October 2022 - Freeradius-Users - lists.freeradius.org

ldap redundant-load-balance sanity check and questions
by Brantley Padgett 12 Oct '22

12 Oct '22

There was a thread a few days ago that caused me to relook at how to configure failover for multiple ldap backends. After a lot of reading, a lot more trial and error, I have an apparently functioning solution. Is there anything glaringly wrong with this configuration? Also, I didn't have any luck finding end to end examples so also hoping this will help if anyone else is trying to figure out a similar setup. First, my setup. I started with a fresh build, installed FR 3.2 from the networkradius repo. I added to radiusd.conf in the instantiate stanza: redundant-load-balance redundant_ldap { server1 server2 server3 } I edited mods-available/ldap: ldap server1 { $INCLUDE ${modconfdir}/files/ldap_server_info server = 'ldap1.example.net' } ldap server2 { $INCLUDE ${modconfdir}/files/ldap_server_info server = 'ldap2.example.net' } ldap server3 { $INCLUDE ${modconfdir}/files/ldap_server_info server = 'ldap3.example.net' } To make ldap more readable and save typing, next made a file in mods-config/files/ldap_server_info containing all the ldap data, user, group, filters, etc that are static between all 3 nodes. port = [...] identity = [...] password = [...] base_dn = [...] update { control:Password-With-Header += 'userPassword' control:NT-Password := 'sambaNTPassword' } user_dn = "LDAP-UserDn" user { [...] } group { [...] } accounting { [...] } # Post-Auth can modify LDAP objects too post-auth { update { description := "Authenticated at %S" } } # LDAP connection-specific options. options { [...] } tls { [...] } pool { [...] } Then, in sites-available/default Under authenticate I uncommented and cahnged the Auth-Type LDAP call to Auth-Type LDAP { redundant_ldap { } } Under authorize is where I have a few questions. What I finally did that works: (question #1) redundant_ldap if ((ok || updated) && User-Password && !control:Auth-Type) { update control { &Auth-Type := LDAP } #update session-state { ## ignore these, they were iterations trying to figure out how to combine Ldap-Group related to question 2 # #&control:Ldap-Group += &control:Ldap-Group[*] # &Ldap-Group += &Ldap-Group[*] #} } Finally, under post-auth I have it return back some groups/etc for various devices. It finally clicked that I had to list each ldap server instance for Ldap-Group. I tried a few different stackoverflow inspired answers of updating a session-state or similar but wasn't able to get any of those to work. (question 2) if (server1-Ldap-Group == "group1") || (server2-Ldap-Group == "group1") || (server3-Ldap-Group == "group1") { update reply { [...] } } elsif (server1-Ldap-Group == "group2") || (server2-Ldap-Group == "group2") || (server3-Ldap-Group == "group2") { update reply { [...] } } elsif (server1-Ldap-Group == "group3") || (server2-Ldap-Group == "group3") || (server3-Ldap-Group == "group3") { update reply { [...] } } else { update reply { [...] } } My questions: Foremost, where I had to comment out the update control auth-type, what is that step? I know this is a pretty basic question but either I couldn't find in the docs (I'm sure it's there I just don't know what to look for), or didn't understand if I did find it, what is that update call actually doing? I tried a few different versions and when the config check ran cleanly I stopped messing with it. I get appropriate answers from radtest, I just am not sure what is happening. I actually had all of the update block commented out, so just "if (( ok... )) {}" with nothing between the braces and it works, which is the reason for the question. I assume this is an example as stated in the docs to not mess with auth-type but let the server "just figure it out", but wanted to make sure. Question 2 - is there a better way of handling multiple server[n]-Ldap-Group responses? I've tried to follow https://stackoverflow.com/questions/58187426/freeradius-problem-with-redund… but wasn't exactly sure where those stanzas needed to go, or if rlb_ldap was a typo, or what. (P.S. as I type that, I realize where rlb_ldap came from, that is the instance name the question gave to the redundant-load-balance.) Either way, while server[n]-Ldap-Group works, it's cumbersome to expand with ansible so I'm hoping there's a more elegant way that I'm just not seeing. Thank you in advance! Brantley Padgett The question is not how far. The question is, do you possess the constitution, the depth of faith, to go as far as is needed? -Boondock Saints

3 5

ldap load-balance
by Elias Pereira 07 Oct '22

07 Oct '22

hi, I was reading the load-balance article on the freeradius wiki and had some doubts. I have two vms with sambaAD. In mod-enable > ldap I need to configure 2 entries of the ldap block? eg: ldap1{ ... } ldap2{ ... } 2. Is the loadbalance setting done in the file sites-enable > default? -- Elias Pereira

4 17

Multiple NAS clients within same network
by sachin shetty 06 Oct '22

06 Oct '22

Hello, I'm using Freeradius for VPN and Wifi clients. Lately, I encountered a scenario wrt the NAS client IP address. Before I explain my problem to you, I'd like to give you a brief on the configuration. I'm using the dynamic_clients section, which verifies the NAS entries against the external SQL server. Post which uses rest auth for completion. We have a scenario where a Wireless access point Wifi and VPN gateway are configured at the customer site, and the network has one public IP for both NAS clients. In *the nas* table, I have two entries with the same nas name, i.e., the same client IP address but different secrets. When the Radius packet from *NAS client **1* received, it resolves to the right entry in the database and happy flow. And when the Radius packet from *NAS client 2* received it complains secret is invalid as it always picks one entry from the database. This is evident from the query pasted below for reference. I was of the opinion that secret is different, so lookup can be solved. But from the *dynamic_clients* documentation, it reads as, "*You can specify overlapping networks (127/8 and 127.0/16)*.* In that case, the smallest possible network will be used as the "best match" for the client.*" But in mycase it is overlapping IPs. I also read that some NAS clients do allow to change NAS-IP address, and some don't. At first, I thought relying on the NAS-IP address instead of Packet-Src-Ip-Address as Packet-Src-Ip-Address is same in radius auth packets from both sources. But apparently, I see the NAS IP address remains the same, and some NAS clients don't allow to change their NAS IP address. *Questions are:* *1. Is this the correct configuration (where two NAS clients under same roof)? If yes, is it a solved use case? * *2. Should I use shortname in the query where clause? Will that help? This requires configuring shortname at the NAS client? *Or *does this mean I can have only one IP per NAS client ? * *3. Any alternative approach I can look for dynamic_clients query? I do not want to skip dynamic_client auth as it efficiently blocks invalid clients. **Any reason for dynamic clients not looping all the entries matching the same IP address to compare secrets? i.e forming uniqueness with IP and secret together.* This is the current query (default from the package, as I haven't changed anything) if ("%{sql: SELECT nasname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}") { update control { # # Echo the IP. &FreeRADIUS-Client-IP-Address = "%{Packet-Src-IP-Address}" # # Do multiple SELECT statements to grab # the various definitions. &FreeRADIUS-Client-Shortname = "%{sql: SELECT shortname FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Secret = "%{sql: SELECT secret FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-NAS-Type = "%{sql: SELECT type FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" &FreeRADIUS-Client-Virtual-Server = "%{sql: SELECT server FROM nas WHERE nasname = '%{Packet-Src-IP-Address}'}" } } Thanks, Sachin

6 8

Shared secret is incorrect
by Lane Roberts 06 Oct '22

06 Oct '22

Hi guys I'm at my wits end with a "Shared secret is incorrect" issue. If anyone has any suggestions then they would be much appreciated! Basically sometimes my ubuntu 20.04 machine will successfully authenticate to my NetGear GS108T switch via 802.1X EAP-TLS and sometimes it fails the first time and succeeds later. The pattern is always the same - 9 requests if it succeeds first time, 18 if it fails initially with the first 6 identical but the next three (actually one repeated) giving "Shared secret is incorrect". Then it seems to sort itself out and succeeds. Secret has been set to "testing123" everywhere. Debug output below. Thanks in advance! FreeRADIUS Version 3.0.16 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/date including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/dhcp including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/detail including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/canonicalization including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/check-eap-tls main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.30.247 { ipaddr = 192.168.30.247 require_message_authenticator = no secret = <<< secret >>> nas_type = "juniper" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.31.17 { ipaddr = 192.168.31.17 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.33.55 { ipaddr = 192.168.33.55 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/3.0/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/freeradius/3.0/mods-enabled/dhcp # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } instantiate { } # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" virtual_server = "check-eap-tls" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs/trustedca/" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/server.key" certificate_file = "/etc/freeradius/3.0/certs/server.pem.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = no check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no tmpdir = "/var/cache/freerad" client = "/bin/cp %{TLS-Client-Cert-Filename} /tmp/certs/test.cert" } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:331 } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server check-eap-tls { # from file /etc/freeradius/3.0/sites-enabled/check-eap-tls # Loading authorize {...} } # server check-eap-tls radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 51806 Listening on proxy address :: port 48894 Ready to process requests (0) Received Access-Request Id 9 from 192.168.31.17:54547 to 192.168.30.242:1812 length 157 (0) NAS-IP-Address = 192.168.28.164 (0) NAS-Port = 7 (0) User-Name = "host/07017CF14A4F9A00" (0) Called-Station-Id = "80-CC-9C-93-EC-E2" (0) Calling-Station-Id = "A4-BB-6D-62-41-2F" (0) Service-Type = Framed-User (0) Framed-MTU = 1300 (0) NAS-Port-Type = Ethernet (0) Message-Authenticator = 0xf2aa1179339221dcedc51386802a16a2 (0) EAP-Message = 0x0202001a01686f73742f30373031374346313441344639413030 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 2 length 26 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_tls to process data (0) eap_tls: Initiating new EAP-TLS session (0) eap_tls: Setting verify mode to require certificate from client (0) eap_tls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 3 length 6 (0) eap: EAP session adding &reply:State = 0x7b06d3227b05de54 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 9 from 192.168.30.242:1812 to 192.168.31.17:54547 length 0 (0) EAP-Message = 0x010300060d20 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x7b06d3227b05de54c814d14a9f99a82e (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 10 from 192.168.31.17:55178 to 192.168.30.242:1812 length 345 (1) NAS-IP-Address = 192.168.28.164 (1) NAS-Port = 7 (1) User-Name = "host/07017CF14A4F9A00" (1) Called-Station-Id = "80-CC-9C-93-EC-E2" (1) Calling-Station-Id = "A4-BB-6D-62-41-2F" (1) Service-Type = Framed-User (1) Framed-MTU = 1300 (1) NAS-Port-Type = Ethernet (1) Message-Authenticator = 0x0dbc3d67d7ca3615acd73e9804908cd2 (1) EAP-Message = 0x020300c40d0016030100b9010000b503039be1c08b43884514fa749b7bca5d64938cf781fe51d91a419f10f898f1aa8ae8000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000054000b0004030001 (1) State = 0x7b06d3227b05de54c814d14a9f99a82e (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 3 length 196 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x7b06d3227b05de54 (1) eap: Finished EAP session with state 0x7b06d3227b05de54 (1) eap: Previous EAP request found for state 0x7b06d3227b05de54, released from the list (1) eap: Peer sent packet with method EAP TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: Continuing EAP-TLS (1) eap_tls: Got final TLS record fragment (190 bytes) (1) eap_tls: WARNING: Total received TLS record fragments (190 bytes), does not equal indicated TLS record length (0 bytes) (1) eap_tls: [eaptls verify] = ok (1) eap_tls: Done initial handshake (1) eap_tls: (other): before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: <<< recv UNKNOWN TLS VERSION ?0304? [length 00b9] (1) eap_tls: TLS_accept: SSLv3/TLS read client hello (1) eap_tls: >>> send TLS 1.2 [length 003d] (1) eap_tls: TLS_accept: SSLv3/TLS write server hello (1) eap_tls: >>> send TLS 1.2 [length 0fe0] (1) eap_tls: TLS_accept: SSLv3/TLS write certificate (1) eap_tls: >>> send TLS 1.2 [length 014d] (1) eap_tls: TLS_accept: SSLv3/TLS write key exchange (1) eap_tls: >>> send TLS 1.2 [length 003a] (1) eap_tls: TLS_accept: SSLv3/TLS write certificate request (1) eap_tls: >>> send TLS 1.2 [length 0004] (1) eap_tls: TLS_accept: SSLv3/TLS write server done (1) eap_tls: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_tls: In SSL Handshake Phase (1) eap_tls: In SSL Accept mode (1) eap_tls: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 4 length 1004 (1) eap: EAP session adding &reply:State = 0x7b06d3227a02de54 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 10 from 192.168.30.242:1812 to 192.168.31.17:55178 length 0 (1) EAP-Message = 0x010403ec0dc0000011c1160303003d0200003903038bfd761ee1ef5d46544c1c3138fd879d899ca3a5b8c733084efab27a180b994e00c030000011ff01000100000b000403000102001700001603030fe00b000fdc000fd90005c9308205c5308203ada0030201020213470000000def2e5ac0160bdf88 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x7b06d3227a02de54c814d14a9f99a82e (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 11 from 192.168.31.17:38732 to 192.168.30.242:1812 length 155 (2) NAS-IP-Address = 192.168.28.164 (2) NAS-Port = 7 (2) User-Name = "host/07017CF14A4F9A00" (2) Called-Station-Id = "80-CC-9C-93-EC-E2" (2) Calling-Station-Id = "A4-BB-6D-62-41-2F" (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Ethernet (2) Message-Authenticator = 0xbe3e6d1c6bd067920bdf7467665ffb33 (2) EAP-Message = 0x020400060d00 (2) State = 0x7b06d3227a02de54c814d14a9f99a82e (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 4 length 6 (2) eap: No EAP Start, assuming it's an on-going EAP conversation (2) [eap] = updated (2) [files] = noop (2) [expiration] = noop (2) [logintime] = noop (2) [pap] = noop (2) } # authorize = updated (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x7b06d3227a02de54 (2) eap: Finished EAP session with state 0x7b06d3227a02de54 (2) eap: Previous EAP request found for state 0x7b06d3227a02de54, released from the list (2) eap: Peer sent packet with method EAP TLS (13) (2) eap: Calling submodule eap_tls to process data (2) eap_tls: Continuing EAP-TLS (2) eap_tls: Peer ACKed our handshake fragment (2) eap_tls: [eaptls verify] = request (2) eap_tls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 5 length 1004 (2) eap: EAP session adding &reply:State = 0x7b06d3227903de54 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 11 from 192.168.30.242:1812 to 192.168.31.17:38732 length 0 (2) EAP-Message = 0x010503ec0dc0000011c1653f6f626a656374436c6173733d63657274696669636174696f6e417574686f72697479300d06092a864886f70d01010b050003820201008d414e224f1117b36c14254233210a280c7d56fdaf530b52ad532adec3765d32380d0197bd39b965611b05a1814099ef250dbbcd1e (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x7b06d3227903de54c814d14a9f99a82e (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 12 from 192.168.31.17:44829 to 192.168.30.242:1812 length 155 (3) NAS-IP-Address = 192.168.28.164 (3) NAS-Port = 7 (3) User-Name = "host/07017CF14A4F9A00" (3) Called-Station-Id = "80-CC-9C-93-EC-E2" (3) Calling-Station-Id = "A4-BB-6D-62-41-2F" (3) Service-Type = Framed-User (3) Framed-MTU = 1300 (3) NAS-Port-Type = Ethernet (3) Message-Authenticator = 0x462c5a69befb52af783f23c4209c145a (3) EAP-Message = 0x020500060d00 (3) State = 0x7b06d3227903de54c814d14a9f99a82e (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 5 length 6 (3) eap: No EAP Start, assuming it's an on-going EAP conversation (3) [eap] = updated (3) [files] = noop (3) [expiration] = noop (3) [logintime] = noop (3) [pap] = noop (3) } # authorize = updated (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x7b06d3227903de54 (3) eap: Finished EAP session with state 0x7b06d3227903de54 (3) eap: Previous EAP request found for state 0x7b06d3227903de54, released from the list (3) eap: Peer sent packet with method EAP TLS (13) (3) eap: Calling submodule eap_tls to process data (3) eap_tls: Continuing EAP-TLS (3) eap_tls: Peer ACKed our handshake fragment (3) eap_tls: [eaptls verify] = request (3) eap_tls: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 6 length 1004 (3) eap: EAP session adding &reply:State = 0x7b06d3227800de54 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 12 from 192.168.30.242:1812 to 192.168.31.17:44829 length 0 (3) EAP-Message = 0x010603ec0dc0000011c1ab0cb2199b3d9d5d34d9f5072dfe7fe6bcacdcea19de101694fe88e33f4d62a86ffe280fba1884b08213f42dada39b00cc28a336c58611b150a2c3b943cb835ea3f3afb6c13e2db1482e8e087d93ab980cd11b78d527ac930203010001a3693067301306092b06010401823714 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x7b06d3227800de54c814d14a9f99a82e (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 13 from 192.168.31.17:45736 to 192.168.30.242:1812 length 155 (4) NAS-IP-Address = 192.168.28.164 (4) NAS-Port = 7 (4) User-Name = "host/07017CF14A4F9A00" (4) Called-Station-Id = "80-CC-9C-93-EC-E2" (4) Calling-Station-Id = "A4-BB-6D-62-41-2F" (4) Service-Type = Framed-User (4) Framed-MTU = 1300 (4) NAS-Port-Type = Ethernet (4) Message-Authenticator = 0xf59358285a1560f18c87a6035739d32e (4) EAP-Message = 0x020600060d00 (4) State = 0x7b06d3227800de54c814d14a9f99a82e (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 6 length 6 (4) eap: No EAP Start, assuming it's an on-going EAP conversation (4) [eap] = updated (4) [files] = noop (4) [expiration] = noop (4) [logintime] = noop (4) [pap] = noop (4) } # authorize = updated (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0x7b06d3227800de54 (4) eap: Finished EAP session with state 0x7b06d3227800de54 (4) eap: Previous EAP request found for state 0x7b06d3227800de54, released from the list (4) eap: Peer sent packet with method EAP TLS (13) (4) eap: Calling submodule eap_tls to process data (4) eap_tls: Continuing EAP-TLS (4) eap_tls: Peer ACKed our handshake fragment (4) eap_tls: [eaptls verify] = request (4) eap_tls: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 7 length 1004 (4) eap: EAP session adding &reply:State = 0x7b06d3227f01de54 (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 13 from 192.168.30.242:1812 to 192.168.31.17:45736 length 0 (4) EAP-Message = 0x010703ec0dc0000011c154d5e00544c6144bfba1edab2d233934d3bb40cf01263caad059e6f13b53b494807337bf08851ec5a51694fa7688d10df56ff372674bb6cf033793e4b1f153d7cee272a18258299c77d88a34e117edbc87fe71e2e80923503f02e716a13f33cfa98ec3c121ff9c552abf435d44 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x7b06d3227f01de54c814d14a9f99a82e (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 14 from 192.168.31.17:40033 to 192.168.30.242:1812 length 155 (5) NAS-IP-Address = 192.168.28.164 (5) NAS-Port = 7 (5) User-Name = "host/07017CF14A4F9A00" (5) Called-Station-Id = "80-CC-9C-93-EC-E2" (5) Calling-Station-Id = "A4-BB-6D-62-41-2F" (5) Service-Type = Framed-User (5) Framed-MTU = 1300 (5) NAS-Port-Type = Ethernet (5) Message-Authenticator = 0x0c04189c659a1cb2386d0e48fcc44d3c (5) EAP-Message = 0x020700060d00 (5) State = 0x7b06d3227f01de54c814d14a9f99a82e (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 7 length 6 (5) eap: No EAP Start, assuming it's an on-going EAP conversation (5) [eap] = updated (5) [files] = noop (5) [expiration] = noop (5) [logintime] = noop (5) [pap] = noop (5) } # authorize = updated (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x7b06d3227f01de54 (5) eap: Finished EAP session with state 0x7b06d3227f01de54 (5) eap: Previous EAP request found for state 0x7b06d3227f01de54, released from the list (5) eap: Peer sent packet with method EAP TLS (13) (5) eap: Calling submodule eap_tls to process data (5) eap_tls: Continuing EAP-TLS (5) eap_tls: Peer ACKed our handshake fragment (5) eap_tls: [eaptls verify] = request (5) eap_tls: [eaptls process] = handled (5) eap: Sending EAP Request (code 1) ID 8 length 579 (5) eap: EAP session adding &reply:State = 0x7b06d3227e0ede54 (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 14 from 192.168.30.242:1812 to 192.168.31.17:40033 length 0 (5) EAP-Message = 0x010802430d80000011c1e9e434dfda7f2176ba0eafb1d8851556c83e28a1a1bf300bf7293eb3425ed46440163eb0fc03baba5ae97af16694ab5b9161abca6f4be936926693722890dbef31d1057a25ba905ff53912d293ef236d1dc0118e7f1ae680bede4fb817cff22c3d05da2a9288dc2a993f02a799 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x7b06d3227e0ede54c814d14a9f99a82e (5) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 9 with timestamp +43 (1) Cleaning up request packet ID 10 with timestamp +43 (2) Cleaning up request packet ID 11 with timestamp +43 (3) Cleaning up request packet ID 12 with timestamp +43 (4) Cleaning up request packet ID 13 with timestamp +43 (5) Cleaning up request packet ID 14 with timestamp +43 Ready to process requests (6) Received Access-Request Id 15 from 192.168.31.17:43802 to 192.168.30.242:1812 length 1435 Dropping packet without response because of error: Received packet from 192.168.31.17 with invalid Message-Authenticator! (Shared secret is incorrect.) Waking up in 0.3 seconds. (6) Cleaning up request packet ID 15 with timestamp +48 Ready to process requests (7) Received Access-Request Id 15 from 192.168.31.17:43802 to 192.168.30.242:1812 length 1435 Dropping packet without response because of error: Received packet from 192.168.31.17 with invalid Message-Authenticator! (Shared secret is incorrect.) Waking up in 0.3 seconds. (7) Cleaning up request packet ID 15 with timestamp +53 Ready to process requests (8) Received Access-Request Id 15 from 192.168.31.17:43802 to 192.168.30.242:1812 length 1435 Dropping packet without response because of error: Received packet from 192.168.31.17 with invalid Message-Authenticator! (Shared secret is incorrect.) Waking up in 0.3 seconds. (8) Cleaning up request packet ID 15 with timestamp +58 Ready to process requests (9) Received Access-Request Id 16 from 192.168.31.17:36625 to 192.168.30.242:1812 length 157 (9) NAS-IP-Address = 192.168.28.164 (9) NAS-Port = 7 (9) User-Name = "host/07017CF14A4F9A00" (9) Called-Station-Id = "80-CC-9C-93-EC-E2" (9) Calling-Station-Id = "A4-BB-6D-62-41-2F" (9) Service-Type = Framed-User (9) Framed-MTU = 1300 (9) NAS-Port-Type = Ethernet (9) Message-Authenticator = 0xc8c6081580a9865569e4cb822811fe75 (9) EAP-Message = 0x0201001a01686f73742f30373031374346313441344639413030 (9) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 1 length 26 (9) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) authenticate { (9) eap: Peer sent packet with method EAP Identity (1) (9) eap: Calling submodule eap_tls to process data (9) eap_tls: Initiating new EAP-TLS session (9) eap_tls: Setting verify mode to require certificate from client (9) eap_tls: [eaptls start] = request (9) eap: Sending EAP Request (code 1) ID 2 length 6 (9) eap: EAP session adding &reply:State = 0x252769892525641b (9) [eap] = handled (9) } # authenticate = handled (9) Using Post-Auth-Type Challenge (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) Challenge { ... } # empty sub-section is ignored (9) Sent Access-Challenge Id 16 from 192.168.30.242:1812 to 192.168.31.17:36625 length 0 (9) EAP-Message = 0x010200060d20 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0x252769892525641bdadcc75df5317f46 (9) Finished request Waking up in 4.9 seconds. (10) Received Access-Request Id 17 from 192.168.31.17:58526 to 192.168.30.242:1812 length 345 (10) NAS-IP-Address = 192.168.28.164 (10) NAS-Port = 7 (10) User-Name = "host/07017CF14A4F9A00" (10) Called-Station-Id = "80-CC-9C-93-EC-E2" (10) Calling-Station-Id = "A4-BB-6D-62-41-2F" (10) Service-Type = Framed-User (10) Framed-MTU = 1300 (10) NAS-Port-Type = Ethernet (10) Message-Authenticator = 0x227d41aa6a0c8996ba8d197d3c7b05b1 (10) EAP-Message = 0x020200c40d0016030100b9010000b5030389e1b4aca4da5d836b1e4409a203e5cb81ca8503321c4d1fb77a2826357948ee000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000054000b0004030001 (10) State = 0x252769892525641bdadcc75df5317f46 (10) session-state: No cached attributes (10) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (10) authorize { (10) policy filter_username { (10) if (&User-Name) { (10) if (&User-Name) -> TRUE (10) if (&User-Name) { (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@[^@]*@/ ) { (10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /(a)\./) { (10) if (&User-Name =~ /(a)\./) -> FALSE (10) } # if (&User-Name) = notfound (10) } # policy filter_username = notfound (10) [preprocess] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (10) suffix: No such realm "NULL" (10) [suffix] = noop (10) eap: Peer sent EAP Response (code 2) ID 2 length 196 (10) eap: No EAP Start, assuming it's an on-going EAP conversation (10) [eap] = updated (10) [files] = noop (10) [expiration] = noop (10) [logintime] = noop (10) [pap] = noop (10) } # authorize = updated (10) Found Auth-Type = eap (10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (10) authenticate { (10) eap: Expiring EAP session with state 0x7b06d3227e0ede54 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! EAP session with state 0x7b06d3227e0ede54c814d14a9f99a82e did not finish! !! !! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! (10) eap: Expiring EAP session with state 0x252769892525641b (10) eap: Finished EAP session with state 0x252769892525641b (10) eap: Previous EAP request found for state 0x252769892525641b, released from the list (10) eap: Peer sent packet with method EAP TLS (13) (10) eap: Calling submodule eap_tls to process data (10) eap_tls: Continuing EAP-TLS (10) eap_tls: Got final TLS record fragment (190 bytes) (10) eap_tls: WARNING: Total received TLS record fragments (190 bytes), does not equal indicated TLS record length (0 bytes) (10) eap_tls: [eaptls verify] = ok (10) eap_tls: Done initial handshake (10) eap_tls: (other): before SSL initialization (10) eap_tls: TLS_accept: before SSL initialization (10) eap_tls: TLS_accept: before SSL initialization (10) eap_tls: <<< recv UNKNOWN TLS VERSION ?0304? [length 00b9] (10) eap_tls: TLS_accept: SSLv3/TLS read client hello (10) eap_tls: >>> send TLS 1.2 [length 003d] (10) eap_tls: TLS_accept: SSLv3/TLS write server hello (10) eap_tls: >>> send TLS 1.2 [length 0fe0] (10) eap_tls: TLS_accept: SSLv3/TLS write certificate (10) eap_tls: >>> send TLS 1.2 [length 014d] (10) eap_tls: TLS_accept: SSLv3/TLS write key exchange (10) eap_tls: >>> send TLS 1.2 [length 003a] (10) eap_tls: TLS_accept: SSLv3/TLS write certificate request (10) eap_tls: >>> send TLS 1.2 [length 0004] (10) eap_tls: TLS_accept: SSLv3/TLS write server done (10) eap_tls: TLS_accept: Need to read more data: SSLv3/TLS write server done (10) eap_tls: In SSL Handshake Phase (10) eap_tls: In SSL Accept mode (10) eap_tls: [eaptls process] = handled (10) eap: Sending EAP Request (code 1) ID 3 length 1004 (10) eap: EAP session adding &reply:State = 0x252769892424641b (10) [eap] = handled (10) } # authenticate = handled (10) Using Post-Auth-Type Challenge (10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (10) Challenge { ... } # empty sub-section is ignored (10) Sent Access-Challenge Id 17 from 192.168.30.242:1812 to 192.168.31.17:58526 length 0 (10) EAP-Message = 0x010303ec0dc0000011c1160303003d0200003903036c473dd0faf933742fe9036a5cb35ad852e9e33095599b6b9b7ecbe75fcfb35a00c030000011ff01000100000b000403000102001700001603030fe00b000fdc000fd90005c9308205c5308203ada0030201020213470000000def2e5ac0160bdf88 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) State = 0x252769892424641bdadcc75df5317f46 (10) Finished request Waking up in 4.9 seconds. (11) Received Access-Request Id 18 from 192.168.31.17:48281 to 192.168.30.242:1812 length 155 (11) NAS-IP-Address = 192.168.28.164 (11) NAS-Port = 7 (11) User-Name = "host/07017CF14A4F9A00" (11) Called-Station-Id = "80-CC-9C-93-EC-E2" (11) Calling-Station-Id = "A4-BB-6D-62-41-2F" (11) Service-Type = Framed-User (11) Framed-MTU = 1300 (11) NAS-Port-Type = Ethernet (11) Message-Authenticator = 0x44d39d4396d8859d383ed1a473747a51 (11) EAP-Message = 0x020300060d00 (11) State = 0x252769892424641bdadcc75df5317f46 (11) session-state: No cached attributes (11) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (11) authorize { (11) policy filter_username { (11) if (&User-Name) { (11) if (&User-Name) -> TRUE (11) if (&User-Name) { (11) if (&User-Name =~ / /) { (11) if (&User-Name =~ / /) -> FALSE (11) if (&User-Name =~ /@[^@]*@/ ) { (11) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (11) if (&User-Name =~ /\.\./ ) { (11) if (&User-Name =~ /\.\./ ) -> FALSE (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (11) if (&User-Name =~ /\.$/) { (11) if (&User-Name =~ /\.$/) -> FALSE (11) if (&User-Name =~ /(a)\./) { (11) if (&User-Name =~ /(a)\./) -> FALSE (11) } # if (&User-Name) = notfound (11) } # policy filter_username = notfound (11) [preprocess] = ok (11) [chap] = noop (11) [mschap] = noop (11) [digest] = noop (11) suffix: Checking for suffix after "@" (11) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (11) suffix: No such realm "NULL" (11) [suffix] = noop (11) eap: Peer sent EAP Response (code 2) ID 3 length 6 (11) eap: No EAP Start, assuming it's an on-going EAP conversation (11) [eap] = updated (11) [files] = noop (11) [expiration] = noop (11) [logintime] = noop (11) [pap] = noop (11) } # authorize = updated (11) Found Auth-Type = eap (11) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (11) authenticate { (11) eap: Expiring EAP session with state 0x252769892424641b (11) eap: Finished EAP session with state 0x252769892424641b (11) eap: Previous EAP request found for state 0x252769892424641b, released from the list (11) eap: Peer sent packet with method EAP TLS (13) (11) eap: Calling submodule eap_tls to process data (11) eap_tls: Continuing EAP-TLS (11) eap_tls: Peer ACKed our handshake fragment (11) eap_tls: [eaptls verify] = request (11) eap_tls: [eaptls process] = handled (11) eap: Sending EAP Request (code 1) ID 4 length 1004 (11) eap: EAP session adding &reply:State = 0x252769892723641b (11) [eap] = handled (11) } # authenticate = handled (11) Using Post-Auth-Type Challenge (11) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (11) Challenge { ... } # empty sub-section is ignored (11) Sent Access-Challenge Id 18 from 192.168.30.242:1812 to 192.168.31.17:48281 length 0 (11) EAP-Message = 0x010403ec0dc0000011c1653f6f626a656374436c6173733d63657274696669636174696f6e417574686f72697479300d06092a864886f70d01010b050003820201008d414e224f1117b36c14254233210a280c7d56fdaf530b52ad532adec3765d32380d0197bd39b965611b05a1814099ef250dbbcd1e (11) Message-Authenticator = 0x00000000000000000000000000000000 (11) State = 0x252769892723641bdadcc75df5317f46 (11) Finished request Waking up in 4.9 seconds. (12) Received Access-Request Id 19 from 192.168.31.17:36746 to 192.168.30.242:1812 length 155 (12) NAS-IP-Address = 192.168.28.164 (12) NAS-Port = 7 (12) User-Name = "host/07017CF14A4F9A00" (12) Called-Station-Id = "80-CC-9C-93-EC-E2" (12) Calling-Station-Id = "A4-BB-6D-62-41-2F" (12) Service-Type = Framed-User (12) Framed-MTU = 1300 (12) NAS-Port-Type = Ethernet (12) Message-Authenticator = 0x05de22f45a3efe3456c38a4db9475854 (12) EAP-Message = 0x020400060d00 (12) State = 0x252769892723641bdadcc75df5317f46 (12) session-state: No cached attributes (12) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (12) authorize { (12) policy filter_username { (12) if (&User-Name) { (12) if (&User-Name) -> TRUE (12) if (&User-Name) { (12) if (&User-Name =~ / /) { (12) if (&User-Name =~ / /) -> FALSE (12) if (&User-Name =~ /@[^@]*@/ ) { (12) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (12) if (&User-Name =~ /\.\./ ) { (12) if (&User-Name =~ /\.\./ ) -> FALSE (12) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (12) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (12) if (&User-Name =~ /\.$/) { (12) if (&User-Name =~ /\.$/) -> FALSE (12) if (&User-Name =~ /(a)\./) { (12) if (&User-Name =~ /(a)\./) -> FALSE (12) } # if (&User-Name) = notfound (12) } # policy filter_username = notfound (12) [preprocess] = ok (12) [chap] = noop (12) [mschap] = noop (12) [digest] = noop (12) suffix: Checking for suffix after "@" (12) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (12) suffix: No such realm "NULL" (12) [suffix] = noop (12) eap: Peer sent EAP Response (code 2) ID 4 length 6 (12) eap: No EAP Start, assuming it's an on-going EAP conversation (12) [eap] = updated (12) [files] = noop (12) [expiration] = noop (12) [logintime] = noop (12) [pap] = noop (12) } # authorize = updated (12) Found Auth-Type = eap (12) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (12) authenticate { (12) eap: Expiring EAP session with state 0x252769892723641b (12) eap: Finished EAP session with state 0x252769892723641b (12) eap: Previous EAP request found for state 0x252769892723641b, released from the list (12) eap: Peer sent packet with method EAP TLS (13) (12) eap: Calling submodule eap_tls to process data (12) eap_tls: Continuing EAP-TLS (12) eap_tls: Peer ACKed our handshake fragment (12) eap_tls: [eaptls verify] = request (12) eap_tls: [eaptls process] = handled (12) eap: Sending EAP Request (code 1) ID 5 length 1004 (12) eap: EAP session adding &reply:State = 0x252769892622641b (12) [eap] = handled (12) } # authenticate = handled (12) Using Post-Auth-Type Challenge (12) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (12) Challenge { ... } # empty sub-section is ignored (12) Sent Access-Challenge Id 19 from 192.168.30.242:1812 to 192.168.31.17:36746 length 0 (12) EAP-Message = 0x010503ec0dc0000011c1ab0cb2199b3d9d5d34d9f5072dfe7fe6bcacdcea19de101694fe88e33f4d62a86ffe280fba1884b08213f42dada39b00cc28a336c58611b150a2c3b943cb835ea3f3afb6c13e2db1482e8e087d93ab980cd11b78d527ac930203010001a3693067301306092b06010401823714 (12) Message-Authenticator = 0x00000000000000000000000000000000 (12) State = 0x252769892622641bdadcc75df5317f46 (12) Finished request Waking up in 4.9 seconds. (13) Received Access-Request Id 20 from 192.168.31.17:57212 to 192.168.30.242:1812 length 155 (13) NAS-IP-Address = 192.168.28.164 (13) NAS-Port = 7 (13) User-Name = "host/07017CF14A4F9A00" (13) Called-Station-Id = "80-CC-9C-93-EC-E2" (13) Calling-Station-Id = "A4-BB-6D-62-41-2F" (13) Service-Type = Framed-User (13) Framed-MTU = 1300 (13) NAS-Port-Type = Ethernet (13) Message-Authenticator = 0x08051fbe4d2eee327f6fbfdd79088a69 (13) EAP-Message = 0x020500060d00 (13) State = 0x252769892622641bdadcc75df5317f46 (13) session-state: No cached attributes (13) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (13) authorize { (13) policy filter_username { (13) if (&User-Name) { (13) if (&User-Name) -> TRUE (13) if (&User-Name) { (13) if (&User-Name =~ / /) { (13) if (&User-Name =~ / /) -> FALSE (13) if (&User-Name =~ /@[^@]*@/ ) { (13) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (13) if (&User-Name =~ /\.\./ ) { (13) if (&User-Name =~ /\.\./ ) -> FALSE (13) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (13) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (13) if (&User-Name =~ /\.$/) { (13) if (&User-Name =~ /\.$/) -> FALSE (13) if (&User-Name =~ /(a)\./) { (13) if (&User-Name =~ /(a)\./) -> FALSE (13) } # if (&User-Name) = notfound (13) } # policy filter_username = notfound (13) [preprocess] = ok (13) [chap] = noop (13) [mschap] = noop (13) [digest] = noop (13) suffix: Checking for suffix after "@" (13) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (13) suffix: No such realm "NULL" (13) [suffix] = noop (13) eap: Peer sent EAP Response (code 2) ID 5 length 6 (13) eap: No EAP Start, assuming it's an on-going EAP conversation (13) [eap] = updated (13) [files] = noop (13) [expiration] = noop (13) [logintime] = noop (13) [pap] = noop (13) } # authorize = updated (13) Found Auth-Type = eap (13) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (13) authenticate { (13) eap: Expiring EAP session with state 0x252769892622641b (13) eap: Finished EAP session with state 0x252769892622641b (13) eap: Previous EAP request found for state 0x252769892622641b, released from the list (13) eap: Peer sent packet with method EAP TLS (13) (13) eap: Calling submodule eap_tls to process data (13) eap_tls: Continuing EAP-TLS (13) eap_tls: Peer ACKed our handshake fragment (13) eap_tls: [eaptls verify] = request (13) eap_tls: [eaptls process] = handled (13) eap: Sending EAP Request (code 1) ID 6 length 1004 (13) eap: EAP session adding &reply:State = 0x252769892121641b (13) [eap] = handled (13) } # authenticate = handled (13) Using Post-Auth-Type Challenge (13) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (13) Challenge { ... } # empty sub-section is ignored (13) Sent Access-Challenge Id 20 from 192.168.30.242:1812 to 192.168.31.17:57212 length 0 (13) EAP-Message = 0x010603ec0dc0000011c154d5e00544c6144bfba1edab2d233934d3bb40cf01263caad059e6f13b53b494807337bf08851ec5a51694fa7688d10df56ff372674bb6cf033793e4b1f153d7cee272a18258299c77d88a34e117edbc87fe71e2e80923503f02e716a13f33cfa98ec3c121ff9c552abf435d44 (13) Message-Authenticator = 0x00000000000000000000000000000000 (13) State = 0x252769892121641bdadcc75df5317f46 (13) Finished request Waking up in 4.9 seconds. (14) Received Access-Request Id 21 from 192.168.31.17:43188 to 192.168.30.242:1812 length 155 (14) NAS-IP-Address = 192.168.28.164 (14) NAS-Port = 7 (14) User-Name = "host/07017CF14A4F9A00" (14) Called-Station-Id = "80-CC-9C-93-EC-E2" (14) Calling-Station-Id = "A4-BB-6D-62-41-2F" (14) Service-Type = Framed-User (14) Framed-MTU = 1300 (14) NAS-Port-Type = Ethernet (14) Message-Authenticator = 0xbdcc02caa996f426722b8f6218405ced (14) EAP-Message = 0x020600060d00 (14) State = 0x252769892121641bdadcc75df5317f46 (14) session-state: No cached attributes (14) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (14) authorize { (14) policy filter_username { (14) if (&User-Name) { (14) if (&User-Name) -> TRUE (14) if (&User-Name) { (14) if (&User-Name =~ / /) { (14) if (&User-Name =~ / /) -> FALSE (14) if (&User-Name =~ /@[^@]*@/ ) { (14) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (14) if (&User-Name =~ /\.\./ ) { (14) if (&User-Name =~ /\.\./ ) -> FALSE (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (14) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (14) if (&User-Name =~ /\.$/) { (14) if (&User-Name =~ /\.$/) -> FALSE (14) if (&User-Name =~ /(a)\./) { (14) if (&User-Name =~ /(a)\./) -> FALSE (14) } # if (&User-Name) = notfound (14) } # policy filter_username = notfound (14) [preprocess] = ok (14) [chap] = noop (14) [mschap] = noop (14) [digest] = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (14) suffix: No such realm "NULL" (14) [suffix] = noop (14) eap: Peer sent EAP Response (code 2) ID 6 length 6 (14) eap: No EAP Start, assuming it's an on-going EAP conversation (14) [eap] = updated (14) [files] = noop (14) [expiration] = noop (14) [logintime] = noop (14) [pap] = noop (14) } # authorize = updated (14) Found Auth-Type = eap (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) authenticate { (14) eap: Expiring EAP session with state 0x252769892121641b (14) eap: Finished EAP session with state 0x252769892121641b (14) eap: Previous EAP request found for state 0x252769892121641b, released from the list (14) eap: Peer sent packet with method EAP TLS (13) (14) eap: Calling submodule eap_tls to process data (14) eap_tls: Continuing EAP-TLS (14) eap_tls: Peer ACKed our handshake fragment (14) eap_tls: [eaptls verify] = request (14) eap_tls: [eaptls process] = handled (14) eap: Sending EAP Request (code 1) ID 7 length 579 (14) eap: EAP session adding &reply:State = 0x252769892020641b (14) [eap] = handled (14) } # authenticate = handled (14) Using Post-Auth-Type Challenge (14) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (14) Challenge { ... } # empty sub-section is ignored (14) Sent Access-Challenge Id 21 from 192.168.30.242:1812 to 192.168.31.17:43188 length 0 (14) EAP-Message = 0x010702430d80000011c1e9e434dfda7f2176ba0eafb1d8851556c83e28a1a1bf300bf7293eb3425ed46440163eb0fc03baba5ae97af16694ab5b9161abca6f4be936926693722890dbef31d1057a25ba905ff53912d293ef236d1dc0118e7f1ae680bede4fb817cff22c3d05da2a9288dc2a993f02a799 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0x252769892020641bdadcc75df5317f46 (14) Finished request Waking up in 4.8 seconds. (15) Received Access-Request Id 22 from 192.168.31.17:54714 to 192.168.30.242:1812 length 1435 (15) NAS-IP-Address = 192.168.28.164 (15) NAS-Port = 7 (15) User-Name = "host/07017CF14A4F9A00" (15) Called-Station-Id = "80-CC-9C-93-EC-E2" (15) Calling-Station-Id = "A4-BB-6D-62-41-2F" (15) Service-Type = Framed-User (15) Framed-MTU = 1300 (15) NAS-Port-Type = Ethernet (15) Message-Authenticator = 0xbe6b6255b6000dc930e0eea5c9105d93 (15) EAP-Message = 0x020704fc0dc00000071e160303058e0b00058a0005870005843082058030820468a00302010202133f0005b7ce2ac4ec72769d3d5200030005b7ce300d06092a864886f70d01010b0500304731153013060a0992268993f22c64011916056c6f63616c31173015060a0992268993f22c64011916077465 (15) State = 0x252769892020641bdadcc75df5317f46 (15) session-state: No cached attributes (15) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (15) authorize { (15) policy filter_username { (15) if (&User-Name) { (15) if (&User-Name) -> TRUE (15) if (&User-Name) { (15) if (&User-Name =~ / /) { (15) if (&User-Name =~ / /) -> FALSE (15) if (&User-Name =~ /@[^@]*@/ ) { (15) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (15) if (&User-Name =~ /\.\./ ) { (15) if (&User-Name =~ /\.\./ ) -> FALSE (15) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (15) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (15) if (&User-Name =~ /\.$/) { (15) if (&User-Name =~ /\.$/) -> FALSE (15) if (&User-Name =~ /(a)\./) { (15) if (&User-Name =~ /(a)\./) -> FALSE (15) } # if (&User-Name) = notfound (15) } # policy filter_username = notfound (15) [preprocess] = ok (15) [chap] = noop (15) [mschap] = noop (15) [digest] = noop (15) suffix: Checking for suffix after "@" (15) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (15) suffix: No such realm "NULL" (15) [suffix] = noop (15) eap: Peer sent EAP Response (code 2) ID 7 length 1276 (15) eap: No EAP Start, assuming it's an on-going EAP conversation (15) [eap] = updated (15) [files] = noop (15) [expiration] = noop (15) [logintime] = noop (15) [pap] = noop (15) } # authorize = updated (15) Found Auth-Type = eap (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (15) authenticate { (15) eap: Expiring EAP session with state 0x252769892020641b (15) eap: Finished EAP session with state 0x252769892020641b (15) eap: Previous EAP request found for state 0x252769892020641b, released from the list (15) eap: Peer sent packet with method EAP TLS (13) (15) eap: Calling submodule eap_tls to process data (15) eap_tls: Continuing EAP-TLS (15) eap_tls: Peer indicated complete TLS record size will be 1822 bytes (15) eap_tls: Expecting 2 TLS record fragments (15) eap_tls: Got first TLS record fragment (1266 bytes). Peer indicated more fragments to follow (15) eap_tls: [eaptls verify] = first fragment (15) eap_tls: ACKing Peer's TLS record fragment (15) eap_tls: [eaptls process] = handled (15) eap: Sending EAP Request (code 1) ID 8 length 6 (15) eap: EAP session adding &reply:State = 0x25276989232f641b (15) [eap] = handled (15) } # authenticate = handled (15) Using Post-Auth-Type Challenge (15) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (15) Challenge { ... } # empty sub-section is ignored (15) Sent Access-Challenge Id 22 from 192.168.30.242:1812 to 192.168.31.17:54714 length 0 (15) EAP-Message = 0x010800060d00 (15) Message-Authenticator = 0x00000000000000000000000000000000 (15) State = 0x25276989232f641bdadcc75df5317f46 (15) Finished request Waking up in 4.8 seconds. (16) Received Access-Request Id 23 from 192.168.31.17:57919 to 192.168.30.242:1812 length 715 (16) NAS-IP-Address = 192.168.28.164 (16) NAS-Port = 7 (16) User-Name = "host/07017CF14A4F9A00" (16) Called-Station-Id = "80-CC-9C-93-EC-E2" (16) Calling-Station-Id = "A4-BB-6D-62-41-2F" (16) Service-Type = Framed-User (16) Framed-MTU = 1300 (16) NAS-Port-Type = Ethernet (16) Message-Authenticator = 0x1f8bf58c063f627077be4404cedb6e90 (16) EAP-Message = 0x020802320d0035062309231f79616c09cfd597f681d521cdc57358ae0a93fcee2fc4a4fa947f9c357ad9f41e1489600e57850d21248459c854a645f14546c42a69770c2b622e0fb6502fd5e6a72c1d028581695d7d9c50685273be2464f458087101784ab5df37016bed2baa22bbe290c5739cf0764390 (16) State = 0x25276989232f641bdadcc75df5317f46 (16) session-state: No cached attributes (16) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (16) authorize { (16) policy filter_username { (16) if (&User-Name) { (16) if (&User-Name) -> TRUE (16) if (&User-Name) { (16) if (&User-Name =~ / /) { (16) if (&User-Name =~ / /) -> FALSE (16) if (&User-Name =~ /@[^@]*@/ ) { (16) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (16) if (&User-Name =~ /\.\./ ) { (16) if (&User-Name =~ /\.\./ ) -> FALSE (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (16) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (16) if (&User-Name =~ /\.$/) { (16) if (&User-Name =~ /\.$/) -> FALSE (16) if (&User-Name =~ /(a)\./) { (16) if (&User-Name =~ /(a)\./) -> FALSE (16) } # if (&User-Name) = notfound (16) } # policy filter_username = notfound (16) [preprocess] = ok (16) [chap] = noop (16) [mschap] = noop (16) [digest] = noop (16) suffix: Checking for suffix after "@" (16) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (16) suffix: No such realm "NULL" (16) [suffix] = noop (16) eap: Peer sent EAP Response (code 2) ID 8 length 562 (16) eap: No EAP Start, assuming it's an on-going EAP conversation (16) [eap] = updated (16) [files] = noop (16) [expiration] = noop (16) [logintime] = noop (16) [pap] = noop (16) } # authorize = updated (16) Found Auth-Type = eap (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (16) authenticate { (16) eap: Expiring EAP session with state 0x25276989232f641b (16) eap: Finished EAP session with state 0x25276989232f641b (16) eap: Previous EAP request found for state 0x25276989232f641b, released from the list (16) eap: Peer sent packet with method EAP TLS (13) (16) eap: Calling submodule eap_tls to process data (16) eap_tls: Continuing EAP-TLS (16) eap_tls: Got final TLS record fragment (556 bytes) (16) eap_tls: [eaptls verify] = ok (16) eap_tls: Done initial handshake (16) eap_tls: TLS_accept: SSLv3/TLS write server done (16) eap_tls: <<< recv TLS 1.2 [length 058e] (16) eap_tls: Creating attributes from certificate OIDs (16) eap_tls: Creating attributes from certificate OIDs (16) eap_tls: TLS-Cert-Serial := "3300005807f6feb7bf7d4fc694000000005807" (16) eap_tls: TLS-Cert-Expiration := "230415101043Z" (16) eap_tls: TLS-Cert-Subject := "/DC=local/DC=testlab/CN=Device-SubCA" (16) eap_tls: TLS-Cert-Issuer := "/DC=local/DC=testlab/CN=Device-CA" (16) eap_tls: TLS-Cert-Common-Name := "Device-SubCA" (16) eap_tls: Creating attributes from certificate OIDs (16) eap_tls: TLS-Client-Cert-Serial := "3f0005b7ce2ac4ec72769d3d5200030005b7ce" (16) eap_tls: TLS-Client-Cert-Expiration := "230415101043Z" (16) eap_tls: TLS-Client-Cert-Subject := "/CN=07017CF14A4F9A00" (16) eap_tls: TLS-Client-Cert-Issuer := "/DC=local/DC=testlab/CN=Device-SubCA" (16) eap_tls: TLS-Client-Cert-Common-Name := "07017CF14A4F9A00" (16) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Dns := "07017CF14A4F9A00" (16) eap_tls: TLS-Client-Cert-X509v3-Subject-Key-Identifier += "00:A4:6F:46:55:A0:3F:D4:62:70:4F:99:8A:28:59:1C:C2:A4:90:09" (16) eap_tls: TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:73:2B:38:63:7E:C9:B4:EC:2C:DF:DF:6A:86:24:F7:B2:E2:76:E1:78\n" (16) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Server Authentication, TLS Web Client Authentication" (16) eap_tls: Verifying client certificate: /bin/cp %{TLS-Client-Cert-Filename} /tmp/certs/test.cert (16) eap_tls: Executing: /bin/cp %{TLS-Client-Cert-Filename} /tmp/certs/test.cert: (16) eap_tls: EXPAND %{TLS-Client-Cert-Filename} (16) eap_tls: --> /var/cache/freerad/radiusd.client.XXrVGTee (16) eap_tls: Program returned code (0) and output '' (16) eap_tls: Client certificate CN 07017CF14A4F9A00 passed external validation (16) eap_tls: TLS_accept: SSLv3/TLS read client certificate (16) eap_tls: <<< recv TLS 1.2 [length 0046] (16) eap_tls: TLS_accept: SSLv3/TLS read client key exchange (16) eap_tls: <<< recv TLS 1.2 [length 0108] (16) eap_tls: TLS_accept: SSLv3/TLS read certificate verify (16) eap_tls: TLS_accept: SSLv3/TLS read change cipher spec (16) eap_tls: <<< recv TLS 1.2 [length 0010] (16) eap_tls: TLS_accept: SSLv3/TLS read finished (16) eap_tls: >>> send TLS 1.2 [length 0001] (16) eap_tls: TLS_accept: SSLv3/TLS write change cipher spec (16) eap_tls: >>> send TLS 1.2 [length 0010] (16) eap_tls: TLS_accept: SSLv3/TLS write finished (16) eap_tls: (other): SSL negotiation finished successfully (16) eap_tls: SSL Connection Established (16) eap_tls: [eaptls process] = handled (16) eap: Sending EAP Request (code 1) ID 9 length 61 (16) eap: EAP session adding &reply:State = 0x25276989222e641b (16) [eap] = handled (16) } # authenticate = handled (16) Using Post-Auth-Type Challenge (16) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (16) Challenge { ... } # empty sub-section is ignored (16) Sent Access-Challenge Id 23 from 192.168.30.242:1812 to 192.168.31.17:57919 length 0 (16) EAP-Message = 0x0109003d0d800000003314030300010116030300281cda7d5172c882c6d2d7507280f4d8b6d1c5d57d16a2aeacacc99a4db1ed5445362edad31448b2d9 (16) Message-Authenticator = 0x00000000000000000000000000000000 (16) State = 0x25276989222e641bdadcc75df5317f46 (16) Finished request Waking up in 4.8 seconds. (17) Received Access-Request Id 24 from 192.168.31.17:41633 to 192.168.30.242:1812 length 155 (17) NAS-IP-Address = 192.168.28.164 (17) NAS-Port = 7 (17) User-Name = "host/07017CF14A4F9A00" (17) Called-Station-Id = "80-CC-9C-93-EC-E2" (17) Calling-Station-Id = "A4-BB-6D-62-41-2F" (17) Service-Type = Framed-User (17) Framed-MTU = 1300 (17) NAS-Port-Type = Ethernet (17) Message-Authenticator = 0x50a7a690843d3d838c9e58ec96d47437 (17) EAP-Message = 0x020900060d00 (17) State = 0x25276989222e641bdadcc75df5317f46 (17) session-state: No cached attributes (17) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (17) authorize { (17) policy filter_username { (17) if (&User-Name) { (17) if (&User-Name) -> TRUE (17) if (&User-Name) { (17) if (&User-Name =~ / /) { (17) if (&User-Name =~ / /) -> FALSE (17) if (&User-Name =~ /@[^@]*@/ ) { (17) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (17) if (&User-Name =~ /\.\./ ) { (17) if (&User-Name =~ /\.\./ ) -> FALSE (17) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (17) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (17) if (&User-Name =~ /\.$/) { (17) if (&User-Name =~ /\.$/) -> FALSE (17) if (&User-Name =~ /(a)\./) { (17) if (&User-Name =~ /(a)\./) -> FALSE (17) } # if (&User-Name) = notfound (17) } # policy filter_username = notfound (17) [preprocess] = ok (17) [chap] = noop (17) [mschap] = noop (17) [digest] = noop (17) suffix: Checking for suffix after "@" (17) suffix: No '@' in User-Name = "host/07017CF14A4F9A00", looking up realm NULL (17) suffix: No such realm "NULL" (17) [suffix] = noop (17) eap: Peer sent EAP Response (code 2) ID 9 length 6 (17) eap: No EAP Start, assuming it's an on-going EAP conversation (17) [eap] = updated (17) [files] = noop (17) [expiration] = noop (17) [logintime] = noop (17) [pap] = noop (17) } # authorize = updated (17) Found Auth-Type = eap (17) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (17) authenticate { (17) eap: Expiring EAP session with state 0x25276989222e641b (17) eap: Finished EAP session with state 0x25276989222e641b (17) eap: Previous EAP request found for state 0x25276989222e641b, released from the list (17) eap: Peer sent packet with method EAP TLS (13) (17) eap: Calling submodule eap_tls to process data (17) eap_tls: Continuing EAP-TLS (17) eap_tls: Peer ACKed our handshake fragment. handshake is finished (17) eap_tls: [eaptls verify] = success (17) eap_tls: [eaptls process] = success (17) eap_tls: Validating certificate (17) Virtual server check-eap-tls received request (17) NAS-IP-Address = 192.168.28.164 (17) NAS-Port = 7 (17) User-Name = "host/07017CF14A4F9A00" (17) Called-Station-Id = "80-CC-9C-93-EC-E2" (17) Calling-Station-Id = "A4-BB-6D-62-41-2F" (17) Service-Type = Framed-User (17) Framed-MTU = 1300 (17) NAS-Port-Type = Ethernet (17) Message-Authenticator = 0x50a7a690843d3d838c9e58ec96d47437 (17) EAP-Message = 0x020900060d00 (17) State = 0x25276989222e641bdadcc75df5317f46 (17) Event-Timestamp = "Oct 6 2022 08:06:18 UTC" (17) EAP-Type = TLS (17) TLS-Cert-Serial := "3300005807f6feb7bf7d4fc694000000005807" (17) TLS-Cert-Expiration := "230415101043Z" (17) TLS-Cert-Subject := "/DC=local/DC=testlab/CN=Device-SubCA" (17) TLS-Cert-Issuer := "/DC=local/DC=testlab/CN=Device-CA" (17) TLS-Cert-Common-Name := "Device-SubCA" (17) TLS-Client-Cert-Serial := "3f0005b7ce2ac4ec72769d3d5200030005b7ce" (17) TLS-Client-Cert-Expiration := "230415101043Z" (17) TLS-Client-Cert-Subject := "/CN=07017CF14A4F9A00" (17) TLS-Client-Cert-Issuer := "/DC=local/DC=testlab/CN=Device-SubCA" (17) TLS-Client-Cert-Common-Name := "07017CF14A4F9A00" (17) TLS-Client-Cert-Subject-Alt-Name-Dns := "07017CF14A4F9A00" (17) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "00:A4:6F:46:55:A0:3F:D4:62:70:4F:99:8A:28:59:1C:C2:A4:90:09" (17) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:73:2B:38:63:7E:C9:B4:EC:2C:DF:DF:6A:86:24:F7:B2:E2:76:E1:78\n" (17) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Server Authentication, TLS Web Client Authentication" (17) WARNING: Outer and inner identities are the same. User privacy is compromised. (17) server check-eap-tls { (17) session-state: No cached attributes (17) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/check-eap-tls (17) authorize { (17) update config { (17) &Auth-Type := Accept (17) } # update config = noop (17) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (17) auth_log: --> /usr/local/var/log/radius/radacct/ 192.168.31.17/auth-detail-20221006 (17) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/ 192.168.31.17/auth-detail-20221006 (17) auth_log: EXPAND %t (17) auth_log: --> Thu Oct 6 08:06:18 2022 (17) [auth_log] = ok (17) } # authorize = ok (17) Found Auth-Type = Accept (17) Auth-Type = Accept, accepting the user (17) Login OK: [host/07017CF14A4F9A00/<via Auth-Type = Accept>] (from client 192.168.31.17 port 7 cli A4-BB-6D-62-41-2F via TLS tunnel) (17) } # server check-eap-tls (17) Virtual server sending reply (17) eap: Sending EAP Success (code 3) ID 9 length 4 (17) eap: Freeing handler (17) [eap] = ok (17) } # authenticate = ok (17) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (17) post-auth { (17) update { (17) No attributes updated (17) } # update = noop (17) [exec] = noop (17) policy remove_reply_message_if_eap { (17) if (&reply:EAP-Message && &reply:Reply-Message) { (17) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (17) else { (17) [noop] = noop (17) } # else = noop (17) } # policy remove_reply_message_if_eap = noop (17) } # post-auth = noop (17) Login OK: [host/07017CF14A4F9A00/<via Auth-Type = eap>] (from client 192.168.31.17 port 7 cli A4-BB-6D-62-41-2F) (17) Sent Access-Accept Id 24 from 192.168.30.242:1812 to 192.168.31.17:41633 length 0 (17) MS-MPPE-Recv-Key = 0x479bb21721265834a85a1efde49164b03cf4264c1ec9fb486e1154150f0c0275 (17) MS-MPPE-Send-Key = 0x2fc976bf8bf99db38af786a755d160d5f627f5e296e30b6c11b04c83d91b3c96 (17) EAP-Message = 0x03090004 (17) Message-Authenticator = 0x00000000000000000000000000000000 (17) User-Name = "host/07017CF14A4F9A00" (17) Finished request Waking up in 4.7 seconds. (9) Cleaning up request packet ID 16 with timestamp +134 (10) Cleaning up request packet ID 17 with timestamp +134 (11) Cleaning up request packet ID 18 with timestamp +134 (12) Cleaning up request packet ID 19 with timestamp +134 (13) Cleaning up request packet ID 20 with timestamp +134 (14) Cleaning up request packet ID 21 with timestamp +134 (15) Cleaning up request packet ID 22 with timestamp +134 (16) Cleaning up request packet ID 23 with timestamp +134 (17) Cleaning up request packet ID 24 with timestamp +134 Ready to process requests

2 2

PEAP and TLS 1.3 on brnach 3.2.x?
by Stefan Winter 06 Oct '22

06 Oct '22

Hello, in the Changelog, I read that 3.0.26 now supports PEAP+TTLS on TLS 1.3. Good! I didn't find a similar entry in the 3.2.x release train. Does this work on 3.2.x already, or is this pending for a future release? (We do get user reports about EAP failures with Windows 11 22H2 which in parts may be related to TLS 1.3 negotiation failures on older 3.0.x releases, and wonder what exactly to suggest as an upgrade path) (other root causes seem to be Windows 11 Enterprise 22H2 and it's Credential Guard feature that prevents PEAP/MSCHAPv2 from functioning; still investigating and that is of course nothing where FreeRADIUS can help - we just want to get any ("simple") noise from TLS negos and old versions out of the way) Greetings, Stefan Winter -- This email may contain information for limited distribution only, please treat accordingly. Fondation Restena, Stefan WINTER Chief Technology Officer 2, avenue de l'Université L-4365 Esch-sur-Alzette

2 1

Re: Checkrad and IPv6 NAS IP address
by Fabricio Viana 05 Oct '22

05 Oct '22

Hello Alan, how are you? I ran some tests as fast as I could. Now it's giving the following message: (0) sql: Executing select query: SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = 'joseph.test' AND acctstoptime IS NULL checkrad: Unknown NAS 2804:444:1:1::2, not checking NAS 2804:444:1:1::2 was added normally: rlm_sql (sql): Adding client 2804:444:1:1::2 (R1.ITU) to global clients list rlm_sql (2804:444:1:1::2): Client "R1.ITU" (sql) added Authentication normally takes place with IPv6. The problem is with checkrad. Below is the Access-Request package and the freeradius -X command output. Could you help please? Thank you! Fabricio Viana root@li1268-188:/# freeradius -v radiusd: FreeRADIUS Version 3.0.24 (git #83d87a2), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.0.24 (0) Received Access-Request Id 142 from [2804:444:1:1::2]:33926 to [2600:4a00::f132:91a4:f567:34fd]:1812 length 185 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) NAS-Port = 15813747 (0) NAS-Port-Type = Ethernet (0) User-Name = "joseph.test" (0) Calling-Station-Id = "AA:BB:B6:41:33:AA" (0) Called-Station-Id = "pppoe-server-olt02" (0) NAS-Port-Id = "ether3.501-PPPoE-OLT02" (0) CHAP-Challenge = 0x388b23cbdc8d67936f09a731c70acf6e (0) CHAP-Password = 0x018003bc3835139074138c89d63370276a (0) NAS-Identifier = "R1.ITU" (0) NAS-IPv6-Address = 2804:444:1:1::2 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) if ("%{Cisco-AVPair[*]}" =~ /client-mac-address=(.*)/) { (0) EXPAND %{Cisco-AVPair[*]} (0) --> (0) if ("%{Cisco-AVPair[*]}" =~ /client-mac-address=(.*)/) -> FALSE (0) elsif (ERX-Dhcp-Mac-Addr =~ /^([a-f0-9][a-f0-9])([a-f0-9][a-f0-9]).([a-f0-9][a-f0-9])([a-f0-9][a-f0-9]).([a-f0-9][a-f0-9])([a-f0-9][a-f0-9])$/) { (0) ERROR: Failed retrieving values required to evaluate condition (0) else { (0) update request { (0) EXPAND %{toupper:%{Calling-Station-Id}} (0) --> AA:BB:B6:41:33:AA (0) Calling-Station-Id := AA:BB:B6:41:33:AA (0) } # update request = noop (0) } # else = noop (0) if (!control:Cleartext-Password){ (0) if (!control:Cleartext-Password) -> TRUE (0) if (!control:Cleartext-Password) { (0) update control { (0) Cleartext-Password := "no_user_found_radiusnet" (0) } # update control = noop (0) } # if (!control:Cleartext-Password) = noop (0) [preprocess] = ok (0) chap: &control:Auth-Type := CHAP (0) [chap] = ok (0) [mschap] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> joseph.test (0) sql: SQL-User-Name set to 'joseph.test' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'joseph.test' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'joseph.test' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "ellen8858" (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'joseph.test' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'joseph.test' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'joseph.test' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'joseph.test' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '2BLO' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '2BLO' ORDER BY id (0) sql: Group "2BLO": Conditional check items matched (0) sql: Group "2BLO": Merging assignment check items (0) sql: Simultaneous-Use := 1 (0) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id (0) sql: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '2BLO' ORDER BY id (0) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '2BLO' ORDER BY id (0) sql: Group "2BLO": Merging reply items (0) sql: Mikrotik-Rate-Limit = "100k/100k" (0) sql: WISPr-Bandwidth-Max-Down = 100000 (0) sql: WISPr-Bandwidth-Max-Up = 100000 (0) sql: Framed-Pool = "pool_bloqueados" (0) sql: Mikrotik-Address-List = "bloqueados" rlm_sql (sql): Released connection (1) (0) [sql] = ok (0) pap: WARNING: Auth-Type already set. Not setting to PAP (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = CHAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Auth-Type CHAP { (0) chap: Comparing with "known good" Cleartext-Password (0) chap: CHAP user "joseph.test" authenticated successfully (0) [chap] = ok (0) if (request:Service-Type == Login-User && !request:NAS-Port-Type && !reply:Mikrotik-Group){ (0) if (request:Service-Type == Login-User && !request:NAS-Port-Type && !reply:Mikrotik-Group) -> FALSE (0) if (request:Service-Type == Login-User && request:NAS-Port-Type && reply:Mikrotik-Group){ (0) if (request:Service-Type == Login-User && request:NAS-Port-Type && reply:Mikrotik-Group) -> FALSE (0) if (request:Service-Type == Framed-User && reply:Mikrotik-Group){ (0) if (request:Service-Type == Framed-User && reply:Mikrotik-Group) -> FALSE (0) if (reject && Framed-Protocol == PPP) { (0) if (reject && Framed-Protocol == PPP) -> FALSE (0) if (invalid && Framed-Protocol == PPP) { (0) if (invalid && Framed-Protocol == PPP) -> FALSE (0) } # Auth-Type CHAP = ok (0) # Executing section session from file /etc/freeradius/sites-enabled/default (0) session { (0) sql: EXPAND %{User-Name} (0) sql: --> joseph.test (0) sql: SQL-User-Name set to 'joseph.test' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL (0) sql: --> SELECT COUNT(*) FROM radacct WHERE username = 'joseph.test' AND acctstoptime IS NULL (0) sql: Executing select query: SELECT COUNT(*) FROM radacct WHERE username = 'joseph.test' AND acctstoptime IS NULL (0) sql: EXPAND SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL (0) sql: --> SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = 'joseph.test' AND acctstoptime IS NULL (0) sql: Executing select query: SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = 'joseph.test' AND acctstoptime IS NULL checkrad: Unknown NAS 2804:444:1:1::2, not checking rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) } # session = ok (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (0) sql: EXPAND %{User-Name} (0) sql: --> joseph.test (0) sql: SQL-User-Name set to 'joseph.test' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate, nasipaddress, callingstationid) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', UTC_TIMESTAMP(), '%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}', '%{Calling-Station-Id}') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate, nasipaddress, callingstationid) VALUES ( 'joseph.test', '0x018003bc3835139074138c89d63370276a', 'Access-Reject', UTC_TIMESTAMP(), '2804:444:1:1::2', 'AA:BB:B6:41:33:AA') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate, nasipaddress, callingstationid) VALUES ( 'joseph.test', '0x018003bc3835139074138c89d63370276a', 'Access-Reject', UTC_TIMESTAMP(), '2804:444:1:1::2', 'AA:BB:B6:41:33:AA') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (3) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> joseph.test (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. FreeRADIUS Version 3.0.24 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/sqlippool_v4 including configuration file /etc/freeradius/mods-config/sql/ippool/mysql/queries.conf including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/sqlippool including configuration file /etc/freeradius/mods-config/sql/ippool/mysql/queries.conf including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/mysql/queries.conf including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/ddns_exec including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/sqlippool_v6 including configuration file /etc/freeradius/mods-config/sql/ippool/mysql/queries_v6.conf including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/digest including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/accounting /etc/freeradius/policy.d/accounting[42]: Reference "${IDRADIUSSERVER}" not found /etc/freeradius/policy.d/accounting[54]: Reference "${IDRADIUSSERVER}" not found including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/control including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/freeradius.env including configuration file /etc/freeradius/ddns.env main { security { user = "root" group = "root" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/var/scriptsradius/callcheckrad.sh" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_sqlippool # Loading module "sqlippool_v4" from file /etc/freeradius/mods-enabled/sqlippool_v4 sqlippool sqlippool_v4 { sql_module_instance = "sql" lease_duration = 3600 pool_name = "Pool-Name" default_pool = "main_pool" allocate_begin = "START TRANSACTION" allocate_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= UTC_TIMESTAMP() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" allocate_clear_timeout = 1 allocate_existing = "" allocate_requested = "" allocate_find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < UTC_TIMESTAMP() OR expiry_time IS NULL) AND banned = 0 ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate_update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = UTC_TIMESTAMP() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I' AND expiry_time IS NULL" allocate_commit = "COMMIT" pool_check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start_begin = "" start_update = "UPDATE radippool SET expiry_time = UTC_TIMESTAMP() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start_commit = "" alive_begin = "" alive_update = "UPDATE radippool SET expiry_time = UTC_TIMESTAMP() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive_commit = "" stop_begin = "" stop_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop_commit = "" on_begin = "" on_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on_commit = "" off_begin = "" off_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off_commit = "" messages { exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loading module "sqlippool" from file /etc/freeradius/mods-enabled/sqlippool sqlippool { sql_module_instance = "sql" lease_duration = 3600 pool_name = "Pool-Name" default_pool = "main_pool" ipv6 = yes allocate_begin = "START TRANSACTION" allocate_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= UTC_TIMESTAMP() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" allocate_clear_timeout = 1 allocate_existing = "" allocate_requested = "" allocate_find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < UTC_TIMESTAMP() OR expiry_time IS NULL) AND banned = 0 ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate_update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = UTC_TIMESTAMP() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I' AND expiry_time IS NULL" allocate_commit = "COMMIT" pool_check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start_begin = "" start_update = "UPDATE radippool SET expiry_time = UTC_TIMESTAMP() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start_commit = "" alive_begin = "" alive_update = "UPDATE radippool SET expiry_time = UTC_TIMESTAMP() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive_commit = "" stop_begin = "" stop_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop_commit = "" on_begin = "" on_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on_commit = "" off_begin = "" off_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off_commit = "" messages { exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "192.0.2.2" port = 3306 login = "radius_user" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = UTC_TIMESTAMP(), acctsessiontime = UNIX_TIMESTAMP(UTC_TIMESTAMP()) - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}' AND acctstarttime <= UTC_TIMESTAMP()" } accounting-off { query = "UPDATE radacct SET acctstoptime = UTC_TIMESTAMP(), acctsessiontime = UNIX_TIMESTAMP(UTC_TIMESTAMP()) - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}' AND acctstarttime <= UTC_TIMESTAMP()" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6prefix, delegatedipv6prefix) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', UTC_TIMESTAMP(), UTC_TIMESTAMP(), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Prefix}', '%{Delegated-IPv6-Prefix}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = UTC_TIMESTAMP(), acctinterval = UNIX_TIMESTAMP(UTC_TIMESTAMP()) - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', framedipv6prefix = '%{Framed-IPv6-Prefix}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctstoptime = NULL, nasportid = '%{NAS-Port-Id}', calledstationid = '%{Called-Station-Id}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' OR AcctUniqueId = '%{Segundo-AcctUnique-Id}' OR AcctUniqueId = '%{Terceiro-AcctUnique-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = UTC_TIMESTAMP(), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate, nasipaddress, callingstationid) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', UTC_TIMESTAMP(), '%{%{NAS-IP-Address}:-%{NAS-IPv6-Address}}', '%{Calling-Station-Id}')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loading module "ddns_del" from file /etc/freeradius/mods-enabled/ddns_exec exec ddns_del { wait = yes program = "/var/scriptsradius/ddns.php del %{User-Name} %{Framed-IP-Address}" input_pairs = "request" shell_escape = no } # Loading module "ddns_add" from file /etc/freeradius/mods-enabled/ddns_exec exec ddns_add { wait = yes program = "/var/scriptsradius/ddns.php add %{User-Name} %{Framed-IP-Address}" input_pairs = "request" shell_escape = no } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "sqlippool_v6" from file /etc/freeradius/mods-enabled/sqlippool_v6 sqlippool sqlippool_v6 { sql_module_instance = "sql" lease_duration = 3600 pool_name = "Pool-Name" default_pool = "main_pool" ipv6 = yes allocate_begin = "START TRANSACTION" allocate_clear = "UPDATE radippoolv6 SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE expiry_time <= UTC_TIMESTAMP() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" allocate_clear_timeout = 1 allocate_existing = "" allocate_requested = "" allocate_find = "SELECT framedipaddress FROM radippoolv6 WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < UTC_TIMESTAMP() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate_update = "UPDATE radippoolv6 SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{NAS-Port}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = UTC_TIMESTAMP() + INTERVAL 3600 SECOND WHERE framedipaddress = '%I' AND expiry_time IS NULL" allocate_commit = "COMMIT" pool_check = "SELECT id FROM radippoolv6 WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start_begin = "" start_update = "UPDATE radippoolv6 SET expiry_time = UTC_TIMESTAMP() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IPv6-Prefix}'" start_commit = "" alive_begin = "" alive_update = "UPDATE radippoolv6 SET expiry_time = UTC_TIMESTAMP() + INTERVAL 3600 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IPv6-Prefix}'" alive_commit = "" stop_begin = "" stop_clear = "UPDATE radippoolv6 SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{NAS-Port}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IPv6-Prefix}'" stop_commit = "" on_begin = "" on_clear = "UPDATE radippoolv6 SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" on_commit = "" off_begin = "" off_clear = "UPDATE radippoolv6 SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NULL WHERE nasipaddress = '%{Nas-IP-Address}'" off_commit = "" messages { exists = "Existing IP: %{reply:Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IP: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" clear = "Released IP %{Framed-IP-Address} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})" failed = "IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" nopool = "No Pool-Name defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" } } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôoùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔOÙÛÜY" } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest instantiate { } # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 rlm_eap (EAP): Ignoring EAP method 'leap', because it is no longer supported # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" reject_unknown_intermediate_ca = no ecdh_curve = "prime256v1" tls_min_version = "1.2" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "sqlippool_v4" from file /etc/freeradius/mods-enabled/sqlippool_v4 # Instantiating module "sql" from file /etc/freeradius/mods-enabled/sql rlm_sql_mysql: libmysql version: 5.7.35 mysql { tls { tls_required = no check_cert = no check_cert_cn = no } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.0.2.2 via TCP/IP, server version 5.7.18-log, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.0.2.2 via TCP/IP, server version 5.7.18-log, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.0.2.2 via TCP/IP, server version 5.7.18-log, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.0.2.2 via TCP/IP, server version 5.7.18-log, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.0.2.2 via TCP/IP, server version 5.7.18-log, protocol version 10 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Adding client 2804:444:1:1::2 (R1.ITU) to global clients list rlm_sql (2804:444:1:1::2): Client "R1.ITU" (sql) added rlm_sql (sql): Released connection (0) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on 192.0.2.2 via TCP/IP, server version 5.7.18-log, protocol version 10 Ignoring "allocate_clear_timeout = 1", forcing to "allocate_clear_timeout = 1" # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "sqlippool" from file /etc/freeradius/mods-enabled/sqlippool Ignoring "allocate_clear_timeout = 1", forcing to "allocate_clear_timeout = 1" # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "sqlippool_v6" from file /etc/freeradius/mods-enabled/sqlippool_v6 Ignoring "allocate_clear_timeout = 1", forcing to "allocate_clear_timeout = 1" # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 38092 Listening on proxy address :: port 58617 Ready to process requests

2 3

Performance issues
by Imdad Hasan 05 Oct '22

05 Oct '22

Hi Alen, I am checking the slow query logs from the last 3 days and still it's not any slow query logs more than 2 secs from FreeRADIUS queries. Please suggest what I should do. I checked all the things. Thanks Imdad

3 3

Version 3.2.1 has been released
by Matthew Newton 03 Oct '22

03 Oct '22

We have released version 3.2.1. This is the latest version 3 "feature" release. There are a number of improvements and bug fixes, see the changelog for full details. As usual, see the web site for release notes and downloads: https://freeradius.org/releases/ ftp://ftp.freeradius.org/pub/freeradius/ https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_2_1 Packages are available on the Network RADIUS site: https://packages.networkradius.com/ Rocky Linux 9 packages have been added with this release. Note that since Ubuntu 16 is now EOL, packages will be dropped at some point in the future; you are encouraged to upgrade. Docker images have been pushed to Dockerhub. With this release the Docker "latest" tag now points at version 3.2.1, along with the "latest-3.2" tag. For anyone wishing to stay with version 3.0, please use the "latest-3.0" tag. -- Matthew

1 0

Performance issues
by Imdad Hasan 01 Oct '22

01 Oct '22

Hi Alen, I enabled slow query logs and another mysql logs for further inspection for last 24 hours, i set the time is 2 secs long for slow query logs, But whenever the freeradius gives me a warning like *WARNING: Module rlm_sql became unblocked *at that time mysql hasn't any slow query logs. Meaning mysql hasn't any query that takes more than 2 seconds. Thanks Imdad 😊

1 0