December 2023 - Freeradius-Users - lists.freeradius.org

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

Can I use diffrent root CA certificates while dynamic loading certificate chains?
by James Fan 28 Oct '24

28 Oct '24

Hi, we have a case that, with multi-tenancy, there will be multiple CA certificates in our FreeRadius server, so we need to load the certificate chains dynamically. But when I use the statements below, I can't include the CA certificates in the certificate files I set. The TLS-Session-Cert-File looks like it is only for the server certificate and intermediate CA certificates. Is there any chance of dynamic loading certificate chains with root CA certificates? Thanks. authenticate { ... Auth-Type eap { if ("%{unpack:&EAP-Message 4 byte}" == 1) { update control { TLS-Session-Cert-File := "${certdir}/realms/%{Realm}" } } eap } ... }

4 8

Error : Duplicate module "sql sql"
by Aghyad Fares 25 Dec '23

25 Dec '23

Hope this email finds you well. I am facing this issue after i use this command " /usr/sbin/radiusd -C -lstdout -xxx " I got this error "Duplicate module "sql sql", in file /etc/raddb/mods-enabled/sql.save:20 and file /etc/raddb/mods-enabled/sql:20 " I even checked for duplicates in sql and sql.save files but I didn't find any duplicates. this is sql file in mods-enable : # -*- text -*- ## ## sql.conf -- SQL modules ## ## $Id: 4a59483c35c77f573fb177919e19ba4434cc3da1 $ ###################################################################### # # Configuration for the SQL module # # The database schemas and queries are located in subdirectories: # # sql/<DB>/main/schema.sql Schema # sql/<DB>/main/queries.conf Authorisation and Accounting queries # # Where "DB" is mysql, mssql, oracle, or postgresql. # # sql { # The sub-module to use to execute queries. This should match # the database you're attempting to connect to. # # * rlm_sql_mysql # * rlm_sql_mssql # * rlm_sql_oracle # * rlm_sql_postgresql # * rlm_sql_sqlite # * rlm_sql_null (log queries to disk) driver = "rlm_sql_mysql" # # Several drivers accept specific options, to set them, a # config section with the the name as the driver should be added # to the sql instance. # # Driver specific options are: # # sqlite { # # Path to the sqlite database # filename = "/tmp/freeradius.db" # # # How long to wait for write locks on the database to be # # released (in ms) before giving up. # busy_timeout = 200 # # # If the file above does not exist and bootstrap is set # # a new database file will be created, and the SQL statements # # contained within the bootstrap file will be executed. # bootstrap = "${modconfdir}/${..:name}/main/sqlite/schema.sql" # } # # mysql { # # If any of the files below are set, TLS encryption is enabled # tls { # ca_file = "/etc/ssl/certs/my_ca.crt" # ca_path = "/etc/ssl/certs/" # certificate_file = "/etc/ssl/certs/private/client.crt" # private_key_file = "/etc/ssl/certs/private/client.key" # cipher = "DHE-RSA-AES256-SHA:AES128-SHA" # } # # # If yes, (or auto and libmysqlclient reports warnings are # # available), will retrieve and log additional warnings from # # the server if an error has occured. Defaults to 'auto' # warnings = auto # } # # postgresql { # # # unlike MySQL, which has a tls{} connection configuration, postgresql # # uses its connection parameters - see the radius_db option below in # # this file # # # Send application_name to the postgres server # # Only supported in PG 9.0 and greater. Defaults to no. # send_application_name = yes # } # # The dialect of SQL you want to use, this should usually match # the driver you selected above. # # If you're using rlm_sql_null, then it should be the type of # database the logged queries are going to be executed against. # Connection info: # dialect = "mysql" server = "localhost" port = 3306 login = "radius" password = "radpass" # Database table configuration for everything except Oracle radius_db = "radius" # If you are using Oracle then use this instead # radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))" # If you're using postgresql this can also be used instead of the connection info parameters # radius_db = "dbname=radius host=localhost user=radius password=raddpass" # Postgreql doesn't take tls{} options in its module config like mysql does - if you want to # use SSL connections then use this form of connection info parameter # radius_db = "host=localhost port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslcert=/etc/ssl/client.crt sslkey=/etc/ssl/client.key sslrootcert=/etc/ssl/ca.crt" # If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct" # Allow for storing data after authentication postauth_table = "radpostauth" # Tables containing 'check' items authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" # Tables containing 'reply' items authreply_table = "radreply" groupreply_table = "radgroupreply" # Table to keep group info usergroup_table = "radusergroup" # If set to 'yes' (default) we read the group tables unless Fall-Through = no in the reply table. # If set to 'no' we do not read the group tables unless Fall-Through = yes in the reply table. # read_groups = yes # If set to 'yes' (default) we read profiles unless Fall-Through = no in the groupreply table. # If set to 'no' we do not read profiles unless Fall-Through = yes in the groupreply table. # read_profiles = yes # Remove stale session if checkrad does not see a double login delete_stale_sessions = yes # Write SQL queries to a logfile. This is potentially useful for tracing # issues with authorization queries. See also "logfile" directives in # mods-config/sql/main/*/queries.conf. You can enable per-section logging # by enabling "logfile" there, or global logging by enabling "logfile" here. # # Per-section logging can be disabled by setting "logfile = ''" # logfile = ${logdir}/sqllog.sql # Set the maximum query duration and connection timeout # for rlm_sql_mysql. # query_timeout = 5 # As of version 3.0, the "pool" section has replaced the # following configuration items: # # num_sql_socks # connect_failure_retry_delay # lifetime # max_queries # # The connection pool is new for 3.0, and will be used in many # modules, for all kinds of connection-related activity. # # When the server is not threaded, the connection pool # limits are ignored, and only one connection is used. # # If you want to have multiple SQL modules re-use the same # connection pool, use "pool = name" instead of a "pool" # section. e.g. # # sql1 { # ... # pool { # ... # } # } # # # sql2 will use the connection pool from sql1 # sql2 { # ... # pool = sql1 # } # pool { # Connections to create during module instantiation. # If the server cannot create specified number of # connections during instantiation it will exit. # Set to 0 to allow the server to start without the # database being available. start = ${thread[pool].start_servers} # Minimum number of connections to keep open min = ${thread[pool].min_spare_servers} # Maximum number of connections # # If these connections are all in use and a new one # is requested, the request will NOT get a connection. # # Setting 'max' to LESS than the number of threads means # that some threads may starve, and you will see errors # like 'No connections available and at max connection limit' # # Setting 'max' to MORE than the number of threads means # that there are more connections than necessary. max = ${thread[pool].max_servers} # Spare connections to be left idle # # NOTE: Idle connections WILL be closed if "idle_timeout" # is set. This should be less than or equal to "max" above. spare = ${thread[pool].max_spare_servers} # Number of uses before the connection is closed # # 0 means "infinite" uses = 0 # The number of seconds to wait after the server tries # to open a connection, and fails. During this time, # no new connections will be opened. retry_delay = 30 # The lifetime (in seconds) of the connection lifetime = 0 # idle timeout (in seconds). A connection which is # unused for this length of time will be closed. idle_timeout = 60 # NOTE: All configuration settings are enforced. If a # connection is closed because of "idle_timeout", # "uses", or "lifetime", then the total number of # connections MAY fall below "min". When that # happens, it will open a new connection. It will # also log a WARNING message. # # The solution is to either lower the "min" connections, # or increase lifetime/idle_timeout. } # Set to 'yes' to read radius clients from the database ('nas' table) # Clients will ONLY be read on server startup. read_clients = yes # Table to keep radius client info client_table = "nas" # # The group attribute specific to this instance of rlm_sql # # This entry should be used for additional instances (sql foo {}) # of the SQL module. # group_attribute = "${.:instance}-SQL-Group" # This entry should be used for the default instance (sql {}) # of the SQL module. group_attribute = "SQL-Group" # Read database-specific queries $INCLUDE ${modconfdir}/sql/main/mysql/queries.conf } This is sql.save file : # -*- text -*- ## ## sql.conf -- SQL modules ## ## $Id: 4a59483c35c77f573fb177919e19ba4434cc3da1 $ ###################################################################### # # Configuration for the SQL module # # The database schemas and queries are located in subdirectories: # # sql/<DB>/main/schema.sql Schema # sql/<DB>/main/queries.conf Authorisation and Accounting queries # # Where "DB" is mysql, mssql, oracle, or postgresql. # # sql { # The sub-module to use to execute queries. This should match # the database you're attempting to connect to. # # * rlm_sql_mysql # * rlm_sql_mssql # * rlm_sql_oracle # * rlm_sql_postgresql # * rlm_sql_sqlite # * rlm_sql_null (log queries to disk) # driver = "rlm_sql_mysql" dialect = "mysql" # # Several drivers accept specific options, to set them, a # config section with the the name as the driver should be added # to the sql instance. # # Driver specific options are: # # sqlite { # # Path to the sqlite database # filename = "/tmp/freeradius.db" # # # How long to wait for write locks on the database to be # # released (in ms) before giving up. # busy_timeout = 200 # # # If the file above does not exist and bootstrap is set # # a new database file will be created, and the SQL statements # # contained within the bootstrap file will be executed. # bootstrap = "${modconfdir}/${..:name}/main/sqlite/schema.sql" # } # # mysql { # # If any of the files below are set, TLS encryption is enabled # tls { # ca_file = "/etc/ssl/certs/my_ca.crt" # ca_path = "/etc/ssl/certs/" # certificate_file = "/etc/ssl/certs/private/client.crt" # private_key_file = "/etc/ssl/certs/private/client.key" # cipher = "DHE-RSA-AES256-SHA:AES128-SHA" # } # # # If yes, (or auto and libmysqlclient reports warnings are # # available), will retrieve and log additional warnings from # # the server if an error has occured. Defaults to 'auto' # warnings = auto # } # # postgresql { # # # unlike MySQL, which has a tls{} connection configuration, postgresql # # uses its connection parameters - see the radius_db option below in # # this file # # # Send application_name to the postgres server # # Only supported in PG 9.0 and greater. Defaults to no. # send_application_name = yes # } # # The dialect of SQL you want to use, this should usually match # the driver you selected above. # # If you're using rlm_sql_null, then it should be the type of # database the logged queries are going to be executed against. # Connection info: server = "localhost" port = 3306 login = "radius" password = "radpass" # Database table configuration for everything except Oracle radius_db = "radius" # If you are using Oracle then use this instead # radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=localhost)(PORT=1521))(CONNECT_DATA=(SID=your_sid)))" # If you're using postgresql this can also be used instead of the connection info parameters # radius_db = "dbname=radius host=localhost user=radius password=raddpass" # Postgreql doesn't take tls{} options in its module config like mysql does - if you want to # use SSL connections then use this form of connection info parameter # radius_db = "host=localhost port=5432 dbname=radius user=radius password=raddpass sslmode=verify-full sslcert=/etc/ssl/client.crt sslkey=/etc/ssl/client.key sslrootcert=/etc/ssl/ca.crt" # If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct" # Allow for storing data after authentication postauth_table = "radpostauth" # Tables containing 'check' items authcheck_table = "radcheck" groupcheck_table = "radgroupcheck" # Tables containing 'reply' items authreply_table = "radreply" groupreply_table = "radgroupreply" # Table to keep group info usergroup_table = "radusergroup" # If set to 'yes' (default) we read the group tables unless Fall-Through = no in the reply table. # If set to 'no' we do not read the group tables unless Fall-Through = yes in the reply table. # read_groups = yes # If set to 'yes' (default) we read profiles unless Fall-Through = no in the groupreply table. # If set to 'no' we do not read profiles unless Fall-Through = yes in the groupreply table. # read_profiles = yes # Remove stale session if checkrad does not see a double login delete_stale_sessions = yes # Write SQL queries to a logfile. This is potentially useful for tracing # issues with authorization queries. See also "logfile" directives in # mods-config/sql/main/*/queries.conf. You can enable per-section logging # by enabling "logfile" there, or global logging by enabling "logfile" here. # # Per-section logging can be disabled by setting "logfile = ''" # logfile = ${logdir}/sqllog.sql # Set the maximum query duration and connection timeout # for rlm_sql_mysql. # query_timeout = 5 # As of version 3.0, the "pool" section has replaced the # following configuration items: # # num_sql_socks # connect_failure_retry_delay # lifetime # max_queries # # The connection pool is new for 3.0, and will be used in many # modules, for all kinds of connection-related activity. # # When the server is not threaded, the connection pool # limits are ignored, and only one connection is used. # # If you want to have multiple SQL modules re-use the same # connection pool, use "pool = name" instead of a "pool" # section. e.g. # # sql1 { # ... # pool { # ... # } # } # # # sql2 will use the connection pool from sql1 # sql2 { # ... # pool = sql1 # } # pool { # Connections to create during module instantiation. # If the server cannot create specified number of # connections during instantiation it will exit. # Set to 0 to allow the server to start without the # database being available. start = ${thread[pool].start_servers} # Minimum number of connections to keep open min = ${thread[pool].min_spare_servers} # Maximum number of connections # # If these connections are all in use and a new one # is requested, the request will NOT get a connection. # # Setting 'max' to LESS than the number of threads means # that some threads may starve, and you will see errors # like 'No connections available and at max connection limit' # # Setting 'max' to MORE than the number of threads means # that there are more connections than necessary. max = ${thread[pool].max_servers} # Spare connections to be left idle # # NOTE: Idle connections WILL be closed if "idle_timeout" # is set. This should be less than or equal to "max" above. spare = ${thread[pool].max_spare_servers} # Number of uses before the connection is closed # # 0 means "infinite" uses = 0 # The number of seconds to wait after the server tries # to open a connection, and fails. During this time, # no new connections will be opened. retry_delay = 30 # The lifetime (in seconds) of the connection lifetime = 0 # idle timeout (in seconds). A connection which is # unused for this length of time will be closed. idle_timeout = 60 # NOTE: All configuration settings are enforced. If a # connection is closed because of "idle_timeout", # "uses", or "lifetime", then the total number of # connections MAY fall below "min". When that # happens, it will open a new connection. It will # also log a WARNING message. # # The solution is to either lower the "min" connections, # or increase lifetime/idle_timeout. } # Set to 'yes' to read radius clients from the database ('nas' table) # Clients will ONLY be read on server startup. read_clients = yes # Table to keep radius client info client_table = "nas" # # The group attribute specific to this instance of rlm_sql # # This entry should be used for additional instances (sql foo {}) # of the SQL module. # group_attribute = "${.:instance}-SQL-Group" # This entry should be used for the default instance (sql {}) # of the SQL module. group_attribute = "SQL-Group" # Read database-specific queries # $INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf $INCLUDE ${modconfdir}/sql/main/mysql/queries.conf } Hope you help to find a solution for this error. Looking forward to hearing from you soon. Best wishes; Aghyad

3 3

MAC Address auth?!
by Marco Gaiarin 24 Dec '23

24 Dec '23

A consultant in a session speak about 'MAC address authentication', using Unifi APs/management software, and describing it a '2FA'. If i understood well, enabling a specific options: https://help.ui.com/hc/en-us/articles/115004589707-RADIUS-Based-MAC-Authent… i can connect suppicant to the network (via WPA2/3-Personal, so a shared secret) and then do a second-step authorization using radius, but where account are in the form 'AABBCCDDEEFF' (uppercase MAC address) and password is identical to the user. This seems '0,5FA': 0,5 for a shared passwod, 0 for account where password is identical to username. But effectivaly i found in google some setups like that, that really i don't understand. Someone have some clue? This seems to me real 2FA... https://wiki.freeradius.org/guide/2FA-Active-Directory-plus-Proxy Thanks. -- Vendere no, non passa tra i miei rischi, non comprate i miei dischi e sputatemi addosso. (F. Guccini)

3 2

Monitoring freeradius
by dextá 23 Dec '23

23 Dec '23

Hello, What are the critical points to monitor in freeradius? I'm thinking of monitoring our server via zabbix. Thanks in advance!

2 1

Class atrribute is not updating with CoA
by Imdad Hasan 21 Dec '23

21 Dec '23

Hi All, Can anyone please guide me why the Class attribute is not updating with CoA, even the CoA response is showing ACK (Success). So How can I update the Class attribute with CoA.? Thanks Imdad

2 1

ERROR: FAILED: No NT-Password. Cannot perform authentication
by Chevy Innis 20 Dec '23

20 Dec '23

Hi everyone, I have Aruba APs, FreeRADIUS, and 389 directory server for LDAP. From what I can gather from the debug output and my own research, I can see that the client (Aruba AP) is trying to use EAP-MSCHAPv2 for authentication, which is not compatible with the SSHA2-512 stored passwords in our LDAP server. The solution I have seen for this is to either change the password storage format, or change the authentication method, preferably the later. Aruba APs are compatible with a number of eap authentication methods that should work with SSHA2-512 passwords, but there is no way to define this on the controller, so I think this has to be done on the radius server. Let me know if I am on the right track. If this assumption is correct, how do I manually define the authentication method on freeradius? Or if I am totally wrong and misguided, a point in the right direction will be greatly appreciated. See debug output below. Thank you. root@paw-mgmt-svr04:/home/pawnetadmin# freeradius -X 2>&1 | tee debugfile FreeRADIUS Version 3.0.26 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/ldap including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 202.8.32.153 { ipaddr = 202.8.32.153 require_message_authenticator = no secret = <<< secret >>> shortname = "paw-mgmt-ap01" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/3.0/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap ldap { server = "ldap://ldap-pool.pawsey.org.au" identity = "uid=cinnis,ou=people,dc=pawsey,dc=org,dc=au" password = <<< secret >>> sasl { } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=pawsey,dc=org,dc=au" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } instantiate { } # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no reject_unknown_intermediate_ca = no ecdh_curve = "" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/coa # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20516 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap-pool.pawsey.org.au:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap-pool.pawsey.org.au:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap-pool.pawsey.org.au:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap-pool.pawsey.org.au:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap-pool.pawsey.org.au:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:336 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 57048 Listening on proxy address :: port 47947 Ready to process requests (0) Received Access-Request Id 31 from 202.8.32.153:64998 to 146.118.55.22:1812 length 252 (0) User-Name = "cinnis" (0) NAS-IP-Address = 202.8.32.153 (0) NAS-Port = 0 (0) NAS-Identifier = "202.8.32.153" (0) NAS-Port-Type = Wireless-802.11 (0) Calling-Station-Id = "aef623dbdd7d" (0) Called-Station-Id = "b837b2cc82c7" (0) Service-Type = Framed-User (0) Framed-MTU = 1100 (0) EAP-Message = 0x0222000b0163696e6e6973 (0) Aruba-Essid-Name = "pawsey-aruba01" (0) Aruba-Location-Id = "paw-mgmt-ap01" (0) Aruba-AP-Group = "Pawsey" (0) Aruba-AP-MAC-Address = "b837b2cc82c7" (0) Aruba-Device-MAC-Address = "aef623dbdd7d" (0) WLAN-Pairwise-Cipher = 1027081 (0) WLAN-Group-Cipher = 1027081 (0) WLAN-Group-Mgmt-Cipher = 1027084 (0) WLAN-AKM-Suite = 1027084 (0) Message-Authenticator = 0xbf5cfcc1d9a4b65fc38841eba1bc5a53 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 34 length 11 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 35 length 22 (0) eap: EAP session adding &reply:State = 0xacbf8e2dac9c8a23 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 31 from 146.118.55.22:1812 to 202.8.32.153:64998 length 80 (0) EAP-Message = 0x012300160410f81be1c0c58574328670a9084ba7ce33 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xacbf8e2dac9c8a23447f5f0d988fc5a6 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 32 from 202.8.32.153:64998 to 146.118.55.22:1812 length 267 (1) User-Name = "cinnis" (1) NAS-IP-Address = 202.8.32.153 (1) NAS-Port = 0 (1) NAS-Identifier = "202.8.32.153" (1) NAS-Port-Type = Wireless-802.11 (1) Calling-Station-Id = "aef623dbdd7d" (1) Called-Station-Id = "b837b2cc82c7" (1) Service-Type = Framed-User (1) Framed-MTU = 1100 (1) EAP-Message = 0x022300080319152b (1) State = 0xacbf8e2dac9c8a23447f5f0d988fc5a6 (1) Aruba-Essid-Name = "pawsey-aruba01" (1) Aruba-Location-Id = "paw-mgmt-ap01" (1) Aruba-AP-Group = "Pawsey" (1) Aruba-AP-MAC-Address = "b837b2cc82c7" (1) Aruba-Device-MAC-Address = "aef623dbdd7d" (1) WLAN-Pairwise-Cipher = 1027081 (1) WLAN-Group-Cipher = 1027081 (1) WLAN-Group-Mgmt-Cipher = 1027084 (1) WLAN-AKM-Suite = 1027084 (1) Message-Authenticator = 0x0da18016c6e85b1432a7eed37e2c02d1 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 35 length 8 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop rlm_ldap (ldap): Reserved connection (0) (1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (1) ldap: --> (uid=cinnis) (1) ldap: Performing search in "ou=people,dc=pawsey,dc=org,dc=au" with filter "(uid=cinnis)", scope "sub" (1) ldap: Waiting for search result... (1) ldap: User object found at DN "uid=cinnis,ou=people,dc=pawsey,dc=org,dc=au" (1) ldap: Processing user attributes (1) ldap: control:Password-With-Header += '{SSHA512}nx/7G2SlyNnOn/GAt9PupHv9tXr+3k1sw0RCEXLOUz0CMR330v4xLfdRfYtkvzfxAQtorEB2igMDtm1Dah7APpeiezp8X9Yh' rlm_ldap (ldap): Released connection (0) Need more connections to reach 10 spares rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used rlm_ldap (ldap): Connecting to ldap://ldap-pool.pawsey.org.au:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (1) [ldap] = updated (1) [expiration] = noop (1) [logintime] = noop (1) pap: Converted: &control:Password-With-Header -> &control:SSHA2-512-Password (1) pap: Removing &control:Password-With-Header (1) pap: Normalizing SSHA2-512-Password from base64 encoding, 96 bytes -> 72 bytes (1) pap: WARNING: Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xacbf8e2dac9c8a23 (1) eap: Finished EAP session with state 0xacbf8e2dac9c8a23 (1) eap: Previous EAP request found for state 0xacbf8e2dac9c8a23, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: (TLS) Initiating new session (1) eap: Sending EAP Request (code 1) ID 36 length 6 (1) eap: EAP session adding &reply:State = 0xacbf8e2dad9b9723 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) session-state: Saving cached attributes (1) Framed-MTU = 994 (1) Sent Access-Challenge Id 32 from 146.118.55.22:1812 to 202.8.32.153:64998 length 64 (1) EAP-Message = 0x012400061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xacbf8e2dad9b9723447f5f0d988fc5a6 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 33 from 202.8.32.153:64998 to 146.118.55.22:1812 length 420 (2) User-Name = "cinnis" (2) NAS-IP-Address = 202.8.32.153 (2) NAS-Port = 0 (2) NAS-Identifier = "202.8.32.153" (2) NAS-Port-Type = Wireless-802.11 (2) Calling-Station-Id = "aef623dbdd7d" (2) Called-Station-Id = "b837b2cc82c7" (2) Service-Type = Framed-User (2) Framed-MTU = 1100 (2) EAP-Message = 0x022400a119800000009716030100920100008e0303658257969eabec888737990ce4b7e8897a8c17fd201a49aae1935abe072a3fce00002c00ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000a01000039000a00080006001700180019000b00020100000d00120010040102010501060104030203050306030005000501000000000012000000170000 (2) State = 0xacbf8e2dad9b9723447f5f0d988fc5a6 (2) Aruba-Essid-Name = "pawsey-aruba01" (2) Aruba-Location-Id = "paw-mgmt-ap01" (2) Aruba-AP-Group = "Pawsey" (2) Aruba-AP-MAC-Address = "b837b2cc82c7" (2) Aruba-Device-MAC-Address = "aef623dbdd7d" (2) WLAN-Pairwise-Cipher = 1027081 (2) WLAN-Group-Cipher = 1027081 (2) WLAN-Group-Mgmt-Cipher = 1027084 (2) WLAN-AKM-Suite = 1027084 (2) Message-Authenticator = 0x41ac94e039eeeb27aa7995d3ec2d12d8 (2) Restoring &session-state (2) &session-state:Framed-MTU = 994 (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 36 length 161 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xacbf8e2dad9b9723 (2) eap: Finished EAP session with state 0xacbf8e2dad9b9723 (2) eap: Previous EAP request found for state 0xacbf8e2dad9b9723, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: (TLS) EAP Peer says that the final record size will be 151 bytes (2) eap_peap: (TLS) EAP Got all data (151 bytes) (2) eap_peap: (TLS) Handshake state - before SSL initialization (2) eap_peap: (TLS) Handshake state - Server before SSL initialization (2) eap_peap: (TLS) Handshake state - Server before SSL initialization (2) eap_peap: (TLS) recv TLS 1.3 Handshake, ClientHello (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS read client hello (2) eap_peap: (TLS) send TLS 1.2 Handshake, ServerHello (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write server hello (2) eap_peap: (TLS) send TLS 1.2 Handshake, Certificate (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write certificate (2) eap_peap: (TLS) send TLS 1.2 Handshake, ServerKeyExchange (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write key exchange (2) eap_peap: (TLS) send TLS 1.2 Handshake, ServerHelloDone (2) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write server done (2) eap_peap: (TLS) Server : Need to read more data: SSLv3/TLS write server done (2) eap_peap: (TLS) In Handshake Phase (2) eap: Sending EAP Request (code 1) ID 37 length 1004 (2) eap: EAP session adding &reply:State = 0xacbf8e2dae9a9723 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) session-state: Saving cached attributes (2) Framed-MTU = 994 (2) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (2) Sent Access-Challenge Id 33 from 146.118.55.22:1812 to 202.8.32.153:64998 length 1068 (2) EAP-Message = 0x012503ec19c0000004b7160303003d0200003903033149d44db36075066fed6bbc685d4369b7889473b1e3a955db966bcb9c69a1fb00c030000011ff01000100000b0004030001020017000016030303150b00031100030e00030b30820307308201efa00302010202144f9061a1e632766cf1e30650c2111644c212039e300d06092a864886f70d01010b050030193117301506035504030c0e7061772d6d676d742d7376723034301e170d3233313231323033313834395a170d3333313230393033313834395a30193117301506035504030c0e7061772d6d676d742d737672303430820122300d06092a864886f70d01010105000382010f003082010a0282010100a0cc25fdcbb3e3bfeaacb179da71513655babfbb15427d809f145d8178c6b8ae287dd19c780a74a9a24c133a9df31006d361bcc756f6a46062aad3500d983389003bdd2bf1eaac53c04bb12f2494ed6d0c50d445e9a2154d011ed651db35fa2d13be28f60fa0017726baf0378c7f021ecdf3b1 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xacbf8e2dae9a9723447f5f0d988fc5a6 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 34 from 202.8.32.153:64998 to 146.118.55.22:1812 length 265 (3) User-Name = "cinnis" (3) NAS-IP-Address = 202.8.32.153 (3) NAS-Port = 0 (3) NAS-Identifier = "202.8.32.153" (3) NAS-Port-Type = Wireless-802.11 (3) Calling-Station-Id = "aef623dbdd7d" (3) Called-Station-Id = "b837b2cc82c7" (3) Service-Type = Framed-User (3) Framed-MTU = 1100 (3) EAP-Message = 0x022500061900 (3) State = 0xacbf8e2dae9a9723447f5f0d988fc5a6 (3) Aruba-Essid-Name = "pawsey-aruba01" (3) Aruba-Location-Id = "paw-mgmt-ap01" (3) Aruba-AP-Group = "Pawsey" (3) Aruba-AP-MAC-Address = "b837b2cc82c7" (3) Aruba-Device-MAC-Address = "aef623dbdd7d" (3) WLAN-Pairwise-Cipher = 1027081 (3) WLAN-Group-Cipher = 1027081 (3) WLAN-Group-Mgmt-Cipher = 1027084 (3) WLAN-AKM-Suite = 1027084 (3) Message-Authenticator = 0xc6ed1a5762cf7aa597926146d310beaa (3) Restoring &session-state (3) &session-state:Framed-MTU = 994 (3) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 37 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0xacbf8e2dae9a9723 (3) eap: Finished EAP session with state 0xacbf8e2dae9a9723 (3) eap: Previous EAP request found for state 0xacbf8e2dae9a9723, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: (TLS) Peer ACKed our handshake fragment (3) eap: Sending EAP Request (code 1) ID 38 length 219 (3) eap: EAP session adding &reply:State = 0xacbf8e2daf999723 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) session-state: Saving cached attributes (3) Framed-MTU = 994 (3) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (3) Sent Access-Challenge Id 34 from 146.118.55.22:1812 to 202.8.32.153:64998 length 277 (3) EAP-Message = 0x012600db190081d6599b85f5ae458d1c1f2693a2ff6de32f92243c82cc5c43b74d23858dc3fe15c43180ac6ee82628e764ad376431085cfa8f595b43cecf51564fc58557f645bdae4a8cb6192359b285198020f06468cbe6122710a3b48d9455e017419c446e28ec60b7b0466955b98451d167f9f5537b850cca3622fb2445871cbfb30d82ee4636db92de8bb91d760baa4a98ab59daaf99d2c522369c16e614a5ec758afccca22f2919aa7b67c45b4b4d8874f94e41c28d1c8d63450c6cad5ea4c0ba25fe88c5bdd9c982022fa6e4b93f5716030300040e000000 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xacbf8e2daf999723447f5f0d988fc5a6 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 35 from 202.8.32.153:64998 to 146.118.55.22:1812 length 395 (4) User-Name = "cinnis" (4) NAS-IP-Address = 202.8.32.153 (4) NAS-Port = 0 (4) NAS-Identifier = "202.8.32.153" (4) NAS-Port-Type = Wireless-802.11 (4) Calling-Station-Id = "aef623dbdd7d" (4) Called-Station-Id = "b837b2cc82c7" (4) Service-Type = Framed-User (4) Framed-MTU = 1100 (4) EAP-Message = 0x0226008819800000007e1603030046100000424104b46f177c54099766e9ea709a123c22b0facecbe7f746ed35b53b95929abc8a1b391d0db8e79eb497e8167c5404c66924ebf488aefa9783a5bc931098976db1c9140303000101160303002885ad6f7b5100450f2a1365da8f33c95e6e36a745c9b79350efe834acdc8bbee182a58efdbe506f96 (4) State = 0xacbf8e2daf999723447f5f0d988fc5a6 (4) Aruba-Essid-Name = "pawsey-aruba01" (4) Aruba-Location-Id = "paw-mgmt-ap01" (4) Aruba-AP-Group = "Pawsey" (4) Aruba-AP-MAC-Address = "b837b2cc82c7" (4) Aruba-Device-MAC-Address = "aef623dbdd7d" (4) WLAN-Pairwise-Cipher = 1027081 (4) WLAN-Group-Cipher = 1027081 (4) WLAN-Group-Mgmt-Cipher = 1027084 (4) WLAN-AKM-Suite = 1027084 (4) Message-Authenticator = 0xb7aa9e69a1ac50f578088035570a5c8f (4) Restoring &session-state (4) &session-state:Framed-MTU = 994 (4) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 38 length 136 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0xacbf8e2daf999723 (4) eap: Finished EAP session with state 0xacbf8e2daf999723 (4) eap: Previous EAP request found for state 0xacbf8e2daf999723, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: (TLS) EAP Peer says that the final record size will be 126 bytes (4) eap_peap: (TLS) EAP Got all data (126 bytes) (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write server done (4) eap_peap: (TLS) recv TLS 1.2 Handshake, ClientKeyExchange (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS read client key exchange (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS read change cipher spec (4) eap_peap: (TLS) recv TLS 1.2 Handshake, Finished (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS read finished (4) eap_peap: (TLS) send TLS 1.2 ChangeCipherSpec (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write change cipher spec (4) eap_peap: (TLS) send TLS 1.2 Handshake, Finished (4) eap_peap: (TLS) Handshake state - Server SSLv3/TLS write finished (4) eap_peap: (TLS) Handshake state - SSL negotiation finished successfully (4) eap_peap: (TLS) Connection Established (4) eap_peap: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (4) eap_peap: TLS-Session-Version = "TLS 1.2" (4) eap: Sending EAP Request (code 1) ID 39 length 57 (4) eap: EAP session adding &reply:State = 0xacbf8e2da8989723 (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) session-state: Saving cached attributes (4) Framed-MTU = 994 (4) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (4) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (4) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (4) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (4) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (4) TLS-Session-Version = "TLS 1.2" (4) Sent Access-Challenge Id 35 from 146.118.55.22:1812 to 202.8.32.153:64998 length 115 (4) EAP-Message = 0x0127003919001403030001011603030028adadc0d8bac571660801b6061e715d09965c990efff3734d505445672aa0dd6e413c9a872c786179 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xacbf8e2da8989723447f5f0d988fc5a6 (4) Finished request Waking up in 4.8 seconds. (5) Received Access-Request Id 36 from 202.8.32.153:64998 to 146.118.55.22:1812 length 265 (5) User-Name = "cinnis" (5) NAS-IP-Address = 202.8.32.153 (5) NAS-Port = 0 (5) NAS-Identifier = "202.8.32.153" (5) NAS-Port-Type = Wireless-802.11 (5) Calling-Station-Id = "aef623dbdd7d" (5) Called-Station-Id = "b837b2cc82c7" (5) Service-Type = Framed-User (5) Framed-MTU = 1100 (5) EAP-Message = 0x022700061900 (5) State = 0xacbf8e2da8989723447f5f0d988fc5a6 (5) Aruba-Essid-Name = "pawsey-aruba01" (5) Aruba-Location-Id = "paw-mgmt-ap01" (5) Aruba-AP-Group = "Pawsey" (5) Aruba-AP-MAC-Address = "b837b2cc82c7" (5) Aruba-Device-MAC-Address = "aef623dbdd7d" (5) WLAN-Pairwise-Cipher = 1027081 (5) WLAN-Group-Cipher = 1027081 (5) WLAN-Group-Mgmt-Cipher = 1027084 (5) WLAN-AKM-Suite = 1027084 (5) Message-Authenticator = 0x793a0acd9005fabc0fb41c74cbe98639 (5) Restoring &session-state (5) &session-state:Framed-MTU = 994 (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (5) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (5) &session-state:TLS-Session-Version = "TLS 1.2" (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 39 length 6 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0xacbf8e2da8989723 (5) eap: Finished EAP session with state 0xacbf8e2da8989723 (5) eap: Previous EAP request found for state 0xacbf8e2da8989723, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: (TLS) Peer ACKed our handshake fragment. handshake is finished (5) eap_peap: Session established. Decoding tunneled attributes (5) eap_peap: PEAP state TUNNEL ESTABLISHED (5) eap: Sending EAP Request (code 1) ID 40 length 40 (5) eap: EAP session adding &reply:State = 0xacbf8e2da9979723 (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) session-state: Saving cached attributes (5) Framed-MTU = 994 (5) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (5) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (5) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (5) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (5) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (5) TLS-Session-Version = "TLS 1.2" (5) Sent Access-Challenge Id 36 from 146.118.55.22:1812 to 202.8.32.153:64998 length 98 (5) EAP-Message = 0x012800281900170303001dadadc0d8bac571673d34fcf19da62cc342aa46fd9f4c1e25eee85abab0 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0xacbf8e2da9979723447f5f0d988fc5a6 (5) Finished request Waking up in 4.8 seconds. (6) Received Access-Request Id 37 from 202.8.32.153:64998 to 146.118.55.22:1812 length 301 (6) User-Name = "cinnis" (6) NAS-IP-Address = 202.8.32.153 (6) NAS-Port = 0 (6) NAS-Identifier = "202.8.32.153" (6) NAS-Port-Type = Wireless-802.11 (6) Calling-Station-Id = "aef623dbdd7d" (6) Called-Station-Id = "b837b2cc82c7" (6) Service-Type = Framed-User (6) Framed-MTU = 1100 (6) EAP-Message = 0x0228002a1900170303001f85ad6f7b51004510436531d625b8985bee0d04b04fe10b9fe3c2b6be08d03e (6) State = 0xacbf8e2da9979723447f5f0d988fc5a6 (6) Aruba-Essid-Name = "pawsey-aruba01" (6) Aruba-Location-Id = "paw-mgmt-ap01" (6) Aruba-AP-Group = "Pawsey" (6) Aruba-AP-MAC-Address = "b837b2cc82c7" (6) Aruba-Device-MAC-Address = "aef623dbdd7d" (6) WLAN-Pairwise-Cipher = 1027081 (6) WLAN-Group-Cipher = 1027081 (6) WLAN-Group-Mgmt-Cipher = 1027084 (6) WLAN-AKM-Suite = 1027084 (6) Message-Authenticator = 0xc838f6a2988a899a1ab7f2f936acba3a (6) Restoring &session-state (6) &session-state:Framed-MTU = 994 (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (6) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) &session-state:TLS-Session-Version = "TLS 1.2" (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 40 length 42 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0xacbf8e2da9979723 (6) eap: Finished EAP session with state 0xacbf8e2da9979723 (6) eap: Previous EAP request found for state 0xacbf8e2da9979723, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: (TLS) EAP Done initial handshake (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state WAITING FOR INNER IDENTITY (6) eap_peap: Identity - cinnis (6) eap_peap: Got inner identity 'cinnis' (6) eap_peap: Setting default EAP type for tunneled EAP session (6) eap_peap: Got tunneled request (6) eap_peap: EAP-Message = 0x0228000b0163696e6e6973 (6) eap_peap: Setting User-Name to cinnis (6) eap_peap: Sending tunneled request to inner-tunnel (6) eap_peap: EAP-Message = 0x0228000b0163696e6e6973 (6) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (6) eap_peap: User-Name = "cinnis" (6) Virtual server inner-tunnel received request (6) EAP-Message = 0x0228000b0163696e6e6973 (6) FreeRADIUS-Proxied-To = 127.0.0.1 (6) User-Name = "cinnis" (6) WARNING: Outer and inner identities are the same. User privacy is compromised. (6) server inner-tunnel { (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [chap] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) update control { (6) &Proxy-To-Realm := LOCAL (6) } # update control = noop (6) eap: Peer sent EAP Response (code 2) ID 40 length 11 (6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (6) authenticate { (6) eap: Peer sent packet with method EAP Identity (1) (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: Issuing Challenge (6) eap: Sending EAP Request (code 1) ID 41 length 43 (6) eap: EAP session adding &reply:State = 0x2e43fcfd2e6ae697 (6) [eap] = handled (6) } # authenticate = handled (6) } # server inner-tunnel (6) Virtual server sending reply (6) EAP-Message = 0x0129002b1a01290026107782beaf28a29753aaaa8735c1e80502667265657261646975732d332e302e3236 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x2e43fcfd2e6ae69791d2eb31eacfa999 (6) eap_peap: Got tunneled reply code 11 (6) eap_peap: EAP-Message = 0x0129002b1a01290026107782beaf28a29753aaaa8735c1e80502667265657261646975732d332e302e3236 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0x2e43fcfd2e6ae69791d2eb31eacfa999 (6) eap_peap: Got tunneled reply RADIUS code 11 (6) eap_peap: EAP-Message = 0x0129002b1a01290026107782beaf28a29753aaaa8735c1e80502667265657261646975732d332e302e3236 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0x2e43fcfd2e6ae69791d2eb31eacfa999 (6) eap_peap: Got tunneled Access-Challenge (6) eap: Sending EAP Request (code 1) ID 41 length 74 (6) eap: EAP session adding &reply:State = 0xacbf8e2daa969723 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) session-state: Saving cached attributes (6) Framed-MTU = 994 (6) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (6) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (6) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (6) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (6) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) TLS-Session-Version = "TLS 1.2" (6) Sent Access-Challenge Id 37 from 146.118.55.22:1812 to 202.8.32.153:64998 length 132 (6) EAP-Message = 0x0129004a1900170303003fadadc0d8bac57168169ea553441fae056b4b81c61ccc1aa325adda636fd76131712a09458793559d9c3d405107ea0d82762f62151e81f80eef5e805661fd55 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0xacbf8e2daa969723447f5f0d988fc5a6 (6) Finished request Waking up in 4.8 seconds. (7) Received Access-Request Id 38 from 202.8.32.153:64998 to 146.118.55.22:1812 length 355 (7) User-Name = "cinnis" (7) NAS-IP-Address = 202.8.32.153 (7) NAS-Port = 0 (7) NAS-Identifier = "202.8.32.153" (7) NAS-Port-Type = Wireless-802.11 (7) Calling-Station-Id = "aef623dbdd7d" (7) Called-Station-Id = "b837b2cc82c7" (7) Service-Type = Framed-User (7) Framed-MTU = 1100 (7) EAP-Message = 0x022900601900170303005585ad6f7b51004511bf7522d9301d7bcefdd3a583e613c0851a7768a77374a35c81ecf65b0889485da2fa99e7e02acc39871d28cf6defca36ff9e54a0071e536fb4f4f5bac20ad967b81d2cea5e490076ebb7ca7d1d (7) State = 0xacbf8e2daa969723447f5f0d988fc5a6 (7) Aruba-Essid-Name = "pawsey-aruba01" (7) Aruba-Location-Id = "paw-mgmt-ap01" (7) Aruba-AP-Group = "Pawsey" (7) Aruba-AP-MAC-Address = "b837b2cc82c7" (7) Aruba-Device-MAC-Address = "aef623dbdd7d" (7) WLAN-Pairwise-Cipher = 1027081 (7) WLAN-Group-Cipher = 1027081 (7) WLAN-Group-Mgmt-Cipher = 1027084 (7) WLAN-AKM-Suite = 1027084 (7) Message-Authenticator = 0x2662a952fe880851d5c8b6c082d48c8c (7) Restoring &session-state (7) &session-state:Framed-MTU = 994 (7) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (7) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (7) &session-state:TLS-Session-Version = "TLS 1.2" (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) eap: Peer sent EAP Response (code 2) ID 41 length 96 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x2e43fcfd2e6ae697 (7) eap: Finished EAP session with state 0xacbf8e2daa969723 (7) eap: Previous EAP request found for state 0xacbf8e2daa969723, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: (TLS) EAP Done initial handshake (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state phase2 (7) eap_peap: EAP method MSCHAPv2 (26) (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x022900411a0229003c31a72220197244c30038b38ac77f0844570000000000000000d68f2ca22b77c9ba02a72ed883ffbd1aac3115947968f01d0063696e6e6973 (7) eap_peap: Setting User-Name to cinnis (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x022900411a0229003c31a72220197244c30038b38ac77f0844570000000000000000d68f2ca22b77c9ba02a72ed883ffbd1aac3115947968f01d0063696e6e6973 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "cinnis" (7) eap_peap: State = 0x2e43fcfd2e6ae69791d2eb31eacfa999 (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x022900411a0229003c31a72220197244c30038b38ac77f0844570000000000000000d68f2ca22b77c9ba02a72ed883ffbd1aac3115947968f01d0063696e6e6973 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "cinnis" (7) State = 0x2e43fcfd2e6ae69791d2eb31eacfa999 (7) WARNING: Outer and inner identities are the same. User privacy is compromised. (7) server inner-tunnel { (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [chap] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) update control { (7) &Proxy-To-Realm := LOCAL (7) } # update control = noop (7) eap: Peer sent EAP Response (code 2) ID 41 length 65 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [files] = noop rlm_ldap (ldap): Reserved connection (1) (7) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (7) ldap: --> (uid=cinnis) (7) ldap: Performing search in "ou=people,dc=pawsey,dc=org,dc=au" with filter "(uid=cinnis)", scope "sub" (7) ldap: Waiting for search result... (7) ldap: User object found at DN "uid=cinnis,ou=people,dc=pawsey,dc=org,dc=au" (7) ldap: Processing user attributes (7) ldap: control:Password-With-Header += '{SSHA512}nx/7G2SlyNnOn/GAt9PupHv9tXr+3k1sw0RCEXLOUz0CMR330v4xLfdRfYtkvzfxAQtorEB2igMDtm1Dah7APpeiezp8X9Yh' rlm_ldap (ldap): Released connection (1) (7) [ldap] = updated (7) [expiration] = noop (7) [logintime] = noop (7) pap: Converted: &control:Password-With-Header -> &control:SSHA2-512-Password (7) pap: Removing &control:Password-With-Header (7) pap: Normalizing SSHA2-512-Password from base64 encoding, 96 bytes -> 72 bytes (7) pap: WARNING: Auth-Type already set. Not setting to PAP (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authenticate { (7) eap: Expiring EAP session with state 0x2e43fcfd2e6ae697 (7) eap: Finished EAP session with state 0x2e43fcfd2e6ae697 (7) eap: Previous EAP request found for state 0x2e43fcfd2e6ae697, released from the list (7) eap: Peer sent packet with method EAP MSCHAPv2 (26) (7) eap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) eap_mschapv2: authenticate { (7) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (7) mschap: Creating challenge hash with username: cinnis (7) mschap: Client is using MS-CHAPv2 (7) mschap: ERROR: FAILED: No NT-Password. Cannot perform authentication (7) mschap: ERROR: MS-CHAP2-Response is incorrect (7) eap_mschapv2: [mschap] = reject (7) eap_mschapv2: } # authenticate = reject (7) eap: Sending EAP Failure (code 4) ID 41 length 4 (7) eap: Freeing handler (7) [eap] = reject (7) } # authenticate = reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject: EXPAND %{User-Name} (7) attr_filter.access_reject: --> cinnis (7) attr_filter.access_reject: Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) update outer.session-state { (7) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: FAILED: No NT-Password. Cannot perform authentication' (7) } # update outer.session-state = noop (7) } # Post-Auth-Type REJECT = updated (7) } # server inner-tunnel (7) Virtual server sending reply (7) MS-CHAP-Error = ")E=691 R=1 C=b6fadc319ac0a2784f689ea7332565c9 V=3 M=Authentication rejected" (7) EAP-Message = 0x04290004 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: Got tunneled reply code 3 (7) eap_peap: MS-CHAP-Error = ")E=691 R=1 C=b6fadc319ac0a2784f689ea7332565c9 V=3 M=Authentication rejected" (7) eap_peap: EAP-Message = 0x04290004 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: Got tunneled reply RADIUS code 3 (7) eap_peap: MS-CHAP-Error = ")E=691 R=1 C=b6fadc319ac0a2784f689ea7332565c9 V=3 M=Authentication rejected" (7) eap_peap: EAP-Message = 0x04290004 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: Tunneled authentication was rejected (7) eap_peap: FAILURE (7) eap: Sending EAP Request (code 1) ID 42 length 46 (7) eap: EAP session adding &reply:State = 0xacbf8e2dab959723 (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) Challenge { ... } # empty sub-section is ignored (7) session-state: Saving cached attributes (7) Framed-MTU = 994 (7) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (7) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (7) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (7) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (7) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (7) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (7) TLS-Session-Version = "TLS 1.2" (7) Module-Failure-Message := "mschap: FAILED: No NT-Password. Cannot perform authentication" (7) Sent Access-Challenge Id 38 from 146.118.55.22:1812 to 202.8.32.153:64998 length 104 (7) EAP-Message = 0x012a002e19001703030023adadc0d8bac571691422853e29e1488bede09f06ee11589b59c4f69816e1b3493109bf (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0xacbf8e2dab959723447f5f0d988fc5a6 (7) Finished request Waking up in 4.8 seconds. (8) Received Access-Request Id 39 from 202.8.32.153:64998 to 146.118.55.22:1812 length 305 (8) User-Name = "cinnis" (8) NAS-IP-Address = 202.8.32.153 (8) NAS-Port = 0 (8) NAS-Identifier = "202.8.32.153" (8) NAS-Port-Type = Wireless-802.11 (8) Calling-Station-Id = "aef623dbdd7d" (8) Called-Station-Id = "b837b2cc82c7" (8) Service-Type = Framed-User (8) Framed-MTU = 1100 (8) EAP-Message = 0x022a002e1900170303002385ad6f7b510045124a6c7543d95cf4c13d2688d43fee9bfbc37b92550f05040ebad2e0 (8) State = 0xacbf8e2dab959723447f5f0d988fc5a6 (8) Aruba-Essid-Name = "pawsey-aruba01" (8) Aruba-Location-Id = "paw-mgmt-ap01" (8) Aruba-AP-Group = "Pawsey" (8) Aruba-AP-MAC-Address = "b837b2cc82c7" (8) Aruba-Device-MAC-Address = "aef623dbdd7d" (8) WLAN-Pairwise-Cipher = 1027081 (8) WLAN-Group-Cipher = 1027081 (8) WLAN-Group-Mgmt-Cipher = 1027084 (8) WLAN-AKM-Suite = 1027084 (8) Message-Authenticator = 0x0b7fd77c594812484ce9443a8580abea (8) Restoring &session-state (8) &session-state:Framed-MTU = 994 (8) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (8) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (8) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (8) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (8) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (8) &session-state:TLS-Session-Version = "TLS 1.2" (8) &session-state:Module-Failure-Message := "mschap: FAILED: No NT-Password. Cannot perform authentication" (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "cinnis", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 42 length 46 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0xacbf8e2dab959723 (8) eap: Finished EAP session with state 0xacbf8e2dab959723 (8) eap: Previous EAP request found for state 0xacbf8e2dab959723, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: (TLS) EAP Done initial handshake (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state send tlv failure (8) eap_peap: Received EAP-TLV response (8) eap_peap: ERROR: The users session was previously rejected: returning reject (again.) (8) eap_peap: This means you need to read the PREVIOUS messages in the debug output (8) eap_peap: to find out the reason why the user was rejected (8) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (8) eap_peap: what went wrong, and how to fix the problem (8) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (8) eap: Sending EAP Failure (code 4) ID 42 length 4 (8) eap: Failed in EAP select (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> cinnis (8) attr_filter.access_reject: Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated (8) [eap] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (8) Sending delayed response (8) Sent Access-Reject Id 39 from 146.118.55.22:1812 to 202.8.32.153:64998 length 44 (8) EAP-Message = 0x042a0004 (8) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. (0) Cleaning up request packet ID 31 with timestamp +30 due to cleanup_delay was reached (1) Cleaning up request packet ID 32 with timestamp +30 due to cleanup_delay was reached (2) Cleaning up request packet ID 33 with timestamp +30 due to cleanup_delay was reached (3) Cleaning up request packet ID 34 with timestamp +30 due to cleanup_delay was reached (4) Cleaning up request packet ID 35 with timestamp +30 due to cleanup_delay was reached (5) Cleaning up request packet ID 36 with timestamp +30 due to cleanup_delay was reached (6) Cleaning up request packet ID 37 with timestamp +30 due to cleanup_delay was reached (7) Cleaning up request packet ID 38 with timestamp +30 due to cleanup_delay was reached (8) Cleaning up request packet ID 39 with timestamp +30 due to cleanup_delay was reached Ready to process requests

2 3

I encountered the problem that there is an account in the database, but the authentication process feedback does not exist. Please help.
by 娶你苟命 19 Dec '23

19 Dec '23

Hi,everyone！ * I'm having trouble with freeradius and don't know if I should ask "freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org>"? If this has caused any inconvenience to anyone, please accept my apology and please ignore this email.* * The following is the debugging process tee debugfile I provide for freeradius sever to execute radiusd -X 2>&1 | (this includes valid authentication and invalid authentication processes, I will put them at the end of the email):* FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client all_client { ipaddr = 0.0.0.0/0 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "dbuser" password = <<< secret >>> radius_db = "radiusdb" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY i d" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY i d" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedproto col FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '% {NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '% {NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, c onnectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatec ause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME( %{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', ' ', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Tim estamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsess iontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctet s = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time} :-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Giga words}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE Ac ctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT" . # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm # Instantiating module "sql" from file /etc/raddb/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.1.48-MariaDB mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radiusdb" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 11.2.2-MariaDB-log, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 11.2.2-MariaDB-log, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 11.2.2-MariaDB-log, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 11.2.2-MariaDB-log, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 11.2.2-MariaDB-log, protocol version 10 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:330 } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on proxy address * port 34346 Listening on proxy address :: port 45544 Ready to process requests *The following will be the debugging information of the certification process of the switch：* (0) Received Access-Request Id 228 from 192.168.1.243:38272 to 192.168.2.118:1812 length 215 (0) User-Name = "netnoc" (0) NAS-Identifier = "4F-37U-S6812" (0) Acct-Session-Id = "0000000106121519040000000108000026168" (0) User-Password = "123456" (0) Calling-Station-Id = "192.168.2.1" (0) NAS-Port-Type = Virtual (0) Attr-26.25506.230 = 0x4d2d4769676162697445746865726e6574302f302f30 (0) Framed-IP-Address = 192.168.2.1 (0) Service-Type = Login-User (0) NAS-IP-Address = 192.168.1.243 (0) H3C-Product-ID = "H3C S6812-48X6C" (0) H3C-NAS-Startup-Timestamp = 1609459214 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "netnoc", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> netnoc (0) sql: SQL-User-Name set to 'netnoc' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'netnoc' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'netnoc' ORDER BY id (0) sql: User found in radcheck table (0) sql: Conditional check items matched, merging assignment check items (0) sql: MD5-Password := 0x6466346638383237653136313136306566383961303439343861363962323139 (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'netnoc' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'netnoc' ORDER BY id (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'netnoc' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'netnoc' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (0) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 11.2.2-MariaDB-log, protocol version 10 (0) [sql] = ok (0) [expiration] = noop (0) [logintime] = noop (0) pap: Normalizing MD5-Password from hex encoding, 32 bytes -> 16 bytes (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known-good" MD5-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /etc/raddb/sites-enabled/default (0) post-auth { (0) update { (0) No attributes updated (0) } # update = noop (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND %{User-Name} (0) sql: --> netnoc (0) sql: SQL-User-Name set to 'netnoc' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'netnoc', '123456', 'Access-Accept', '2023-12-05 10: 07:15.051206') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'netnoc', '123456', 'Access-Accept', '2023 -12-05 10:07:15.051206') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (0) [sql] = ok (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # post-auth = ok (0) Sent Access-Accept Id 228 from 192.168.2.118:1812 to 192.168.1.243:38272 length 0 (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 228 with timestamp +5 Ready to process requests (1) Received Access-Request Id 175 from 192.168.1.244:63378 to 192.168.2.118:1812 length 170 (1) User-Name = "netnoc" (1) User-Password = "123456" (1) Service-Type = Administrative-User (1) Framed-Protocol = X.75-Synchronous (1) Framed-IP-Address = 192.168.2.1 (1) NAS-Identifier = "4F-CE6857-ASW244" (1) NAS-Port-Type = Virtual (1) NAS-IP-Address = 192.168.1.244 (1) Huawei-Startup-Stamp = 1701770673 (1) Huawei-Version = "Huawei VRP Software Version" (1) Huawei-Product-ID = "VRP" (1) Message-Authenticator = 0x83f55529c0423e10fb1e141aa00a5fff (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "netnoc", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [files] = noop (1) sql: EXPAND %{User-Name} (1) sql: --> netnoc (1) sql: SQL-User-Name set to 'netnoc' rlm_sql (sql): Reserved connection (2) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'netnoc' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'netnoc' ORDER BY id (1) sql: User found in radcheck table (1) sql: Conditional check items matched, merging assignment check items (1) sql: MD5-Password := 0x6466346638383237653136313136306566383961303439343861363962323139 (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'netnoc' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'netnoc' ORDER BY id (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'netnoc' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'netnoc' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (2) Need 4 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 11.2.2-MariaDB-log, protocol version 10 (1) [sql] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: Normalizing MD5-Password from hex encoding, 32 bytes -> 16 bytes (1) [pap] = updated (1) } # authorize = updated (1) Found Auth-Type = PAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Auth-Type PAP { (1) pap: Login attempt with password (1) pap: Comparing with "known-good" MD5-Password (1) pap: User authenticated successfully (1) [pap] = ok (1) } # Auth-Type PAP = ok (1) # Executing section post-auth from file /etc/raddb/sites-enabled/default (1) post-auth { (1) update { (1) No attributes updated (1) } # update = noop (1) sql: EXPAND .query (1) sql: --> .query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (1) sql: EXPAND %{User-Name} (1) sql: --> netnoc (1) sql: SQL-User-Name set to 'netnoc' (1) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (1) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'netnoc', '123456', 'Access-Accept', '2023-12-05 10: 07:21.420568') (1) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'netnoc', '123456', 'Access-Accept', '2023 -12-05 10:07:21.420568') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (3) (1) [sql] = ok (1) [exec] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # post-auth = ok (1) Sent Access-Accept Id 175 from 192.168.2.118:1812 to 192.168.1.244:63378 length 0 (1) Finished request Waking up in 4.9 seconds *What is puzzling is that the user "netnoc" exists on my mysql, but when using H3C network supplier products, it will prompt that the user does not exist. I have repeatedly confirmed that there is no problem with the switch configuration file. This problem will not exist when testing with Cisco ACS.* *The following is the mysql account information：* MariaDB [radiusdb]> SELECT * FROM radcheck; +----+----------+--------------------+----+----------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+----------------------------------+ | 1 | netnoc | MD5-Password | := | df4f8827e161sdfg56a04948a69b219 | *The following is my network configuration file using H3C S6812-48X6C. I tried to use both freeradius and system domains but failed, which is very frustrating.* local-user usermgmt service-type ssh terminal authorization-attribute level 3 password cipher sjkak25u98sdk quit ssh server enable ssh user usermgmt service-type all authentication-type password dot1x dot1x authentication-method pap domain default enable freeradius(system) radius scheme freeradius primary authentication 192.168.2.118 key simple demo_radius_secret user-name-format without-domain quit radius scheme system user-name-format without-domain quit domain freeradius authentication login radius-scheme freeradius local quit domain system authentication login radius-scheme freeradius local quit user-interface vty 0 4 acl 2000 inbound authentication-mode scheme protocol inbound ssh * I don’t know if providing the above information will be helpful or troublesome to you. If so, I'm so sorry! I look forward to having you reply to my email again if I need to provide more information. At the same time, I also look forward to your help me solve this problem! Thanks everyone!* * alex007*

3 12

Issue installing FreeRADIUS 3.2.3 MySQL module.
by Mucci Andrea 19 Dec '23

19 Dec '23

Hi All, I'm installing the latest stable version of FreeRADIUS (3.2.3) on the Rhel 8.9 operating system, via the networkradius repository "NetworkRADIUS-8". I have to interface with MariaDB version 10.5, so I have to install the "freeradius-mysql" package. The installation has "mysql-common" and "mysql-libs" dependencies which however conflict with the installed libraries of the MariaDB server. So, it doesn't let me install the "freeradius-mysql" package. Anyone have any idea how I can solve this?? Best Regards Andrea [root@OFVM01 /]# yum install freeradius-mysql Dependencies resolved. ======================================================================================================================================================================================================================================================================= Package Architecture Version Repository Size ======================================================================================================================================================================================================================================================================= Installing: freeradius-mysql x86_64 3.2.3-1.el8 networkradius 15 k Installing dependencies: mysql-common x86_64 8.0.32-1.module+el8.8.0+18446+fca6280e rhel-8-for-x86_64-appstream-rpms 137 k mysql-libs x86_64 8.0.32-1.module+el8.8.0+18446+fca6280e rhel-8-for-x86_64-appstream-rpms 1.5 M Enabling module streams: mysql 8.0 Transaction Summary ======================================================================================================================================================================================================================================================================= Install 3 Packages Total size: 1.6 M Installed size: 7.8 M Is this ok [y/N]: y Downloading Packages: [SKIPPED] mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64.rpm: Already downloaded [SKIPPED] mysql-libs-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64.rpm: Already downloaded [SKIPPED] freeradius-mysql-3.2.3-1.el8.x86_64.rpm: Already downloaded Running transaction check Transaction check succeeded. Running transaction test The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'yum clean packages'. Error: Transaction test error: file /usr/share/mysql/charsets/Index.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/armscii8.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/ascii.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/cp1250.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/cp1251.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/cp1256.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/cp1257.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/cp850.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/cp852.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/cp866.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/dec8.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/geostd8.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/greek.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/hebrew.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/hp8.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/keybcs2.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/koi8r.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/koi8u.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/latin1.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/latin2.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/latin5.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/latin7.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/macce.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/macroman.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 file /usr/share/mysql/charsets/swe7.xml from install of mysql-common-8.0.32-1.module+el8.8.0+18446+fca6280e.x86_64 conflicts with file from package MariaDB-common-10.5.10-1.el8.x86_64 [root@OFVM01 /]#

4 4

Help with Freeradius and Google Suite LDAP
by Chris Bradley 16 Dec '23

16 Dec '23

Hello everyone! :) I have this working but it's not working for all of our users. We have users in our Gsuite with to different email addresses: domain.k12.in.us and students.domain.k12.in.us I can authenticate users from one or the other by modifying the ldap file under mods-enabled and changing the base_DN to match whichever group I want to authenticate. Can anyone, at a very simple level, explain to me how to allow the freeradius server to authenticate users from two base_dn (domain.k12.in.us and students.k12.in.us) using a single server? I've been tinkering with the files and I'm not having any luck. Thanks! -- This message originated from Bartholomew Consolidated School Corporation, Columbus, Indiana. The message and any attachments may be confidential or privileged and are intended only for the individual or entity identified above as the addressee. This email should not be disseminated, distributed, or copied. If you are not the addressee, or if this message has been addressed to you in error, you are not authorized to read, copy or distribute this message or any attachments; and we ask that you please delete it and notify the sender by return e-mail. Delivery of this message and any attachments to any person other than the intended recipient(s) is not intended in any way to waive confidentiality or a privilege. All personal messages express views only of the sender, which are not to be attributed to Bartholomew Consolidated School Corporation, and may not be copied or distributed without this statement.

3 2

Configuring Separate Log File for rlm_ldap Module
by dextá 15 Dec '23

15 Dec '23

hi, Is it possible to configure a separate log file for the rlm_ldap module through rlm_linelog or rlm_detail?

2 2

ERROR: SQL query failed: server error
by Vinayak Makwana 15 Dec '23

15 Dec '23

HI all, We are handling interim-update for accounting purposes .so we are getting interim-update every 10 sec. At that time we are using mysql query to get data from mysql DB. Like Below: Executing select query: SELECT balance FROM users WHERE username = '5656565' We are getting below error sometimes while execute this query : ERROR: rlm_sql_mysql: ERROR 2014 (Commands out of sync; you can't run this command now): HY000 (17) ERROR: SQL query failed: server suggest to me how i can avoid this error. Thanks & Regards Vinayak -- * * *Disclaimer* In addition to generic Disclaimer which you have agreed on our website, any views or opinions presented in this email are solely those of the originator and do not necessarily represent those of the Company or its sister concerns. Any liability (in negligence, contract or otherwise) arising from any third party taking any action, or refraining from taking any action on the basis of any of the information contained in this email is hereby excluded. *Confidentiality* This communication (including any attachment/s) is intended only for the use of the addressee(s) and contains information that is PRIVILEGED AND CONFIDENTIAL. Unauthorized reading, dissemination, distribution, or copying of this communication is prohibited. Please inform originator if you have received it in error. *Caution for viruses, malware etc.* This communication, including any attachments, may not be free of viruses, trojans, similar or new contaminants/malware, interceptions or interference, and may not be compatible with your systems. You shall carry out virus/malware scanning on your own before opening any attachment to this e-mail. The sender of this e-mail and Company including its sister concerns shall not be liable for any damage that may incur to you as a result of viruses, incompleteness of this message, a delay in receipt of this message or any other computer problems.

2 1

FreeTDS errors after running perfectly fine for 30-60minutes.
by Olaf 15 Dec '23

15 Dec '23

Running Freeradius 3.2.3 (from freeradius rep) installed with: sudo apt install freeradius freeradius-utils freeradius-freetds After running for 30-60 minutes this happens on all servers (3) (Debian 12-latetst) Thu Dec 14 06:49:32 2023 : Error: rlm_sql_freetds: unable to send command (ct_send()) Thu Dec 14 06:49:32 2023 : ERROR: (571) ERROR: rlm_sql_freetds: Server msg from "mydbserver": severity(5701), number(0), origin(1), layer(1), procedure "none": Changed database context to 'mydb'. Thu Dec 14 06:49:32 2023 : ERROR: (571) ERROR: SQL query failed: server error Thu Dec 14 06:49:32 2023 : Auth: (571) Login incorrect (rlm_sql_freetds: Server msg from "mydbserver": severity(5701), number(0), origin(1), layer(1), procedure "none": Changed database context to 'mydblog'.): [327700051207842] (from client 192.168.3.161/32 port 0 cli 327700051207842) Thu Dec 14 06:49:32 2023 : Auth: (572) Login OK: [327700050547002] (from client 192.168.3.161/32 port 0 cli 327700050547002) Thu Dec 14 06:49:33 2023 : Auth: (573) Login OK: [327700050626183] (from client 192.168.3.161/32 port 0 cli 327700050626183) Thu Dec 14 06:49:33 2023 : Auth: (574) Login OK: [327700051319260] (from client 192.168.3.161/32 port 0 cli 327700051319260) Thu Dec 14 06:49:34 2023 : Auth: (575) Login OK: [327700051047968] (from client 192.168.3.161/32 port 0 cli 327700051047968) Thu Dec 14 06:49:35 2023 : Error: rlm_sql_freetds: unable to send command (ct_send()) etc etc And start repeating like this forever. Most successful, some not. Restarting freeradius solves it directly. At that exact same moment my old centos server CAN connect with no issues to that same db for years already. I'm clueless whats going on here. But im almost sure it must be something local. Changing start servers did not help. Issue stays. freetds.conf # A typical Microsoft Azure SQL [myserver] host = mydb.database.windows.net port = 1433 tds version = 7.3 database = mydb Note that 7.4 does not connect but 7.3 or lower connects. My Setup is a default as possible with 1 sql query that does accept for unit or not. freeradius-freetds seems to install: freetds-common/stable,now 1.3.17+ds-2 all [installed,automatic] Not sure what to do here to use latest from Freetds (1.4.1) Any suggestions? Thanks, Olaf

3 3

Socket Error
by Deepansha Gaur 13 Dec '23

13 Dec '23

HI team, I am running freeradius -X and getting this error: Failed creating control socket "/var/run/freeradius/freeradius.sock": Control socket '/var/run/freeradius/freeradius.sock' is already in use I have tried to delete the freeradius.sock file and then it gives me another error: Failed binding to auth address * port 1812 bound to server default: Address already in use /etc/freeradius/sites-enabled/default[59]: Error binding to port for 0.0.0.0 port 1812 I try killing the freeradius session and then it give me the same socket error again. When I reboot, I don't see these errors, could you please help on fixing this? Below is the freeradius -X output FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/krb5 including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/totp including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/eap including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/rfc7542 including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/policy.d/eap including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { nonblock = no ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } recv_coa { } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client private-network-1 { ipaddr = 142.244.0.0/16 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = krb5 # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = Kerberos # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/freeradius/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_krb5 # Loading module "krb5" from file /etc/freeradius/mods-enabled/krb5 krb5 { keytab = "/etc/freeradius/keytab" service_principal = "radius/sema" } # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_totp # Loading module "totp" from file /etc/freeradius/mods-enabled/totp # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } instantiate { } # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/coa # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "krb5" from file /etc/freeradius/mods-enabled/krb5 Using MIT Kerberos library rlm_krb5 (krb5): Using service principal "radius/ sema.srv.ualberta.ca(a)UALBERTA.CA" rlm_krb5 (krb5): Using keytab "FILE:/etc/freeradius/keytab" rlm_krb5 (krb5): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 1 max_retries = 5 spread = no } rlm_krb5 (krb5): Opening additional connection (0), 1 of 32 pending slots used rlm_krb5 (krb5): Opening additional connection (1), 1 of 31 pending slots used rlm_krb5 (krb5): Opening additional connection (2), 1 of 30 pending slots used rlm_krb5 (krb5): Opening additional connection (3), 1 of 29 pending slots used rlm_krb5 (krb5): Opening additional connection (4), 1 of 28 pending slots used # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no reject_unknown_intermediate_ca = no ecdh_curve = "" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type Compiling Auth-Type Kerberos for attr Auth-Type # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) Compiling Autz-Type New-TLS-Connection for attr Autz-Type # Loading preacct {...} # Loading accounting {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Compiling Post-Auth-Type Challenge for attr Post-Auth-Type Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type } # server default server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type CHAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:366 Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "control" listen { socket = "/var/run/freeradius/freeradius.sock" peercred = yes } Failed creating control socket "/var/run/freeradius/freeradius.sock": Control socket '/var/run/freeradius/freeradius.sock' is already in use

3 5

Compilation error on alma8
by Chinnapaiyan, Nagamani 12 Dec '23

12 Dec '23

Hi, I am trying to build freeradius for almalinux8. I see rlm_perl skipped in "make rpm" output so build failed. It said EXTERN.h is not found in /usr/local/include, so I copied that file as a step in dockerfile. But it still throws not found error. #35 51.14 checking for EXTERN.h in /usr/local/include/... no I also see /usr/lib64/perl5/CORE/ is in include path(-isystem /usr/lib64/perl5/CORE), but not sure why it is not searching EXTERN.h in that path. #35 51.10 checking for EXTERN.h... no #35 51.14 checking for EXTERN.h in /usr/local/include/... no #35 51.18 checking for EXTERN.h in /opt/include/... no #35 51.23 checking for EXTERN.h in /usr/local/EXTERN/include/... no #35 51.27 checking for EXTERN.h in /opt/homebrew/include/... no #35 51.31 checking for EXTERN.h in /opt/homebrew/opt/EXTERN/include/... no Below is the extracted output of the docker build. #12 [build-stage 9/32] RUN cp /usr/lib64/perl5/CORE/*.h /usr/local/include/ #12 DONE 0.5s #13 [build-stage 10/32] RUN cp /usr/lib64/perl5/CORE/*.so /usr/local/lib/ #13 DONE 0.5s #14 [build-stage 11/32] RUN ls /usr/local/include/ #14 0.385 EXTERN.h #14 0.385 INTERN.h #14 0.385 XSUB.h #14 0.385 av.h ... ... #34 [build-stage 31/32] RUN ls /usr/local/include/ #34 0.558 EXTERN.h #34 0.558 INTERN.h #34 0.558 XSUB.h ... ... #35 [build-stage 32/32] RUN --mount=type=ssh scl enable devtoolset-8 "CFLAGS=-g make rpm" #35 1.067 rm -rf /usr/local/src/repositories/freeradius-server/build/freeradius-server-4.0 #35 1.071 mkdir -p /usr/local/src/repositories/freeradius-server/build ... ... #35 50.11 Running tests for rlm_perl #35 50.11 #35 50.21 checking for x86_64-redhat-linux-gnu-gcc... /opt/rh/devtoolset-8/root/usr/bin/gcc #35 50.29 checking whether the C compiler works... yes #35 50.37 checking for C compiler default output file name... a.out #35 50.37 checking for suffix of executables... #35 50.45 checking whether we are cross compiling... no #35 50.53 checking for suffix of object files... o #35 50.58 checking whether the compiler supports GNU C... yes #35 50.63 checking whether /opt/rh/devtoolset-8/root/usr/bin/gcc accepts -g... yes #35 50.67 checking for /opt/rh/devtoolset-8/root/usr/bin/gcc option to enable C11 features... none needed #35 50.74 checking how to run the C preprocessor... /opt/rh/devtoolset-8/root/usr/bin/gcc -E #35 50.86 checking whether perl executable path has been provided... no #35 50.86 checking for perl... /usr/bin/perl #35 50.86 configure: Calling ExtUtils::Embed to get 'ccopts' #35 50.89 configure: ExtUtil's ccopts were " -D_REENTRANT -D_GNU_SOURCE -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -fwrapv -fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -I/usr/lib64/perl5/CORE " #35 50.89 configure: Sanitized ccopts are "-D_REENTRANT -D_GNU_SOURCE -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fcf-protection -fwrapv -fno-strict-aliasing -isystem /usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -isystem /usr/lib64/perl5/CORE" #35 50.89 configure: Calling ExtUtils::Embed to get 'ldflags' #35 51.08 configure: ExtUtil's ldopts were "-Wl,--enable-new-dtags -Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -fstack-protector-strong -L/usr/local/lib -L/usr/lib64/perl5/CORE -lperl -lpthread -lresolv -ldl -lm -lcrypt -lutil -lc" #35 51.09 configure: Sanitized ldopts are "-Wl,--enable-new-dtags -Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -Wl,-z,relro -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -fstack-protector-strong -L/usr/local/lib -L/usr/lib64/perl5/CORE -lperl -lpthread -lresolv -ldl -lm -lcrypt -lutil -lc" #35 51.10 checking for EXTERN.h... no #35 51.14 checking for EXTERN.h in /usr/local/include/... no #35 51.18 checking for EXTERN.h in /opt/include/... no #35 51.23 checking for EXTERN.h in /usr/local/EXTERN/include/... no #35 51.27 checking for EXTERN.h in /opt/homebrew/include/... no #35 51.31 checking for EXTERN.h in /opt/homebrew/opt/EXTERN/include/... no #35 51.36 checking for perl.h... no #35 51.40 checking for perl.h in /usr/local/include/... no #35 51.44 checking for perl.h in /opt/include/... no #35 51.48 checking for perl.h in /usr/local/perl/include/... no #35 51.52 checking for perl.h in /opt/homebrew/include/... no #35 51.55 checking for perl.h in /opt/homebrew/opt/perl/include/... no #35 51.59 checking we can link to boot_DynaLoader... no #35 51.64 checking we can link to Perl_hv_store()... no #35 51.68 configure: WARNING: silently not building rlm_perl. #35 51.68 configure: WARNING: FAILURE: rlm_perl requires: EXTERN.h EXTERN.h libperl.so libperl.so. #35 51.73 configure: creating ./config.status #35 52.01 config.status: creating all.mk #35 52.04 config.status: creating config.h ... ... #35 87.95 rlm_pap ................. OK #35 87.96 rlm_passwd .............. OK #35 87.98 rlm_perl ................ skipping (requires EXTERN.h EXTERN.h libperl.so libperl.so) #35 87.99 rlm_python .............. OK #35 88.00 rlm_radius .............. OK ... ... #35 211.1 RPM build errors: #35 211.1 error: File not found: /usr/local/src/repositories/freeradius-server/rpmbuild/BUILDROOT/freeradius-4.0-1.el8.x86_64/usr/lib64/freeradius/rlm_perl.so #35 211.1 File listed twice: /etc/raddb/certs/bootstrap #35 211.1 File listed twice: /etc/raddb/sites-enabled #35 211.1 File not found: /usr/local/src/repositories/freeradius-server/rpmbuild/BUILDROOT/freeradius-4.0-1.el8.x86_64/usr/bin/*_tests #35 211.1 File not found: /usr/local/src/repositories/freeradius-server/rpmbuild/BUILDROOT/freeradius-4.0-1.el8.x86_64/usr/lib64/freeradius/rlm_perl.so #35 211.1 make: *** [Makefile:530: rpm] Error 1 #35 ERROR: process "/bin/sh -c scl enable devtoolset-8 \"CFLAGS=-g make rpm\"" did not complete successfully: exit code: 2 Regards, Nagamani Chinnapaiyan

2 1

LDAP authentication
by Deepansha Gaur 11 Dec '23

11 Dec '23

Hi everyone, I am trying to authenticate using ldap on freeradius. But it keeps giving me "could not start TLS" error. Below are the freeradius debugs: FreeRADIUS Version 3.0.26 Copyright (C) 1999-2021 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/ldap including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/sql including configuration file /etc/freeradius/3.0/mods-config/sql/main/sqlite/queries.conf including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/eap including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/eap including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/tls main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 postauth_client_lost = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_accept = no auth_reject = no auth_badpass = yes auth_goodpass = yes colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server tls { ipaddr = 127.0.0.1 port = 2083 type = "auth" proto = "tcp" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } tls { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key" certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem" ca_file = "/etc/ssl/certs/ca-certificates.crt" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" random_file = "/dev/urandom" fragment_size = 8192 include_length = yes check_crl = no cipher_list = "DEFAULT" ca_path_reload_interval = 0 ecdh_curve = "prime256v1" tls_min_version = "1.2" } tls: Setting DH parameters from /etc/freeradius/3.0/certs/dh - this is no longer necessary. tls: You should comment out the 'dh_file' configuration item. home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server_pool tls { type = fail-over home_server = tls } realm tls { auth_pool = tls } radiusd: #### Loading Clients #### client wireless { ipaddr = 172.20.252.242 require_message_authenticator = no secret = <<< secret >>> proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client ldap { ipaddr = 129.128.221.161 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = LDAP # Creating Autz-Type = New-TLS-Connection radiusd: #### Instantiating modules #### modules { # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/etc/freeradius/3.0/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap ldap { server = "directory.srv.ualberta.ca" identity = "cn=wireless,ou=ldapaccess,dc=ualberta,dc=ca" password = <<< secret >>> sasl { mech = "EXTERNAL" } user_dn = "LDAP-UserDn" user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no allow_dangling_group_ref = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "ou=people,dc=ualberta,dc=ca" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { certificate_file = "/etc/ssl/certs/test-freeradius.corenet.ualberta.ca-cert.pem" private_key_file = "/etc/ssl/private/test-freeradius.corenet.ualberta.ca-key.pem" random_file = "/dev/random" start_tls = yes } } Creating attribute LDAP-Group # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/3.0/mods-enabled/sql sql { driver = "rlm_sql_null" server = "" port = 0 login = "" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-%l}, acctsessiontime = (%{%{integer:Event-Timestamp}:-%l} - acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{%{integer:Event-Timestamp}:-%l}" } accounting-off { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-%l}, acctsessiontime = (%{%{integer:Event-Timestamp}:-%l} - acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{%{integer:Event-Timestamp}:-%l}" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix ) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-%l}, %{%{integer:Event-Timestamp}:-%l}, NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}' )" } interim-update { query = "UPDATE radacct SET acctupdatetime = %{%{integer:Event-Timestamp}:-%l}, acctinterval = 0, framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-%l}, acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )" } } rlm_sql (sql): Driver rlm_sql_null (module rlm_sql_null) loaded and linked Creating attribute SQL-Group # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } instantiate { } # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/coa # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "ldap" from file /etc/freeradius/3.0/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20516 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." } rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://directory.srv.ualberta.ca:389 TLS: can't connect: (unknown error code). rlm_ldap (ldap): Could not start TLS: Connect error rlm_ldap (ldap): Opening connection failed (0) rlm_ldap (ldap): Removing connection pool /etc/freeradius/3.0/mods-enabled/ldap[8]: Instantiation failed for module "ldap" Could you please help me with this? I have a certificate installed and have pointed my config files to it. Thanks. Regards, Deepansha Gaur

2 2

Debian 12 and Azure SQL setup issues (trying unixodb/ FreeTDS / iODBC) .
by Olaf 11 Dec '23

11 Dec '23

Dear users, After 6 years running Freeradius on CentOS 7 successfully it's time to migrate to Debian12. CentOS7 setup: Freeradius 3, FreeTDS and unixodbc. No setup issues. On my new Debian 12.2 server things seem not that easy. By default, Freeradius is not compiled with unixdbc. Ok, I'm not an advanced user on compile from source but ending up with things like: configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. https://serverfault.com/questions/448365/debian-build-the-freeradius-packag… . No solution for Debian 12.unixodbc-(dev) is installed but still... ############################################################## Next try is to use iODBC. Also not working. iodbc modules on debian12 are 12+ years old. Ok compiling from source and issues again; configure.ac:320: error: possibly undefined macro: AM_PATH_GTK If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. make: *** [/usr/share/cdbs/1/class/autotools-files.mk:71: debian/stamp-autotools-files] Error 1 dpkg-buildpackage: error: debian/rules build subprocess returned exit status 2 Got stuck again. ############################################################## Next try is to use FreeTDS module with /usr/lib/x86_64-linux-gnu/odbc/libtdsodbc.so odbc.ini, odbcinst.ini and FreeTDS.conf configured as it should be. no luck still, freeradius -X always show: rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_freetds: unable to establish db to symbolic servername mydatabasedsn rlm_sql_freetds: client error: severity(0), number(34), origin(0), layer(0): Adaptive Server connection failed rlm_sql_freetds: socket destructor called, closing socket rlm_sql (sql): Opening connection failed (0) rlm_sql (sql): Removing connection pool /etc/freeradius/mods-enabled/sql[27]: Instantiation failed for module "sql" Got stuck again. With isql and tsql i can connect manually, so the server>azure sql link works. No issues with that. Summary of my request: If anyone could provide me some help how to get a working sql connection from Freeradius to azure sql on debian12 would be great, regardless of the connection method. Or it's a missing (for me unknown param in mods-enabled\sql) Thanks, Olaf

3 6

dynamic-clients with rest (v.3.2)
by Bino Oetomo 07 Dec '23

07 Dec '23

Dear All I followed the step from https://networkradius.com/packages/#fr32-debian-bullseye ``` root@freeradius32apt ~# freeradius -v radiusd: FreeRADIUS Version 3.2.3 (git #db3d1924d), for host x86_64-pc-linux-gnu FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT ``` I'm trying to do dynamic-clients with rest so I did (as root) ``` apt install freeradius-rest ``` and here is freeradius/mods-enabled/rest ``` rest { # # This subsection configures the tls related items # that control how FreeRADIUS connects to a HTTPS # server. # tls { } # rlm_rest will open a connection to the server specified in connect_uri # to populate the connection cache, ready for the first request. # The server will not start if the server specified is unreachable. # # If you wish to disable this pre-caching and reachability check, # comment out the configuration item below. # connect_uri = "http://127.0.0.1/" # # How long before new connection attempts timeout, defaults to 4.0 seconds. # connect_timeout = 10.0 # # Specify HTTP protocol version to use. one of '1.0', '1.1', '2.0', '2.0+auto', # '2.0+tls' or 'default'. (libcurl option CURLOPT_HTTP_VERSION) # # http_negotiation = 1.1 authorize { uri = "http://192.168.56.1:5000/radius/authorize" method = 'post' body = 'JSON' } authenticate { uri = "http://192.168.56.1:5000/radius/authenticate" method = 'post' body = JSON } preacct { } accounting { uri = "http://192.168.56.1:5000/radius/accounting" method = 'post' body = JSON } post-auth { } pre-proxy { } post-proxy { } # Options for calling rest xlats # uri and method will be derived from the string provided to the xlat xlat { body_uri_encode = yes } # # The connection pool is used to pool outgoing connections. # pool { # Connections to create during module instantiation. # If the server cannot create specified number of # connections during instantiation it will exit. # Set to 0 to allow the server to start without the # web service being available. start = ${thread[pool].start_servers} # Minimum number of connections to keep open min = ${thread[pool].min_spare_servers} # Maximum number of connections # # If these connections are all in use and a new one # is requested, the request will NOT get a connection. # # Setting 'max' to LESS than the number of threads means # that some threads may starve, and you will see errors # like 'No connections available and at max connection limit' # # Setting 'max' to MORE than the number of threads means # that there are more connections than necessary. max = ${thread[pool].max_servers} # Spare connections to be left idle # # NOTE: Idle connections WILL be closed if "idle_timeout" # is set. This should be less than or equal to "max" above. spare = ${thread[pool].max_spare_servers} # Number of uses before the connection is closed # # 0 means "infinite" uses = 0 # The number of seconds to wait after the server tries # to open a connection, and fails. During this time, # no new connections will be opened. retry_delay = 30 # The lifetime (in seconds) of the connection lifetime = 0 # idle timeout (in seconds). A connection which is # unused for this length of time will be closed. idle_timeout = 60 # NOTE: All configuration settings are enforced. If a # connection is closed because of "idle_timeout", # "uses", or "lifetime", then the total number of # connections MAY fall below "min". When that # happens, it will open a new connection. It will # also log a WARNING message. # # The solution is to either lower the "min" connections, # or increase lifetime/idle_timeout. } } ``` my sites-enabled/default ``` server default { listen { type = auth ipaddr = 192.168.56.110 port = 0 limit { # # Limit the number of simultaneous TCP connections to the socket # # The default is 16. # Setting this to 0 means "no limit" max_connections = 16 # The per-socket "max_requests" option does not exist. # # The lifetime, in seconds, of a TCP connection. After # this lifetime, the connection will be closed. # # Setting this to 0 means "forever". lifetime = 0 # # The idle timeout, in seconds, of a TCP connection. # If no packets have been received over the connection for # this time, the connection will be closed. # # Setting this to 0 means "no timeout". # # We STRONGLY RECOMMEND that you set an idle timeout. # idle_timeout = 30 } } # # This second "listen" section is for listening on the accounting # port, too. # listen { ipaddr = 192.168.56.110 port = 0 type = acct limit { # The number of packets received can be rate limited via the # "max_pps" configuration item. When it is set, the server # tracks the total number of packets received in the previous # second. If the count is greater than "max_pps", then the # new packet is silently discarded. This helps the server # deal with overload situations. # # The packets/s counter is tracked in a sliding window. This # means that the pps calculation is done for the second # before the current packet was received. NOT for the current # wall-clock second, and NOT for the previous wall-clock second. # # Useful values are 0 (no limit), or 100 to 10000. # Values lower than 100 will likely cause the server to ignore # normal traffic. Few systems are capable of handling more than # 10K packets/s. # # It is most useful for accounting systems. Set it to 50% # more than the normal accounting load, and you can be sure that # the server will never get overloaded # # max_pps = 0 # Only for "proto = tcp". These are ignored for "udp" sockets. # # idle_timeout = 0 # lifetime = 0 # max_connections = 0 } } # IPv6 versions of the above - read their full config to understand options authorize { filter_username preprocess rest chap mschap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique } # # Accounting. Log the accounting data. # accounting { rest } # Session database, used for checking Simultaneous-Use. Either the radutmp # or rlm_sql module can handle this. # The rlm_sql module is *much* faster session { } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { Post-Auth-Type REJECT { } # # Filter access challenges. # Post-Auth-Type Challenge { } Post-Auth-Type Client-Lost { } # # If the client sends EAP-Key-Name in the request, # then echo the real value back in the reply. # } # # When the server decides to proxy a request to a home server, # the proxied request is first passed through the pre-proxy # stage. This stage can re-write the request, or decide to # cancel the proxy. # # Only a few modules currently have this method. # pre-proxy { } # # When the server receives a reply to a request it proxied # to a home server, the request may be massaged here, in the # post-proxy stage. # post-proxy { } } ``` below is my freeradius/sites-enabled/dynamic-clients ``` # -*- text -*- # # Define a network where clients may be dynamically defined. client dynamic { # # You MUST specify a netmask! # IPv4 /32 or IPv6 /128 are NOT allowed! ipaddr = 192.168.56.0/24 dynamic_clients = dynamic_clients lifetime = 3600 } # # This is the virtual server referenced above by "dynamic_clients". server dynamic_clients { # # The only contents of the virtual server is the "authorize" section. authorize { rest # # Tell the caller that the client was defined properly. # # If the authorize section does NOT return "ok", then # the new client is ignored. ok } } ``` When I try to connect my pppoe client to my pppoe-server, freeradius said that the client (pppoe-server) is unknown some Output from --> freeradius -XXX ``` Wed Dec 6 23:08:21 2023 : Debug: (0) server dynamic_clients { Wed Dec 6 23:08:21 2023 : Debug: (0) # Executing section authorize from file /etc/freeradius/sites-enabled/dynamic-clients Wed Dec 6 23:08:21 2023 : Debug: (0) authorize { Wed Dec 6 23:08:21 2023 : Debug: (0) modsingle[authorize]: calling rest (rlm_rest) Wed Dec 6 23:08:21 2023 : Debug: rlm_rest (rest): Reserved connection (0) Wed Dec 6 23:08:21 2023 : Debug: (0) rest: Expanding URI components Wed Dec 6 23:08:21 2023 : Debug: http://192.168.56.1:5000 Wed Dec 6 23:08:21 2023 : Debug: Parsed xlat tree: Wed Dec 6 23:08:21 2023 : Debug: literal --> http://192.168.56.1:5000 Wed Dec 6 23:08:21 2023 : Debug: (0) rest: EXPAND http://192.168.56.1:5000 Wed Dec 6 23:08:21 2023 : Debug: (0) rest: --> http://192.168.56.1:5000 Wed Dec 6 23:08:21 2023 : Debug: /radius/authorize Wed Dec 6 23:08:21 2023 : Debug: Parsed xlat tree: Wed Dec 6 23:08:21 2023 : Debug: literal --> /radius/authorize Wed Dec 6 23:08:21 2023 : Debug: (0) rest: EXPAND /radius/authorize Wed Dec 6 23:08:21 2023 : Debug: (0) rest: --> /radius/authorize Wed Dec 6 23:08:21 2023 : Debug: (0) rest: Sending HTTP POST to " http://192.168.56.1:5000/radius/authorize" Wed Dec 6 23:08:21 2023 : Debug: (0) rest: Adding custom headers: Wed Dec 6 23:08:21 2023 : Debug: (0) rest: X-FreeRADIUS-Section: authorize Wed Dec 6 23:08:21 2023 : Debug: (0) rest: X-FreeRADIUS-Server: dynamic_clients Wed Dec 6 23:08:21 2023 : Debug: (0) rest: Request body content-type will be "application/json" Wed Dec 6 23:08:21 2023 : Debug: (0) rest: JSON Data: {} Wed Dec 6 23:08:21 2023 : Debug: (0) rest: Returning 2 bytes of JSON data Wed Dec 6 23:08:21 2023 : Debug: (0) rest: Processing response header Wed Dec 6 23:08:21 2023 : Debug: (0) rest: Status : 500 (INTERNAL SERVER ERROR) Wed Dec 6 23:08:21 2023 : Debug: (0) rest: Type : json (application/json) Wed Dec 6 23:08:21 2023 : Debug: (0) rest: Adding reply:REST-HTTP-Status-Code = "500" Wed Dec 6 23:08:21 2023 : ERROR: (0) rest: Server returned: Wed Dec 6 23:08:21 2023 : ERROR: (0) rest: {} Wed Dec 6 23:08:21 2023 : Debug: rlm_rest (rest): Released connection (0) ``` Kindly please look at line 22 of debug lines ``` Wed Dec 6 23:08:21 2023 : Debug: (0) rest: JSON Data: {} ``` I think freeradius did not wrap any data to json body Is that a bug? if not, kindly please tell me how to fix Sincerely -bino-

2 4

radiusd crashing on zero length option61
by Chinnapaiyan, Nagamani 07 Dec '23

07 Dec '23

We are observing radiusd crash when we receive zero length option61 in the dhcp request message.(we are using 2 months old 4.x) 3d 00 Option: (61) Client identifier Length: 0 Value: <MISSING> Thanks, Nagamani Chinnapaiyan

3 4

Re: UnicodeDecodeError in python3 module with binary input
by Aren Sandersen 06 Dec '23

06 Dec '23

We have a commit that adds a configuration flag so that anything that can't be interpreted as UTF-8 will be a binary string instead. I'll submit it as a PR. Aren > while using the python3 module with 3.2.1 I got the following errors: > > mod_populate_vptuple:402, vp->da->name: User-Password > python_error_log:209, Exception type: <class 'UnicodeDecodeError'>, > Exception value: 'utf-8' codec can't decode byte 0xb3 in position 0: > invalid start byte > do_python_single:496, authorize - mod_populate_vps failed > do_python_single:675, authorize - RLM_MODULE_FAIL > > The cause is a switch whichs software mangles the User-Password to binary > garbage. > > Is this handling of binary values in the python module favorable? To my > feeling it would be > cleaner to convert to bytes (instead of a string). Then python can handle > binary data well. > > Or make the conversion using replacement character/ignoring encoding > errors. > > The switch will be fixed, so this is only a design question. > > Thanks for all your great work, > greetings > Hermann >

1 0

issue with reject function while handling interim-update accounting
by Vinayak Makwana 06 Dec '23

06 Dec '23

Hello all, I am facing an issue in the accounting section. I do work on freeradius accounting to handle START, STOP and INTERIM-UPDATE requests. So in an interim-update request I am getting every 1 minute. In that request i am checking user balance if user balance is not sufficient then i am using reject function to send reject request to client. but when I do use the reject function then this function directly rejects the interim-update request without sending access-reject to the client. File : sites-available/default Here's my code : ######################################################### accounting { if(Acct-Status-Type == "Interim-Update"){ if ("%{user_balance}" == 0) { reject } } } ######################################################### Please suggest to me how I can send access-reject messages to client-server. Thanks & Regards Vinayak -- *Disclaimer* In addition to generic Disclaimer which you have agreed on our website, any views or opinions presented in this email are solely those of the originator and do not necessarily represent those of the Company or its sister concerns. Any liability (in negligence, contract or otherwise) arising from any third party taking any action, or refraining from taking any action on the basis of any of the information contained in this email is hereby excluded. *Confidentiality* This communication (including any attachment/s) is intended only for the use of the addressee(s) and contains information that is PRIVILEGED AND CONFIDENTIAL. Unauthorized reading, dissemination, distribution, or copying of this communication is prohibited. Please inform originator if you have received it in error. *Caution for viruses, malware etc.* This communication, including any attachments, may not be free of viruses, trojans, similar or new contaminants/malware, interceptions or interference, and may not be compatible with your systems. You shall carry out virus/malware scanning on your own before opening any attachment to this e-mail. The sender of this e-mail and Company including its sister concerns shall not be liable for any damage that may incur to you as a result of viruses, incompleteness of this message, a delay in receipt of this message or any other computer problems.

3 4

repository issue networkradius?
by Joost Ringoot 06 Dec '23

06 Dec '23

Hi, This is not an immediate problem for me, but I think this is worth to look into. I tried to install freedius with the repository as mentioned here, but it fails, the bigger packages (+ 80 kb) appear to be truncated [ https://networkradius.com/packages/#fr32-ubuntu-jammy | https://networkradius.com/packages/#fr32-ubuntu-jammy ] downloading the packages from here [ http://packages.networkradius.com/freeradius-3.2/ubuntu/jammy/pool/main/f/f… | http://packages.networkradius.com/freeradius-3.2/ubuntu/jammy/pool/main/f/f… ] with wget, the transfer appears to be interrupted by a remote connection closed, wget can resume and downloads it in chunks of 50 - 75 kb which can then be successfull installed with apt I am working from home and tried on a server, that I prepare, I first thought that our IPS or firewall is acting up, but even from home directly on my pc without vpn connection, I have the same behaviour: with wget downloads are interrupted into chunks of 50-70 kb but appear complete in the end. Best regards, Joost [ https://networkradius.com/packages/#fr32-ubuntu-jammy ]

2 1

UnicodeDecodeError in python3 module with binary input
by Hermann.Lauer＠uni-heidelberg.de 06 Dec '23

06 Dec '23

Dear All, while using the python3 module with 3.2.1 I got the following errors: mod_populate_vptuple:402, vp->da->name: User-Password python_error_log:209, Exception type: <class 'UnicodeDecodeError'>, Exception value: 'utf-8' codec can't decode byte 0xb3 in position 0: invalid start byte do_python_single:496, authorize - mod_populate_vps failed do_python_single:675, authorize - RLM_MODULE_FAIL The cause is a switch whichs software mangles the User-Password to binary garbage. Is this handling of binary values in the python module favorable? To my feeling it would be cleaner to convert to bytes (instead of a string). Then python can handle binary data well. Or make the conversion using replacement character/ignoring encoding errors. The switch will be fixed, so this is only a design question. Thanks for all your great work, greetings Hermann -- Administration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 205; 69120 Heidelberg; Tel: (06221)54-14405 Fax: -14427 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

1 0

(no subject)
by Deepansha Gaur 04 Dec '23

04 Dec '23

Hi Team, We are in the process of migrating from radiator to freeradius. I have a test freeradius server built on Ubuntu. When I am authenticating locally, radtest is successful. I added a wireless controller client and when I try to connect to the wifi using that client and freeradius authentication, it keeps failing. I see requests from the client to freeradius server but no response from freeradius. Below are the logs for reference: a2:01:00:00:01:70 > 00:50:56:a2:64:59, IPv4, length 336: WIRELESS_IP.32778 > RADIUS_IP.1812: UDP, length 294 There's no response from the radius server. Below are the firewall rules: nft add rule ip filter input udp dport 1812 counter accept nft add rule ip filter input udp dport 1813 counter accept Please let me know if you need any further information. Thanks. Regards, Deepansha Gaur

6 8