August 2022 - Freeradius-Users - lists.freeradius.org

Error, Unknown CA, Creating attributes from [non existent] server certificate
by Emile Swarts 25 Aug '22

25 Aug '22

Hi, We're using FreeRadius (3.2.0) and successfully authenticating clients over EAP-TTLS / Radsec. We had one failed authentication yesterday that I am struggling to make sense of. Verbose logging is enabled so I can see all the details. I can see the usual "Creating attributes from server certificate" in the authenticate section, which then goes on to mention a server certificate (TLS-Cert-Common-Name) that I've never heard of, and definitely isn't installed on our FreeRadius server. The server then sends the following back to the client: "send TLS 1.2 Alert, fatal unknown_ca" I've looked at the C source code but I'm unable to see where this could have gotten mixed up, any advice appreciated. This has only happened once out of thousands of successful authentications.

2 1

Customise reply-message
by Can Paçacı 25 Aug '22

25 Aug '22

Hi, How can we send the reply-message to NAS according to which attribute in the radcheck table failed during the user authentication phase? Now, it returns the reply-message, Wrong-password and wrong-user only. If the NAS-identifier attribute in the radcheck table failed, we want it to send a separate reply-message. Is it possible? Regards -- Can Paçacı pacaci(a)servisnet.com.tr Servisnet A.Ş. Tel: 90 216 9999677 90 530 5450952

2 3

Re: Frerradius with M$ SQL-Problem with query.conf
by Niko Reinhard 25 Aug '22

25 Aug '22

We did as Alan proposed and installed 3.0.20 with the same result. Than we want to install 3.0.17 (which is the working version on CentOS 7), bute there were no packages at Freradius, therefore we tried to build the packes from source. But this was impossible due to some dependencies for python which we cant resolve. So we used a package from CentOS' own repository directly, but all these packages have an error - the packet "freeradius-config" (which will be silently installed by package "freeradius" from networkradius) is missed. As a workaround we copied the missing files from our working Cent OS 7 installation and - it does also not work. So we give up. Then we remembered the proposal from Nick Porter, we installed as he recommended FR 3.2.0 with the packet freeradius-freetds and - it worked at first go. Thanks Nick! So it seems to me the problem lays on the unixodbc driver for release CentOS/RH 8. Could that be possible? One remark for someone who wants to install it as we did: freeradius-freetds needs to bind the EPEL-repository because it installs 2 packets from Freetds. Alan, we are able to test older versions with unixodbs on release 8 if this helps, but this is only possible if you please provide us the rpm packets from Freeradius. Install from scratch seems to be beyond our skills.. Best regards Niko Reinhard Am 22.08.2022 um 23:17 schrieb Alan DeKok: > On Aug 22, 2022, at 3:37 PM, Niko Reinhard <reiniko(a)web.de> wrote: >> "My only suggestion here is to try tracking down...." >> Hrmm. I can do that gladly, but I'm not so familiar with Freeradius and >> I dont'know how to get the versions between 3.0.17 and .25... sorry. > > You can use "git" to download the source, and then build it. > >> Networkradius offers all versions between 0.20 and 0.25, this should be >> enough for the start, but - I dont know how to get them! The baseurl is: >> baseurl=http://packages.networkradius.com/freeradius-3.0/centos/$releasever/ >> and this gives me only the latest version... can you help me with this >> please? > > You can use a web browser to open that URL. Then click around, and you'll see all of the RPMs available. Right now, I see 3.0.20, 3.0.21, 3.0.22, and 3.0.24. > > You can download them manually. > >> Regarding my annex: The file is >> /etc/raddb/mods-config/sql/main/mssql/queries.conf and the original >> varaible was ${..class.column_name}, whitch this radiusd does not start. >> I changed the variable on line 212, 282,390 and 491 to >> ${....class.column_name} and the the radiusd -X could be started. > > That's already been fixed, thanks. > > And please reply on the public list. That way other people can see answers, too. > > Alan DeKok. >

2 2

Dynamic and static clients + overlapping dynamic client pools
by Fraley, Taylor 24 Aug '22

24 Aug '22

A couple of questions, and apologies if I'm duplicating previous questions - I just haven't been able to find a straight-forward answer to either of these questions: 1. When you have a configuration with both static client entries and dynamic client pools, where the static clients are contained in the dynamic pool, will FR prefer the static client entry and secret? 2. Can you have two or more overlapping dynamic client pools with different secrets. Perhaps even multiple pools with the same subnet but different secrets? For context, we have a large enterprise that uses a handful of shared secrets based on client type. But these different client types are scattered around the same subnets, so it would be impossible or nearly so to specify dynamic blocks of any reasonable size. Most clients will be preconfigured as static clients however, hence question 1. But we need to account for new clients coming online within allowed subnets, but they could be using one of the handful of secrets. With our current solution, we have a script that monitors for new client requests via log and creating static clients on-demand, but the current solution doesn't require a restart to refresh the clients list, so looking for alternatives as we look to FR as a replacement. Thanks, Taylor This communication is the property of Lumen Technologies and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the communication and any attachments.

2 4

Chromebooks, FreeRADIUS and Google Workspace (i.e. G Suites) for 802.1X.
by Robert Montgomery 23 Aug '22

23 Aug '22

Hi Everyone, I think I know my answer, but I figured I would just try to validate / document. I have customers that use Google Workspace as their primary user database (they're schools). I've been attempting to use FreeRADIUS as middleware to allow the WiFi network to perform an 802.1X authentication against the LDAP service provided by Google. It works well for some clients, but not for Chromebooks. I think the root cause of the issue is FreeRADIUS' need to get an unencrypted copy of the password. Because Google Workspace encrypts the user's passwords, authentication only works if the client sends an unencrypted password to FreeRADIUS. To do that, it needs to support the EAP-GTC method. And, while most clients support EAP-GTC, Chromebooks do not. Am I missing something? Has anyone figured out a way to use 802.1X to authenticate Chromebooks against Google Workspace LDAP? (Just figured I'd ask. :-D) Thanks, -Rob

3 4

Freeradius 3, Posgresql 14, application_name
by Andrey Grigorian 23 Aug '22

23 Aug '22

Hi, there is a configuration option in /etc/freeradius/3.0/mods-available/sql sql { postgresql { send_application_name = yes } } which makes Freeradius use "application_name" parameter to connect to Postgresql. is there any way to change the value Freeradius uses to fill this parameter? the default value in the logs "application_name='FreeRADIUS 3.0.20 - radiusd (sql)" which is not useful for me as i'm going to have several Freeradius servers connected to the same external Postgresql DB. log rlm_sql_postgresql: Connecting using parameters: dbname='radius' host='postgresql1' port=5432 user='freeradius' password='freeradius' application_name='FreeRADIUS 3.0.20 - radiusd (sql)' -- Andrey Grigorian

2 1

Fwd: Frerradius with M$ SQL-Problem with query.conf
by Niko Reinhard 22 Aug '22

22 Aug '22

Betreff: Re: Frerradius with M$ SQL-Problem with query.conf Datum: Mon, 22 Aug 2022 21:37:15 +0200 Von: Niko Reinhard <reiniko(a)web.de> An: Alan DeKok <aland(a)deployingradius.com> Hello Alan, many thanks for this very quick response. "My only suggestion here is to try tracking down...." Hrmm. I can do that gladly, but I'm not so familiar with Freeradius and I dont'know how to get the versions between 3.0.17 and .25... sorry. Networkradius offers all versions between 0.20 and 0.25, this should be enough for the start, but - I dont know how to get them! The baseurl is: baseurl=http://packages.networkradius.com/freeradius-3.0/centos/$releasever/ and this gives me only the latest version... can you help me with this please? Regarding my annex: The file is /etc/raddb/mods-config/sql/main/mssql/queries.conf and the original varaible was ${..class.column_name}, whitch this radiusd does not start. I changed the variable on line 212, 282,390 and 491 to ${....class.column_name} and the the radiusd -X could be started. Best regards Reinhard Am 22.08.2022 um 20:33 schrieb Alan DeKok: > On Aug 22, 2022, at 1:58 PM, Niko Reinhard <reiniko(a)web.de> wrote: >> >> We use Freeradius V3.0.17 on Cent OS7 since few years for AAA for our >> Cisco devices. We stored the AVPs in our existing M$ SQL 2008R2 database >> and connected it via Freetds and the unixodbc package from Freeradius. >> Because Cisco AAA needs the Cleartext-Password and we don't want to >> store it in cleartext in our database we wrote a simple small function >> which decrypt/encrypt the password before storing and after reading. >> Therefore we changed the "queries.conf" as follows: >> >> SELECT id, UserName, Attribute,dbo.DecryptPwd(Value, Attribute) as >> Value, op \ >> FROM ${authcheck_table} \ >> WHERE Username = '%{SQL-User-Name}' \ >> ORDER BY id" >> >> This works fine without any problems. > > That's good. > >> Now we want to update our configuration and added a new server with >> Oracle Linux 8 and Freeradius 3.2.0 (we installed with the sources and >> as described at networkradius.com) in the same manner as we did before >> (Freetds and freeradius-unixodbc) - but it works only if we use the >> standard SQL query. > > Hmm... We've had issues over the years with the standard SQL APIs not supporting anything other than a trivial "SELECT". But all of those should have been fixed a while ago. > >> It does not work if we use the function or a View instead a table. >> I tested our original query with tsql and isql and in both cases it >> works fine. Then I installed Freeadius 3.0.25 and it works also not, >> but no problem with isql and tsql. > > There really isn't a lot of difference in the rlm_sql module between 3.0.17 and 3.0.25. The main thing is some unused functions were removed. > >> I added the radiusd -X output on the end of the mail. As you can see >> there is no output for the Cleartext-Password. > > The error show: > > 0) sql: Executing select query: SELECT id, UserName, Attribute, > dbo.DecryptPwd(Value,Attribute) as Value, op FROM radcheck WHERE > Username = 'niklowitz' ORDER BY id > (0) sql: User found in radcheck table > (0) sql: Conditional check items matched, merging assignment check items > (0) sql: Cleartext-Password := "" > > i.e. the output of the "Decrypt" call is empty. > >> What am I doing wrong? Are there any additional settings after 3.0.17? >> Can someone help me with this? > > It should work. > > My only suggestion here is to try tracking down which release / commit broke it. There's only a few versions between 3.0.17 and 3.0.25, and only a few changes to the rlm_sql file. It shouldn't take longer than a few hours to track this down. > > We don't run MS SQL here, so our testing ability is limited. > >> PS: There is an error in the file queries.conf at V3.0.25 from >> networkradius.com, the new variable for Authorization query missed 2 >> dots (instead ${..conf it has to be ${....conf). I corrected it manually. > > Which file is that? There's more than one "queries.conf" file. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2

Frerradius with M$ SQL-Problem with query.conf
by Niko Reinhard 22 Aug '22

22 Aug '22

We use Freeradius V3.0.17 on Cent OS7 since few years for AAA for our Cisco devices. We stored the AVPs in our existing M$ SQL 2008R2 database and connected it via Freetds and the unixodbc package from Freeradius. Because Cisco AAA needs the Cleartext-Password and we don't want to store it in cleartext in our database we wrote a simple small function which decrypt/encrypt the password before storing and after reading. Therefore we changed the "queries.conf" as follows: SELECT id, UserName, Attribute,dbo.DecryptPwd(Value, Attribute) as Value, op \ FROM ${authcheck_table} \ WHERE Username = '%{SQL-User-Name}' \ ORDER BY id" This works fine without any problems. Now we want to update our configuration and added a new server with Oracle Linux 8 and Freeradius 3.2.0 (we installed with the sources and as described at networkradius.com) in the same manner as we did before (Freetds and freeradius-unixodbc) - but it works only if we use the standard SQL query. It does not work if we use the function or a View instead a table. I tested our original query with tsql and isql and in both cases it works fine. Then I installed Freeadius 3.0.25 and it works also not, but no problem with isql and tsql. I added the radiusd -X output on the end of the mail. As you can see there is no output for the Cleartext-Password. What am I doing wrong? Are there any additional settings after 3.0.17? Can someone help me with this? Thanks in advance! Best regards Niko PS: There is an error in the file queries.conf at V3.0.25 from networkradius.com, the new variable for Authorization query missed 2 dots (instead ${..conf it has to be ${....conf). I corrected it manually. --- [root@rsp1radius1 ~]# radiusd -X FreeRADIUS Version 3.0.25 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/totp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mssql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/moonshot-targeted-ids including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/rfc7542 including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüa ÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_totp # Loading module "totp" from file /etc/raddb/mods-enabled/totp # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_unixodbc" server = "radiusDSN" port = 0 login = "RSP\SIRASRV-RADIUS" password = <<< secret >>> radius_db = "freeradius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id, UserName, Attribute, dbo.DecryptPwd(Value,Attribute) as Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, UserName, Attribute, dbo.DecryptPwd(Value,Attribute) as Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value, radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" authorize_group_reply_query = "SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value, radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" type { accounting-on { query = "UPDATE radacct SET AcctStopTime=DATEADD(SS, %{%{integer:Event-Timestamp}:-%l}, '19700101'), AcctSessionTime=%{%{integer:Event-Timestamp}:-%l} - DATEDIFF(SS, '1970-01-01', AcctStartTime), AcctTerminateCause='%{%{Acct-Terminate-Cause}:-NAS-Reboot}', AcctStopDelay = %{%{Acct-Delay-Time}:-0} WHERE AcctStopTime = 0 AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStartTime <= DATEADD(SS, %{%{integer:Event-Timestamp}:-%l}, '19700101')" } accounting-off { query = "UPDATE radacct SET AcctStopTime=DATEADD(SS, %{%{integer:Event-Timestamp}:-%l}, '19700101'), AcctSessionTime=%{%{integer:Event-Timestamp}:-%l} - DATEDIFF(SS, '1970-01-01', AcctStartTime), AcctTerminateCause='%{%{Acct-Terminate-Cause}:-NAS-Reboot}', AcctStopDelay = %{%{Acct-Delay-Time}:-0} WHERE AcctStopTime = 0 AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStartTime <= DATEADD(SS, %{%{integer:Event-Timestamp}:-%l}, '19700101')" } start { query = "INSERT INTO radacct ( AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPort, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, FramedIPv6Address, FramedIPv6Prefix, FramedInterfaceId, DelegatedIPv6Prefix, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey ) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', DATEADD(SS, %{%{integer:Event-Timestamp}:-%l}, '19700101'), '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}', '%{Acct-Delay-Time}', '0', '%{X-Ascend-Session-Svr-Key}' )" } interim-update { query = "UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', FramedIPv6Address = '%{Framed-IPv6-Address}', FramedIPv6Prefix = '%{Framed-IPv6-Prefix}', FramedInterfaceId = '%{Framed-Interface-Id}', DelegatedIPv6Prefix = '%{Delegated-IPv6-Prefix}' WHERE AcctUniqueId = '%{Acct-Unique-Session-ID}' AND AcctStopTime = 0" } stop { query = "UPDATE radacct SET AcctStopTime = DATEADD(SS, %{%{integer:Event-Timestamp}:-%l}, '19700101'), AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = convert(bigint, '%{%{Acct-Input-Gigawords}:-0}' * POWER(2.0, 32)) | '%{%{Acct-Input-Octets}:-0}', AcctOutputOctets = convert(bigint, '%{%{Acct-Output-Gigawords}:-0}' * POWER(2.0, 32)) | '%{%{Acct-Output-Octets}:-0}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{%{Acct-Delay-Time}:-0}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-ID}' AND AcctStopTime = 0" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (userName, pass, reply, authdate ) VALUES('%{User-Name}', '%{%{User-Password}:-CHAP-PASSWORD}', '%{reply:Packet-Type}', '%S.%{expr:%M / 1000}' )" } } rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/coa # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no reject_unknown_intermediate_ca = no ecdh_curve = "prime256v1" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql (sql): Attempting to connect to database "freeradius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id,nasname,shortname,type,secret FROM nas rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id,nasname,shortname,type,secret FROM nas rlm_sql (sql): Adding client localhost (localhost) to global clients list rlm_sql (127.0.0.1): Client "localhost" (sql) added rlm_sql (sql): Adding client 192.168.120.85 (ffm-r-test1) to global clients list rlm_sql (192.168.120.85): Client "ffm-r-test1" (sql) added rlm_sql (sql): Adding client 192.168.120.86 (ffm-r-test2) to global clients list rlm_sql (192.168.120.86): Client "ffm-r-test2" (sql) added rlm_sql (sql): Adding client 172.28.70.245 (rsp1radius1) to global clients list rlm_sql (172.28.70.245): Client "rsp1radius1" (sql) added rlm_sql (sql): Released connection (0) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:336 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 49597 Listening on proxy address :: port 49729 Ready to process requests (0) Received Access-Request Id 15 from 127.0.0.1:33947 to 127.0.0.1:1812 length 79 (0) User-Name = "niklowitz" (0) User-Password = "unify" (0) NAS-IP-Address = 172.28.70.245 (0) NAS-Port = 1 (0) Message-Authenticator = 0xf27a95b7d7e310ac807bf655636530b0 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "niklowitz", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> niklowitz (0) sql: SQL-User-Name set to 'niklowitz' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, UserName, Attribute, dbo.DecryptPwd(Value,Attribute) as Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, dbo.DecryptPwd(Value,Attribute) as Value, op FROM radcheck WHERE Username = 'niklowitz' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, dbo.DecryptPwd(Value,Attribute) as Value, op FROM radcheck WHERE Username = 'niklowitz' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: Cleartext-Password := "" (0) sql: EXPAND SELECT id, UserName, Attribute, dbo.DecryptPwd(Value,Attribute) as Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, UserName, Attribute, dbo.DecryptPwd(Value,Attribute) as Value, op FROM radreply WHERE Username = 'niklowitz' ORDER BY id (0) sql: Executing select query: SELECT id, UserName, Attribute, dbo.DecryptPwd(Value,Attribute) as Value, op FROM radreply WHERE Username = 'niklowitz' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'niklowitz' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'niklowitz' ORDER BY priority (0) sql: User found in the group table (0) sql: EXPAND SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value, radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id (0) sql: --> SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value, radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = 'niklowitz' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id (0) sql: Executing select query: SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value, radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = 'niklowitz' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id (0) sql: Group "administrators": Conditional check items matched (0) sql: Group "administrators": Merging assignment check items (0) sql: EXPAND SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value, radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id (0) sql: --> SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value, radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = 'niklowitz' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id (0) sql: Executing select query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value, radgroupreply.op FROM radgroupreply,radusergroup WHERE radusergroup.Username = 'niklowitz' AND radusergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id (0) sql: Group "administrators": Merging reply items (0) sql: Service-Type := NAS-Prompt-User (0) sql: Cisco-AVPair := "shell:priv-lvl=15" rlm_sql (sql): Released connection (1) Need more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: ERROR: Cleartext password does not match "known good" password (0) pap: Passwords don't match (0) [pap] = reject (0) } # Auth-Type PAP = reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (2) (0) sql: EXPAND %{User-Name} (0) sql: --> niklowitz (0) sql: SQL-User-Name set to 'niklowitz' (0) sql: EXPAND INSERT INTO radpostauth (userName, pass, reply, authdate ) VALUES('%{User-Name}', '%{%{User-Password}:-CHAP-PASSWORD}', '%{reply:Packet-Type}', '%S.%{expr:%M / 1000}' ) (0) sql: --> INSERT INTO radpostauth (userName, pass, reply, authdate ) VALUES('niklowitz', 'unify', 'Access-Reject', '2022-08-22 12:29:23.435' ) (0) sql: Executing query: INSERT INTO radpostauth (userName, pass, reply, authdate ) VALUES('niklowitz', 'unify', 'Access-Reject', '2022-08-22 12:29:23.435' ) (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (2) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> niklowitz (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds Waking up in 0.2 seconds. Waking up in 0.7 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 15 from 127.0.0.1:1812 to 127.0.0.1:33947 length 20 Waking up in 3.9 seconds.

2 1

About using groups
by Семенюк Александр Петрович 22 Aug '22

22 Aug '22

Hi guys! I'm interested to use MAB (mac-address bypass) for dot1x in LAN and to define vlan's number for LAN-switch's port based on mac-address. I use 'users' in Freeradius 3.0 and now should have something like this for each of mac-address in my LAN: a4-bb-6d-c6-2a-b8 Cleartext-Password := "a4-bb-6d-c6-2a-b8" cisco-avpair= "tunnel-type=13", cisco-avpair= "tunnel-medium-type=6", cisco-avpair= "tunnel-private-group-id=2" or 00-90-8f-55-eb-ee Cleartext-Password := "00-90-8f-55-eb-ee" cisco-avpair= "tunnel-type=13", cisco-avpair= "tunnel-medium-type=6", cisco-avpair= "tunnel-private-group-id=7", cisco-avpair = "device-traffic-class=voice" Most of strings are the same for all such a 'users'. Obviously I want to define some 'group' for each vlan number in which define common strings/attributes, and in the user section keep only unique attributes - like password or group-id. It should be 3-4 such groups for now. Can I? 1. Probably, it could be done with Default sections, but for different vlans I should have separate 'default' section? It seems too complicated and I have no idea how to make it. 2. Or it can be done in 'post-auth' section, but how in that time I can guess what group this mac-address belongs? Probably, I should define it earlier - based on mac-address in 'user' section. Can I? -------------------- Regards, Alexander

2 1

Can RADIUS indicate a standardised reason for access rejection?
by Michal Moravec 22 Aug '22

22 Aug '22

Hi there, Imagine you use EAP-TTLS + PAP for 802.1X authentication. You have client which is able to authenticate. One day password changes or expires (server-side). Client attempts to authenticate using the old password. RADIUS server will reply with Access-Reject. Can RADIUS server add some standardised message/attribute to the message indicating the reason for the rejection? E.g. "reason: password expired", e.g. "reason: wrong password", etc. The key is the "standardised". I know I can provide any reply message but here I would need to reply with something the client and/or NAS expect and can react to accordingly. Reason for asking: Most of our clients are macOS devices. When user changes the password server-side, next EAP-TTLS + PAP authentication attempts fails. macOS displays very cryptic message about a connection problem (no prompt to enter the password). Ideal behaviour would be client knowing the reason for authentication failure so it can react accordingly (prompt user for new set of credentials). Best, Michal Moravec

4 5