (0) ldap: reply:Tunnel-Private-Group-ID := '10' (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = updated (0) [expiration] = noop (0) [logintime] = noop (0) if (User-Password) { (0) if (User-Password) -> TRUE (0) if (User-Password) { (0) update control { (0) Auth-Type := LDAP (0) } # update control = noop (0) } # if (User-Password) = noop (0) [pap] = noop (0) } # authorize = updated (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (0) Auth-Type LDAP { rlm_ldap (ldap): Reserved connection (1) (0) ldap: Login attempt by "username" (0) ldap: Using user DN from request “uid=username,ou=OU,ou=OU,ou=OU,dc=DOMAIN,dc=EXT" (0) ldap: Waiting for bind result... (0) ldap: Bind successful (0) ldap: Bind as user “uid=username,ou=OU,ou=OU,ou=OU,dc=DOMAIN,dc=EXT" rlm_ldap (ldap): Released connection (1) Need 4 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (0) post-auth { (0) if (1) { (0) if (1) -> TRUE (0) if (1) { (0) update reply { (0) User-Name !* ANY (0) Message-Authenticator !* ANY (0) EAP-Message !* ANY (0) Proxy-State !* ANY (0) MS-MPPE-Encryption-Types !* ANY (0) MS-MPPE-Encryption-Policy !* ANY (0) MS-MPPE-Send-Key !* ANY (0) MS-MPPE-Recv-Key !* ANY (0) Tunnel-Type := VLAN (0) Tunnel-Medium-Type := IEEE-802 (0) Tunnel-Private-Group-ID := &reply:Tunnel-Private-Group-ID -> '10' (0) } # update reply = noop (0) update { (0) ERROR: Mapping "&reply:" -> "&outer.session-state:" invalid in this context (0) } # update = invalid (0) } # if (1) = invalid (0) } # post-auth = invalid (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> username (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) update outer.session-state { (0) ERROR: Mapping "&request:Module-Failure-Message" -> "&Module-Failure-Message" invalid in this context (0) } # update outer.session-state = invalid (0) } # Post-Auth-Type REJECT = invalid (0) Delaying response for 1.000000 seconds (0) (0) Discarding duplicate request from client localhost port 50596 - ID: 177 due to delayed response Waking up in 0.9 seconds. (0) (0) Discarding duplicate request from client localhost port 50596 - ID: 177 due to delayed response Waking up in 0.9 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 177 from 127.0.0.1:18120 to 127.0.0.1:50596 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 177 with timestamp +18 Ready to process requests —THIRD DEBUG LOG FOR INNER-TUNNEL WITH ATTRIBUTES ONLY IN INNER REPLY— FreeRADIUS Version 3.0.22 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/ldap including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/rfc7542 including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm DOMAIN.EXT { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client user_defined_clients { ipaddr = 172.17.0.0/16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debug state unknown (cap_sys_ptrace capability not set) systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = LDAP # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap ldap { server = "ldaps://ldap.google.com" port = 636 identity = "IDENTITY" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=DOMAIN,dc=EXT" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { certificate_file = "/etc/freeradius/certs/ldap-client.crt" private_key_file = "/etc/freeradius/certs/ldap-client.key" start_tls = no require_cert = "allow" } } Creating attribute LDAP-Group instantiate { } # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/coa # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "gtc" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20445 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type Compiling Auth-Type LDAP for attr Auth-Type # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type } # server default server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type Compiling Auth-Type LDAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 127.0.0.1 client user_defined_clients { ipaddr = 172.17.0.0/16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 172.17.0.0 client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client ::1 } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 37923 Listening on proxy address :: port 49414 Ready to process requests (0) Received Access-Request Id 209 from 127.0.0.1:59797 to 127.0.0.1:18120 length 82 (0) User-Name = "username" (0) User-Password = “userpass" (0) NAS-IP-Address = 172.17.0.2 (0) NAS-Port = 0 (0) Message-Authenticator = 0xf92f8d50a2ccb53c57eebd5a6ce0d4f6 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [chap] = noop (0) [mschap] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "username", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) update control { (0) &Proxy-To-Realm := LOCAL (0) } # update control = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop rlm_ldap (ldap): Reserved connection (0) (0) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (0) ldap: --> (uid=username) (0) ldap: Performing search in "dc=DOMAIN,dc=EXT" with filter "(uid=username)", scope "sub" (0) ldap: Waiting for search result... (0) ldap: User object found at DN "uid=username,ou=OU,ou=OU,ou=OU,dc=DOMAIN,dc=EXT" (0) ldap: Processing user attributes (0) ldap: reply:Tunnel-Private-Group-ID := '10' (0) ldap: WARNING: No "known good" password added. Ensure the admin user has permission to read the password attribute (0) ldap: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Released connection (0) Need 5 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = updated (0) [expiration] = noop (0) [logintime] = noop (0) if (User-Password) { (0) if (User-Password) -> TRUE (0) if (User-Password) { (0) update control { (0) Auth-Type := LDAP (0) } # update control = noop (0) } # if (User-Password) = noop (0) [pap] = noop (0) } # authorize = updated (0) Found Auth-Type = LDAP (0) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (0) Auth-Type LDAP { rlm_ldap (ldap): Reserved connection (1) (0) ldap: Login attempt by "username" (0) ldap: Using user DN from request "uid=username,ou=OU,ou=OU,ou=OU,dc=DOMAIN,dc=EXT" (0) ldap: Waiting for bind result... (0) ldap: Bind successful (0) ldap: Bind as user “uid=username,ou=OU,ou=OU,ou=OU,dc=DOMAIN,dc=EXT" was successful rlm_ldap (ldap): Released connection (1) Need 4 more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (6), 1 of 26 pending slots used rlm_ldap (ldap): Connecting to ldaps://ldap.google.com:636 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (0) [ldap] = ok (0) } # Auth-Type LDAP = ok (0) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (0) post-auth { (0) if (1) { (0) if (1) -> TRUE (0) if (1) { (0) update reply { (0) User-Name !* ANY (0) Message-Authenticator !* ANY (0) EAP-Message !* ANY (0) Proxy-State !* ANY (0) MS-MPPE-Encryption-Types !* ANY (0) MS-MPPE-Encryption-Policy !* ANY (0) MS-MPPE-Send-Key !* ANY (0) MS-MPPE-Recv-Key !* ANY (0) Tunnel-Type := VLAN (0) Tunnel-Medium-Type := IEEE-802 (0) Tunnel-Private-Group-ID := &reply:Tunnel-Private-Group-ID -> '10' (0) } # update reply = noop (0) } # if (1) = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 209 from 127.0.0.1:18120 to 127.0.0.1:59797 length 0 (0) Tunnel-Private-Group-Id := "10" (0) Tunnel-Type := VLAN (0) Tunnel-Medium-Type := IEEE-802 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 209 with timestamp +10 Ready to process requests

3 3

sha128 or sha256 support?
by Honglak Kim 27 May '21

27 May '21

Hello, Does FreeRadius support sha128 or sha256 for the user encrypted password?We are using the internet to communicate between the radius server and network devices.Therefore more strong encrypted password method seems necessary. Thanks a lot,Paul

3 5

Handling unreliable proxy partners
by paul.moser＠bt.com 27 May '21

27 May '21

We proxy a lot of authentication to radius servers that we do not manage/control. In a number of failure scenarios in order to maintain a good customer experience it is better for us to give access to the network even though we can't authenticate the users so customers continue to receive service even if that means giving some non-customer access. We might restrict the length of these sessions or turn on QoS restrictions. Using fallback virtual servers and (in non fallback virtual servers) Post-Proxy-Type Fail-Authentication allows us to handle the cases where no radius servers are responding for a partner or proxying of a single request fails, by returning an access-accept ourselves and automatically kicks in when one of those situations presents itself. Any common radius attributes that need to be set to put restrictions on those sessions can be put in a policy and called from each section rather than duplicating code. This works well. We'd also like a manual mechanism that our support team can trigger to cover other failure scenarios, eg the remote radius server is incorrectly returning access-reject for all valid users, and those scenarios that we haven't been able to think of but will occur, inevitably at the most inconvenient of times. My first attempt at this was that the support team could use radmin to set the home servers to dead which would mean packets were routed via the falback virtual server. I initially thought this worked as a solution, but if FreeRadius is doing status checks against the remote servers then it will automatically bring them back into service as long as the status check requests are responding, which if say the remote partner is responding with access-rejects to even valid users is not what you want. I also considered using ip tables to drop the packets, which would trigger the use of the fallback virtual server, but if you'd decided to go into this state of accepting everything because of some intermittent network problem then dropping all packets with ip tables would make debugging that problem using radclient/radtest very difficult. One idea I haven't explored is having two copies of each virtual server, in different files, one for the normal situation and one for the failure situation and switching which one to use using symlinks and radmin to reload the configuration. So far what I have come up with so far is within a virtual server pre-proxy section to use the exec module to call a simple shell script that check for the presence of flag files indicating which if any partners are in a bad state. The support team are responsible for creating these files. If any flag files are present the the script adds a radius attribute for each, the value indicating which partner. In the pre-proxy section I can then check for this attribute and value if it indicates that the partner the virtual server is handling is in a failure state then call accept from the always module which will cancel the proxying attempt and send an access-accept. We can also call any policy that would also get called in the fallback virtual server or Post-Proxy-Type Fail-Authentication if we want common radius attributes to be returned in the response to apply some sort of QoS restriction. The rlm_exec documentation states using exec is very slow and something like the perl module would be more appropriate for a live environment. Before I carry on down the path of performance testing this and trying perl/python/rest/custom C module does anyone have any thoughts/observations or alternative suggestions? Thanks, Paul

4 10

How to define the Postgres schema name in mods-available sql ?
by Alen 27 May '21

27 May '21

In our postgres db we have a master_db and two underlying schemas, main and radius. How do I define the schema in /etc/freeradius/3.0/mods-available/sql ? server = "xxx" port = 5432 login = "" password = "" radius_db = "master_db" It seems I can only specify the database but not the underlying schema. Thanks,

2 3

postgresql queries.conf has an unterminated string
by Alen 27 May '21

27 May '21

Freeradius 3.0.21 seems to have a typo in /etc/freeradius/3.0/mods-config/sql/main/postgresql/queries.conf Line 505. AcctSessionTime = COALESCE(%{%{Acct-Session-Time}:-NULL}, (${....event_timestamp_epoch} - EXTRACT(EPOCH FROM(AcctStartTime)))), \ The error output: sudo freeradius -X FreeRADIUS Version 3.0.21 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/sql including configuration file /etc/freeradius/3.0/mods-config/sql/main/postgresql/queries.conf /etc/freeradius/3.0/mods-config/sql/main/postgresql/queries.conf[505]: Parse error: Unterminated string Errors reading or parsing /etc/freeradius/3.0/radiusd.conf

3 4

Configuration issue at radiusd.conf?
by Honglak Kim 26 May '21

26 May '21

Hello all, I am very new to FreeRadius and I am not sure why I can't access the network device.It seems something to do with radiusd.conf but I can't identify it.. Please help. This is the debugging message when I ran the test. (0) Received Access-Request Id 116 from 10.0.254.3:43509 to 10.192.2.141:1812 length 92 (0) User-Name = "hong" (0) User-Password = "test123!" (0) NAS-Port-Id = "ssh" (0) Calling-Station-Id = "ops001.mydomain.com" (0) Service-Type = NAS-Prompt-User (0) NAS-Port = 0 (0) NAS-IP-Address = 10.0.254.3 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "hong", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry hong at line 94 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: Normalizing SHA-Password from hex encoding, 40 bytes -> 20 bytes (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" SHA-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) update reply { (0) Juniper-Local-User-Name = "admin" (0) Arista-AVPair = "shell:priv-lvl=15" (0) Arista-AVPair = "shell:roles=network-admin" (0) PaloAlto-Admin-Role = "superuser" (0) PaloAlto-Panorama-Admin-Role = "superuser" (0) PaloAlto-User-Group = "all" (0) } # update reply = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = noop (0) Sent Access-Accept Id 116 from 10.192.2.141:1812 to 10.0.254.3:43509 length 0 (0) Juniper-Local-User-Name = "admin" (0) Arista-AVPair = "shell:priv-lvl=15" (0) Arista-AVPair = "shell:roles=network-admin" (0) PaloAlto-Admin-Role = "superuser" (0) PaloAlto-Panorama-Admin-Role = "superuser" (0) PaloAlto-User-Group = "all" (0) Finished request Waking up in 4.9 seconds. Waking up in 6.9 seconds. (0) Cleaning up request packet ID 116 with timestamp +9 Thanks,Paul

4 6

Segmentation fault on 3.0.22 and head when doing a request status_check
by paul.moser＠bt.com 26 May '21

26 May '21

I've tried doing an upgrade to 3.0.22 (built locally from source), all our tests pass but one with FreeRadius suffering a segmentation fault. It appears to be when FreeRadius attempts a status_check after getting no response from a server when it's attempting to proxy a request, specifically a request status check, a status-server check does not cause an issue and neither does no status check. (fulradiusd -X output at end of email) (0) Proxying request to home server 127.0.0.1 port 5555 timeout 2.000000 (0) Sent Access-Request Id 127 from 0.0.0.0:57856 to 127.0.0.1:5555 length 59 (0) User-Name = "paul" (0) Event-Timestamp = "May 26 2021 17:30:02 UTC" (0) NAS-IP-Address = 127.0.0.1 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x34 Waking up in 0.3 seconds. (0) Expecting proxy response no later than 1.666647 seconds from now Waking up in 1.6 seconds. (0) No proxy response, giving up on request and marking it done Marking home server 127.0.0.1 port 5555 as zombie (it has not responded in 2.000000 seconds). PING: Waiting 4 seconds for response to ping (1) Sent Access-Request Id 141 from 0.0.0.0:57856 to 127.0.0.1:5555 length 0 (1) User-Name := "test_user_please_reject_me" Segmentation fault (core dumped) The minimal configuration I've used to replicate the issue on top of the out of the box configuration, just adding to proxy.conf: home_server home_server_bt { type = auth ipaddr = 127.0.0.1 port = 5555 secret = secret response_window = 2 status_check = request username = "test_user_please_reject_me" password = "this is really secret" check_interval = 30 num_answers_to_alive = 3 } home_server_pool auth_pool_bt { home_server = home_server_bt virtual_server = virtual_server_bt } realm bt.com { auth_pool = auth_pool_bt } And an empty virtual server in sites-enabled: server virtual_server_bt { } I've tried to rule out anything environmental by trying this on builds on Ubuntu and Oracle Linux. I've also tried a build from head of the v3.0.x branch. Paul FreeRADIUS Version 3.0.22 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Getting debug state failed: ptrace capability not set. If debugger detection is required run as root or: setcap cap_sys_ptrace+ep <path_to_radiusd> Starting - reading configuration files ... including dictionary file /opt/freeradius-server-3.0.22/share/freeradius/dictionary including dictionary file /opt/freeradius-server-3.0.22/share/freeradius/dictionary.dhcp including dictionary file /opt/freeradius-server-3.0.22/share/freeradius/dictionary.vqp including dictionary file /opt/freeradius-server-3.0.22/etc/raddb/dictionary including configuration file /opt/freeradius-server-3.0.22/etc/raddb/radiusd.conf including configuration file /opt/freeradius-server-3.0.22/etc/raddb/proxy.conf including configuration file /opt/freeradius-server-3.0.22/etc/raddb/clients.conf including files in directory /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/ including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/echo including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/chap including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/pap including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/date including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/preprocess including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/unix including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/expr including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail.log including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/dynamic_clients including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/sradutmp including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/soh including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/utf8 including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/linelog including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/passwd including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/ntlm_auth including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/radutmp including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/digest including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/replicate including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/cache_eap including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/files including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/unpack including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/mschap including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/expiration including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/logintime including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/exec including configuration file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/eap including files in directory /opt/freeradius-server-3.0.22/etc/raddb/policy.d/ including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/canonicalization including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/accounting including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/control including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/filter including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/rfc7542 including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/operator-name including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/abfab-tr including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/cui including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/debug including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/eap including configuration file /opt/freeradius-server-3.0.22/etc/raddb/policy.d/dhcp including files in directory /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/ including configuration file /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/default including configuration file /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/virtual_server_bt including configuration file /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/opt/freeradius-server-3.0.22" localstatedir = "/opt/freeradius-server-3.0.22/var" logdir = "/opt/freeradius-server-3.0.22/var/log/radius" run_dir = "/opt/freeradius-server-3.0.22/var/run/radiusd" } main { name = "radiusd" prefix = "/opt/freeradius-server-3.0.22" localstatedir = "/opt/freeradius-server-3.0.22/var" sbindir = "/opt/freeradius-server-3.0.22/sbin" logdir = "/opt/freeradius-server-3.0.22/var/log/radius" run_dir = "/opt/freeradius-server-3.0.22/var/run/radiusd" libdir = "/opt/freeradius-server-3.0.22/lib" radacctdir = "/opt/freeradius-server-3.0.22/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/opt/freeradius-server-3.0.22/var/run/radiusd/radiusd.pid" checkrad = "/opt/freeradius-server-3.0.22/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server home_server_bt { ipaddr = 127.0.0.1 port = 5555 type = "auth" secret = <<< secret >>> response_window = 2.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 username = "test_user_please_reject_me" password = "this is really secret" limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server_pool auth_pool_bt { virtual_server = virtual_server_bt home_server = home_server_bt } realm bt.com { auth_pool = auth_pool_bt } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debug state unknown (cap_sys_ptrace capability not set) # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_exec # Loading module "echo" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_chap # Loading module "chap" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/chap # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_detail # Loading module "detail" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail detail { filename = "/opt/freeradius-server-3.0.22/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_pap # Loading module "pap" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_date # Loading module "date" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/preprocess/huntgroups" hints = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_unix # Loading module "unix" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/unix unix { radwtmp = "/opt/freeradius-server-3.0.22/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expr # Loading module "expr" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "auth_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/opt/freeradius-server-3.0.22/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/opt/freeradius-server-3.0.22/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/opt/freeradius-server-3.0.22/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/opt/freeradius-server-3.0.22/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_radutmp # Loading module "sradutmp" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/opt/freeradius-server-3.0.22/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_soh # Loading module "soh" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_always # Loading module "reject" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/utf8 # Loaded module rlm_linelog # Loading module "linelog" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/linelog linelog { filename = "/opt/freeradius-server-3.0.22/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/opt/freeradius-server-3.0.22/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "ntlm_auth" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "radutmp" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/radutmp radutmp { filename = "/opt/freeradius-server-3.0.22/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_digest # Loading module "digest" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/digest # Loaded module rlm_replicate # Loading module "replicate" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/replicate # Loaded module rlm_cache # Loading module "cache_eap" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_files # Loading module "files" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/files files { filename = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/files/authorize" acctusersfile = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/opt/freeradius-server-3.0.22/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_unpack # Loading module "unpack" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/unpack # Loaded module rlm_mschap # Loading module "mschap" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_expiration # Loading module "expiration" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/expiration # Loaded module rlm_logintime # Loading module "logintime" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loading module "exec" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_eap # Loading module "eap" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } instantiate { } # Instantiating module "IPASS" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/realm # Instantiating module "attr_filter.post-proxy" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/attr_filter reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/attr_filter/coa # Instantiating module "detail" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail # Instantiating module "pap" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/pap # Instantiating module "preprocess" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/preprocess reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/preprocess/hints # Instantiating module "auth_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/detail.log # Instantiating module "reject" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/always # Instantiating module "linelog" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/linelog # Instantiating module "etc_passwd" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "cache_eap" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "files" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/files reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/files/authorize reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/files/accounting reading pairlist file /opt/freeradius-server-3.0.22/etc/raddb/mods-config/files/pre-proxy # Instantiating module "mschap" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "expiration" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/expiration # Instantiating module "logintime" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/logintime # Instantiating module "eap" from file /opt/freeradius-server-3.0.22/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/opt/freeradius-server-3.0.22/etc/raddb/certs" pem_file_type = yes private_key_file = "/opt/freeradius-server-3.0.22/etc/raddb/certs/server.pem" certificate_file = "/opt/freeradius-server-3.0.22/etc/raddb/certs/server.pem" ca_file = "/opt/freeradius-server-3.0.22/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/opt/freeradius-server-3.0.22/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /opt/freeradius-server-3.0.22/etc/raddb/radiusd.conf } # server server default { # from file /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type } # server default server virtual_server_bt { # from file /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/virtual_server_bt } # server virtual_server_bt server inner-tunnel { # from file /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/inner-tunnel:336 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 127.0.0.1 client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client ::1 } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 57856 Listening on proxy address :: port 54137 Ready to process requests (0) Received Access-Request Id 4 from 127.0.0.1:50956 to 127.0.0.1:1812 length 33 (0) User-Name = "paul(a)bt.com" (0) # Executing section authorize from file /opt/freeradius-server-3.0.22/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "bt.com" for User-Name = "paul(a)bt.com" (0) suffix: Found realm "bt.com" (0) suffix: Adding Stripped-User-Name = "paul" (0) suffix: Adding Realm = "bt.com" (0) suffix: Proxying request from user paul to realm bt.com (0) suffix: Preparing to proxy authentication request to realm "bt.com" (0) [suffix] = updated (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated (0) Starting proxy to home server 127.0.0.1 port 5555 (0) server virtual_server_bt { (0) } (0) Proxying request to home server 127.0.0.1 port 5555 timeout 2.000000 (0) Sent Access-Request Id 127 from 0.0.0.0:57856 to 127.0.0.1:5555 length 59 (0) User-Name = "paul" (0) Event-Timestamp = "May 26 2021 17:30:02 UTC" (0) NAS-IP-Address = 127.0.0.1 (0) Message-Authenticator := 0x00 (0) Proxy-State = 0x34 Waking up in 0.3 seconds. (0) Expecting proxy response no later than 1.666647 seconds from now Waking up in 1.6 seconds. (0) No proxy response, giving up on request and marking it done Marking home server 127.0.0.1 port 5555 as zombie (it has not responded in 2.000000 seconds). PING: Waiting 4 seconds for response to ping (1) Sent Access-Request Id 141 from 0.0.0.0:57856 to 127.0.0.1:5555 length 0 (1) User-Name := "test_user_please_reject_me" Segmentation fault (core dumped)

2 1

Building against MariaDB 10.5
by Sebastian Hagedorn 26 May '21

26 May '21

Hi, I apologise if this question is considered off-topic, but I wouldn’t know where else to ask. We run freeradius on RHEL 7, using our own RPMs that are based on the SPEC file included with freeradius, but with some differences. Our database team doesn’t want to use the stock mariadb RPM, so we use version 10.5 from http://yum.mariadb.org/10.5/rhel7-amd64. The issue is that I have found that when I build the freeradius 3.0.22 RPM with MariaDB 10.5 installed, the freeradius server doesn’t run properly. I configured a panic_action and can provide the gdb files if there is interest. If I use mariadb-devel 5.5 (standard issue RHEL 7) to build, everything works fine, even when the database server is running MariaDB 10.5. So there is a workaround, but I wonder if it shouldn’t be possible to compile with the newer version installed? -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

2 3

Radsec Limitations
by Michael Cullen 26 May '21

26 May '21

Good afternoon, We have radsec tunnels between the authenticator and the server wherever it is supported, and a lot of the newer networking equipment that has this. The majority of traffic will be on Windows machines using EAP-TTLS. We came across this message: https://www.juniper.net/documentation/us/en/software/junos/user-access/topi… which states "NOTE: Due to limitations of the TCP protocol, RADSEC can have no more than 255 RADIUS messages in flight." Due to the majority of our traffic being from Windows machines using EAP-TTLS, will this also include RADIUS messages? Has anyone been affected by this limitation? We are looking at scaling the RADIUS solution to a large number of users in the future. There seems to be no reported issues about these limitations, other than the article above. Thanks for any help you can provide, Michael

2 1

Question about the new sql client behaivour in 3.0.22
by bpbp＠fastmail.com 26 May '21

26 May '21

Hi list, I just upgraded to 3.0.22 and I have a question about an issue I just ran into. I see in the changelog there's some changes to how clients are loaded. Previously I was using the nas table via MySQL to load clients into the global list for all my virtual servers. With 3.0.22 I can see the clients successfully loaded but freeradius is then ignoring any accounting requests from those clients with: radiusd[32025]: Ignoring request to acct address * port 1821 bound to server combined from unknown client 192.168.10.215 port 37819 proto udp I resolved the issue by putting the clients into clients.conf with the following basic config for now client radius01.syd1 { ipaddr = 192.168.10.215 secret = [..] } and for reference the previously working SQL configuration for that client mysql> SELECT * FROM radius.nas WHERE nasname = '192.168.10.215'; +----+----------------+---------------+-------+-------+----------+--------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | server | community | description | +----+----------------+---------------+-------+-------+----------+--------+-----------+-------------+ | 85 | 192.168.10.215 | radius01.syd1 | other | NULL | [..]| NULL | NULL | | +----+----------------+---------------+-------+-------+----------+--------+-----------+-------------+ 1 row in set (0.00 sec) radmin shows the following slight differences after loading both radmin> show client list verbose client radius01.syd1 { ipaddr = 192.168.10.215/32 proto = udp secret = [..] longname = 192.168.10.215 shortname = radius01.syd1 number = 0 global = yes } client { ipaddr = 192.168.10.215/32 proto = * secret = [...] longname = 192.168.10.215 shortname = radius01.syd1 nas_type = other number = 47 dynamic = yes lifetime = 0 global = yes } My question is what am I doing wrong here that the client loaded from sql isn't working? I thought it might be the changes around client loading but radmin shows that it was successfully loaded as a global client and not tied to a single virtualhost. Thanks, Boden radiusd -X output FreeRADIUS Version 3.0.22 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including configuration file /etc/raddb/mods-enabled/sqlippool including configuration file /etc/raddb/mods-config/sql/ippool/mysql/queries.conf including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail.my-company.net.au including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/moonshot-targeted-ids including configuration file /etc/raddb/policy.d/rfc7542 including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/combined-walled-garden including configuration file /etc/raddb/sites-enabled/combined-walled-garden-nbn including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/coa including configuration file /etc/raddb/sites-enabled/decoupled-accounting-my-company including configuration file /etc/raddb/sites-enabled/status main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 4096 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### realm DEFAULT { } radiusd: #### Loading Clients #### client radius01.syd1 { ipaddr = 192.168.10.215 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client radius02.syd1 { ipaddr = 192.168.10.222 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = Status-Server radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/visp_users" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "192.168.10.206" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime = '%{%{integer:Event-Timestamp}:-%l}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime = '%{%{integer:Event-Timestamp}:-%l}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedipv6pool, delegatedipv6prefix) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-IPv6-Pool}', '%{Delegated-IPv6-Prefix}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctinterval = %{%{integer:Event-Timestamp}:-%l} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedipv6pool = '%{Framed-IPv6-Pool}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{%{integer:Event-Timestamp}:-%l}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate, downstream, upstream) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M', '%{request:Actual-Data-Rate-Downstream}', '%{request:Actual-Data-Rate-Upstream}' )" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_sqlippool # Loading module "sqlippool" from file /etc/raddb/mods-enabled/sqlippool sqlippool { sql_module_instance = "sql" lease_duration = 3600 pool_name = "Pool-Name" default_pool = "main_pool" attribute_name = "Framed-IP-Address" allocate_begin = "START TRANSACTION" allocate_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'" allocate_clear_timeout = 1 allocate_existing = "" allocate_requested = "" allocate_find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND ( expiry_time < NOW() OR expiry_time IS NULL OR expiry_time = 0 OR ( nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port-Id}' ) ) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate_update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I'" allocate_commit = "COMMIT" pool_check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start_begin = "" start_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start_commit = "" alive_begin = "" alive_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}' AND pool_key = '%{NAS-Port-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive_commit = "" stop_begin = "" stop_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}' AND pool_key = '%{NAS-Port-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop_commit = "" on_begin = "" on_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'" on_commit = "" off_begin = "" off_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{%{Nas-IP-Address}:-%{Nas-IPv6-Address}}'" off_commit = "" messages { exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" clear = "Released IP Framed-IP-Address (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } } # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loading module "detail.my-company.net.au" from file /etc/raddb/mods-enabled/detail.my-company.net.au detail detail.my-company.net.au { filename = "/var/log/radius/radacct/detail-%Y%m%d:%H:%G" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/visp_users reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 5.6.45 mysql { tls { tls_required = no } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 10 min = 10 max = 40 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 600 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 40 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 39 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 38 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 37 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 36 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Opening additional connection (5), 1 of 35 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Opening additional connection (6), 1 of 34 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Opening additional connection (7), 1 of 33 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Opening additional connection (8), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Opening additional connection (9), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.168.10.206 via TCP/IP, server version 8.0.25, protocol version 10 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Adding client 203.23.236.6 (VIC-LNS) to global clients list rlm_sql (203.23.236.6): Client "VIC-LNS" (sql) added rlm_sql (sql): Adding client 203.23.236.26 (ADSL-LNS) to global clients list rlm_sql (203.23.236.26): Client "ADSL-LNS" (sql) added rlm_sql (sql): Adding client 203.23.236.46 (ADSL-LNS) to global clients list rlm_sql (203.23.236.46): Client "ADSL-LNS" (sql) added rlm_sql (sql): Adding client 192.168.10.226 (Station) to global clients list rlm_sql (192.168.10.226): Client "Station" (sql) added rlm_sql (sql): Adding client 202.172.107.74 (Astro) to global clients list rlm_sql (202.172.107.74): Client "Astro" (sql) added rlm_sql (sql): Adding client 202.172.107.75 (VM2) to global clients list rlm_sql (202.172.107.75): Client "VM2" (sql) added rlm_sql (sql): Adding client 203.23.236.80 (Raven) to global clients list rlm_sql (203.23.236.80): Client "Raven" (sql) added rlm_sql (sql): Adding client 203.23.236.2 (3G-LNS) to global clients list rlm_sql (203.23.236.2): Client "3G-LNS" (sql) added rlm_sql (sql): Adding client 124.254.72.146 (ISPOne-radius-1) to global clients list rlm_sql (124.254.72.146): Client "ISPOne-radius-1" (sql) added rlm_sql (sql): Adding client 124.254.72.147 (ISPOne-radius-2) to global clients list rlm_sql (124.254.72.147): Client "ISPOne-radius-2" (sql) added rlm_sql (sql): Adding client 203.194.28.131 (SOUL1) to global clients list rlm_sql (203.194.28.131): Client "SOUL1" (sql) added rlm_sql (sql): Adding client 10.20.20.2 (ADSL-LNS) to global clients list rlm_sql (10.20.20.2): Client "ADSL-LNS" (sql) added rlm_sql (sql): Adding client 203.194.28.132 (SOUL2) to global clients list rlm_sql (203.194.28.132): Client "SOUL2" (sql) added rlm_sql (sql): Adding client 203.194.56.120 (SOUL3) to global clients list rlm_sql (203.194.56.120): Client "SOUL3" (sql) added rlm_sql (sql): Adding client 203.194.56.121 (SOUL4) to global clients list rlm_sql (203.194.56.121): Client "SOUL4" (sql) added rlm_sql (sql): Adding client 203.194.59.120 (SOUL5) to global clients list rlm_sql (203.194.59.120): Client "SOUL5" (sql) added rlm_sql (sql): Adding client 203.194.59.121 (SOUL6) to global clients list rlm_sql (203.194.59.121): Client "SOUL6" (sql) added rlm_sql (sql): Adding client 203.221.163.160 (SOUL7) to global clients list rlm_sql (203.221.163.160): Client "SOUL7" (sql) added rlm_sql (sql): Adding client 203.221.11.41 (SOUL8) to global clients list rlm_sql (203.221.11.41): Client "SOUL8" (sql) added rlm_sql (sql): Adding client 203.194.23.101 (SOUL9) to global clients list rlm_sql (203.194.23.101): Client "SOUL9" (sql) added rlm_sql (sql): Adding client 127.0.0.1 (localhost) to global clients list rlm_sql (127.0.0.1): Client "localhost" (sql) added rlm_sql (sql): Adding client 203.23.236.121 (new-titan) to global clients list rlm_sql (203.23.236.121): Client "new-titan" (sql) added rlm_sql (sql): Adding client 203.23.236.146 (ADSL-LNS) to global clients list rlm_sql (203.23.236.146): Client "ADSL-LNS" (sql) added rlm_sql (sql): Adding client 203.23.236.66 (Angel) to global clients list rlm_sql (203.23.236.66): Client "Angel" (sql) added rlm_sql (sql): Adding client 202.172.107.251 (ADSL-LNS) to global clients list rlm_sql (202.172.107.251): Client "ADSL-LNS" (sql) added rlm_sql (sql): Adding client 192.168.10.195 (Station Eris) to global clients list rlm_sql (192.168.10.195): Client "Station Eris" (sql) added rlm_sql (sql): Adding client 203.23.236.30 (NBN-LNS) to global clients list rlm_sql (203.23.236.30): Client "NBN-LNS" (sql) added rlm_sql (sql): Adding client 203.23.236.46 (ADSL-LNS) to global clients list Ignoring duplicate client 203.23.236.46 rlm_sql (203.23.236.46): Client "ADSL-LNS" (sql) added rlm_sql (sql): Adding client 203.23.236.58 (NBN-LNS) to global clients list rlm_sql (203.23.236.58): Client "NBN-LNS" (sql) added rlm_sql (sql): Adding client 203.23.236.154 (ADSL-LNS) to global clients list rlm_sql (203.23.236.154): Client "ADSL-LNS" (sql) added rlm_sql (sql): Adding client 192.168.10.202 (crimson) to global clients list rlm_sql (192.168.10.202): Client "crimson" (sql) added rlm_sql (sql): Adding client 203.23.236.54 (ADSL-LNS) to global clients list rlm_sql (203.23.236.54): Client "ADSL-LNS" (sql) added rlm_sql (sql): Adding client 192.168.10.205 (Station Galaxy) to global clients list rlm_sql (192.168.10.205): Client "Station Galaxy" (sql) added rlm_sql (sql): Adding client 203.23.236.50 (NBN-LNS) to global clients list rlm_sql (203.23.236.50): Client "NBN-LNS" (sql) added rlm_sql (sql): Adding client 10.10.100.2 (NBN-LNS-2) to global clients list rlm_sql (10.10.100.2): Client "NBN-LNS-2" (sql) added rlm_sql (sql): Adding client 10.10.200.2 (NBN-LNS-2) to global clients list rlm_sql (10.10.200.2): Client "NBN-LNS-2" (sql) added rlm_sql (sql): Adding client 10.10.100.5 (NBN-LNS-2) to global clients list rlm_sql (10.10.100.5): Client "NBN-LNS-2" (sql) added rlm_sql (sql): Adding client 10.10.200.5 (NBN-LNS-2) to global clients list rlm_sql (10.10.200.5): Client "NBN-LNS-2" (sql) added rlm_sql (sql): Adding client 203.29.125.11 (noc3) to global clients list rlm_sql (203.29.125.11): Client "noc3" (sql) added rlm_sql (sql): Adding client 203.23.236.11 (NBN-LNS-2) to global clients list rlm_sql (203.23.236.11): Client "NBN-LNS-2" (sql) added rlm_sql (sql): Adding client 203.23.237.13 (NBN-LNS-3) to global clients list rlm_sql (203.23.237.13): Client "NBN-LNS-3" (sql) added rlm_sql (sql): Adding client 192.168.10.208 (behemoth) to global clients list rlm_sql (192.168.10.208): Client "behemoth" (sql) added rlm_sql (sql): Adding client 203.23.237.12 (NBN-LNS-2) to global clients list rlm_sql (203.23.237.12): Client "NBN-LNS-2" (sql) added rlm_sql (sql): Adding client 202.172.100.9 (NBN-LNS) to global clients list rlm_sql (202.172.100.9): Client "NBN-LNS" (sql) added rlm_sql (sql): Adding client 202.172.100.35 (NBN-LNS) to global clients list rlm_sql (202.172.100.35): Client "NBN-LNS" (sql) added rlm_sql (sql): Adding client 203.23.237.11 (NBN-LNS) to global clients list rlm_sql (203.23.237.11): Client "NBN-LNS" (sql) added rlm_sql (sql): Adding client 192.168.10.215 (radius01.syd1) to global clients list rlm_sql (192.168.10.215): Client "radius01.syd1" (sql) added rlm_sql (sql): Adding client 192.168.10.222 (radius02.syd1) to global clients list rlm_sql (192.168.10.222): Client "radius02.syd1" (sql) added rlm_sql (sql): Released connection (0) # Instantiating module "sqlippool" from file /etc/raddb/mods-enabled/sqlippool Ignoring "allocate_clear_timeout = 1", forcing to "allocate_clear_timeout = 1" # Instantiating module "detail.my-company.net.au" from file /etc/raddb/mods-enabled/detail.my-company.net.au } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server combined { # from file /etc/raddb/sites-enabled/combined-walled-garden # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server combined server combined-nbn { # from file /etc/raddb/sites-enabled/combined-walled-garden-nbn # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading accounting {...} # Loading session {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server combined-nbn server coa { # from file /etc/raddb/sites-enabled/coa # Loading recv-coa {...} # Loading send-coa {...} } # server coa server read-detail.my-company.net.au { # from file /etc/raddb/sites-enabled/decoupled-accounting-my-company # Loading preacct {...} # Loading accounting {...} } # server read-detail.my-company.net.au server status { # from file /etc/raddb/sites-enabled/status # Loading authorize {...} Compiling Autz-Type Status-Server for attr Autz-Type } # server status radiusd: #### Opening IP addresses and Ports #### listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" mode = "rw" peercred = yes } } listen { type = "coa" virtual_server = "coa" ipaddr = * port = 3799 client radius01.syd1 { ipaddr = 192.168.10.215 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 192.168.10.215 client radius02.syd1 { ipaddr = 192.168.10.222 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Ignoring duplicate client 192.168.10.222 } listen { type = "auth" ipaddr = * port = 1815 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 1816 } listen { type = "auth" ipaddr = * port = 1820 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 1821 } listen { type = "detail" listen { filename = "/var/log/radius/radacct/detail-*:*" load_factor = 70 poll_interval = 1 retry_interval = 30 one_shot = no track = yes } } listen { type = "status" ipaddr = 127.0.0.1 port = 18121 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on command file /var/run/radiusd/radiusd.sock Listening on coa address * port 3799 bound to server coa Listening on auth address * port 1815 bound to server combined Listening on acct address * port 1816 bound to server combined Listening on auth address * port 1820 bound to server combined-nbn Listening on acct address * port 1821 bound to server combined-nbn Listening on detail file /var/log/radius/radacct/detail-*:* as server read-detail.my-company.net.au Listening on status address 127.0.0.1 port 18121 bound to server status Ready to process requests

2 1