- Freeradius-Users - lists.freeradius.org

PopTop
by Jonathan Hutchins 21 Apr '10

21 Apr '10

Is it possible to set up a new account on the wiki, or does that require an administrator? I wanted to mark the page http://wiki.freeradius.org/PopTop as obsolete and applying only to the 1.x versions of freeradius. These are the instructions I was originally folowing, and they distinctly do not work with 2.1.8. If anybody has a working 2.1.8 setup for PopTop I would greatly appreciate your advice.

8 30

ntlm_auth
by Jonathan Hutchins 21 Apr '10

21 Apr '10

Ok, disabled smbpasswd, enabled the existing config for ntlm_auth, updated the /path/to/ntlm_auth to /usr/bin/ntlm_auth, added freerad to the winbind_priv group, enabled domain on client. This _looks_ like it worked, but same errror in the pptp log: Apr 20 17:31:26 firewall pppd[2831]: MPPE required, but keys are not available. Possible plugin problem? Apr 20 17:31:26 firewall pppd[2831]: CHAP peer authentication succeeded for AABENSON\\jonathan Apr 20 17:31:26 firewall pppd[2831]: Connection terminated. FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Jan 3 2010 at 15:51:52 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.10.1 { require_message_authenticator = no secret = "pearietnogide" shortname = "firewall" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Instantiating ntdomain realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.1 port 3128, id=97, length=145 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "AABENSON\\jonathan" MS-CHAP-Challenge = 0x10ae603c83702218973cf76e7616a4a9 MS-CHAP2-Response = 0x0100c61f9c7b3035a1d65ca7d8339cdb02c3000000000000000055045265592dcc4d2a20ea2f80d3d9b4bd05f3ca80ef1409 NAS-IP-Address = 24.123.100.82 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "AABENSON\jonathan", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] Looking up realm "AABENSON" for User-Name = "AABENSON\jonathan" [ntdomain] No such realm "AABENSON" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 170 [files] users: Matched entry DEFAULT at line 185 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for jonathan with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> AABENSON\jonathan [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=AABENSON\jonathan [mschap] mschap2: 10 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=d58494fb70df17f6 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=55045265592dcc4d2a20ea2f80d3d9b4bd05f3ca80ef1409 Exec-Program output: NT_KEY: 4A9465E49615D38BDC6576747C1E80E3 Exec-Program-Wait: plaintext: NT_KEY: 4A9465E49615D38BDC6576747C1E80E3 Exec-Program: returned: 0 ++[mschap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 97 to 192.168.10.1 port 3128 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP MS-CHAP2-Success = 0x01533d33384332363646304441374444324239324434454333334341304636394434433146393044443732 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 97 with timestamp +9 Ready to process requests.

3 5

SQL accounting
by Alexander 21 Apr '10

21 Apr '10

Dear all, accounting data gets sent to MySQL in my setup. Unfortunatly active sessions do not show up in radacct. Although terminated sessions show up in the table correctly. Eg. neither AcctStartTime information nor perodic accounting updates get displayed in radacct table until the session ends. How can I make sure that accounting information gets written to the db immediatly and active connections show up? BR, Alexander

3 3

Operator-Name not being logged
by Stefan Winter 21 Apr '10

21 Apr '10

Hi, I'm using the RFC5580 attribute Operator-Name (126, string). I can add it to a request in pre-proxy in another instance of FreeRADIUS just fine. When it hits my home server, it is in the packet, tcpdump below: 10:10:30.740209 IP (tos 0x0, ttl 62, id 59188, offset 0, flags [none], proto UDP (17), length 301) radius-1.restena.lu.tdp-suite > eomund.restena.lu..radius: [udp sum ok] RADIUS, length: 273 Access Request (1), id: 0x49, Authenticator: 8bd04809586e7b658c1a8d87ac2fd9a3 Username Attribute (1), length: 32, Value: availability-test(a)education.lu 0x0000: 6176 6169 6c61 6269 6c69 7479 2d74 6573 0x0010: 7440 6564 7563 6174 696f 6e2e 6c75 NAS IP Address Attribute (4), length: 6, Value: localhost 0x0000: 7f00 0001 Calling Station Attribute (31), length: 19, Value: 70-6F-6C-69-73-68 0x0000: 3730 2d36 462d 3643 2d36 392d 3733 2d36 0x0010: 38 Framed MTU Attribute (12), length: 6, Value: 1400 0x0000: 0000 0578 NAS Port Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 0x0000: 0000 0013 Connect Info Attribute (77), length: 27, Value: rad_eap_test + eapol_test 0x0000: 7261 645f 6561 705f 7465 7374 202b 2065 0x0010: 6170 6f6c 5f74 6573 74 EAP Message Attribute (79), length: 82, Value: .. 0x0000: 0209 0050 1900 1703 0100 20c9 44f9 b283 0x0010: 8415 96a8 aa08 f2ed 9842 19ae 1eb0 a3d4 0x0020: 1229 06fd fa3d c7cc 7d51 9117 0301 0020 0x0030: 42e8 5df5 0f82 6a70 dd6f 8004 00db d140 0x0040: 652c 9a27 2feb 3753 7c42 4128 01a5 e19a State Attribute (24), length: 18, Value: .zD!.s]Qx.|..6.. 0x0000: 907a 4421 9873 5d51 7813 7c13 0a36 d29b Message Authentication Attribute (80), length: 18, Value: ...nQ..V..�e..>. 0x0000: 0ebc 136e 51e4 f656 0e9d 8065 bbd7 3e02 Vendor Specific Attribute (26), length: 18, Value: Vendor: Unknown (23735) Vendor Attribute: 2, Length: 10, Value: eduroam-lu 0x0000: 0000 5cb7 020c 6564 7572 6f61 6d2d 6c75 Proxy State Attribute (33), length: 5, Value: 124 0x0000: 3132 34 Unassigned Attribute (89), length: 3, Value: 0x0000: 00 Unknown Attribute (126), length: 13, Value: 0x0000: 3172 6573 7465 6e61 2e6c 75 But my auth_log stanza logs most of the packet content, but *not* the Operator-Name attribute. Same for the -X output in rad_recv. Then again, it can be processed by the server, because I use it in a xlat later: expand: %{config:cui_hash_key}%{request:User-Name}%{outer.request:Operator-Name} -> stefan.winter(a)education.lu0x3172657374656e612e6c75 expand: %{md5:%{config:cui_hash_key}%{request:User-Name}%{outer.request:Operator-Name}} -> c1cc0e5a16f04777a9b15a85c2738f21 +++++[outer.reply] returns noop (I know, the tcpdump doesn't correspond to *this* xlat, captured at different times, but the behaviour is consistent and reproducible) As you can see, the string content which was in tcpdump is also expanded in xlat. But somewhat strangely... 126 is defined as string in dictionary.rfc5580; so xlat should decode it to "1restena.lu". Instead it displays the hexdump. I wonder if there is something "special" about 126 - maybe because it was previously assigned/hijacked by Ascend? I'm talking about FreeRADIUS 2.1.8 here Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 6

No Auth in Debian Lenny
by Jonathan Hutchins 20 Apr '10

20 Apr '10

I'm having trouble getting freeradius to auth for PPTPD and Windows clients. The Client was configured to auth to a previous Gentoo server, and was working fine. My test PPTP client is actually a linux box, but configured to connect to the PPTPD server as a windows client, other Windows clients could connect to the previous configuration. I've followed the various howtos to no avail. Currently running 2.1.8 from Debian Lenny Backports it says "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user". It is showing the username as "NTDOMAIN\\username". On 2.0.4 it was having trouble parsing the realm from the address, but I can't find where realm strings are configured in the current version, and it's not saying anything about the realm in the debug. I do get a session debug, which makes me think the problem is not with the client config but with the freeradius server. Debian has split the configuration for mppe into a file in the modules directory, and I have enabled mppe there.

3 12

freeradius-1.1.7-sol10-x86-local from sunfreeware on solaris 10 x86
by Michael Bathe 20 Apr '10

20 Apr '10

Hello freeRadius-Users, I've installed freeradius-1.1.7-sol10-x86-local and all dependencies. I don't know whats wrong! then i run /usr/loacl/sbin/radiusd -X i get the following output: root@host# /usr/local/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Segmentation Fault (core dumped) Can somebody help me, please? best regards Michael

2 1

Logs
by Jonathan Hutchins 20 Apr '10

20 Apr '10

Should I be posting my debug logs to a pastebin rather than sending them to the whole list?

3 2

Win PPP auth in Debian
by Jonathan Hutchins 20 Apr '10

20 Apr '10

I don't suppose there's a utility that will parse a freeradius 1.x configuration and spit out appropriate files for 2.x?

2 1

variable expansions in Reply-Message
by Isidor Zeuner 20 Apr '10

20 Apr '10

Hi, when using FreeRADIUS 1.1, I could store RADIUS replies like Reply-Message := "Hello, %u", and get the %u expanded to the username in the reply. After upgrading to FreeRADIUS 2.1, this doesn't seem to work anymore, the reply contains the unexpanded %u. Has this feature been removed, or do I have to configure it explicitly? Best regards, Isidor Zeuner

6 13

Freeradius and AD
by Aniss Nazerian 20 Apr '10

20 Apr '10

Hi, I have a problem with authenticating users against an AD. I'm connecting to a WPA2-Ent with PEAP and MS-CHAPv2 But it wont just work. Any ideas? freeradius is running in "SUSE enterprise 11-64bit" Here is the output from "radiusd -f -X" (the relative parts) FreeRADIUS Version 2.1.1, for host x86_64-suse-linux-gnu, built on Feb 23 2009 at 21:43:09 ... including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 2048 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = no } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "*****" nastype = "other" } client ***** { require_message_authenticator = no secret = "*****" shortname = "*****" nastype = "other" } client ***** { require_message_authenticator = no secret = "*****" shortname = "WLC-1" nastype = "cisco" } client ***** { require_message_authenticator = no secret = "*****" shortname = "WLC-2" nastype = "cisco" } client ***** { require_message_authenticator = no secret = "*****" shortname = "WLC-3" nastype = "cisco" } client ***** { require_message_authenticator = no secret = "*****" shortname = "*****" } client ***** { require_message_authenticator = no secret = "*****" shortname = "*****" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = yes dead_time = 120 wake_all_if_all_dead = no } realm LOCAL { } realm NULL { nostrip authhost = LOCAL accthost = LOCAL } realm XXX.YY { authhost = LOCAL accthost = LOCAL } realm student.XXX.YY { authhost = LOCAL accthost = LOCAL } home_server r1 { ipaddr = ***** port = 1812 type = "auth+acct" secret = "*****" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server r2 { ipaddr = ***** port = 1812 type = "auth+acct" secret = "*****" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool e { type = fail-over home_server = r1 home_server = r2 } realm DEFAULT { pool = e nostrip } radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --domain=%{%{mschap:NT-Domain}:-XXX.YY} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/XX.pem" certificate_file = "/etc/raddb/certs/XX.pem" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = yes with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_sql_log Module: Instantiating sql_log sql_log { path = "/var/log/radius/radacct/sql-relay" Post-Auth = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S');" sql_user_name = "%{%{User-Name}:-DEFAULT}" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. ... [suffix] Looking up realm "XXX.YY" for User-Name = "XXX(a)XXX.YY" [suffix] Found realm "XXX.YY" [suffix] Adding Stripped-User-Name = "XXX" [suffix] Adding Realm = "XXX.YY" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunnled request EAP-Message = 0x020700481a0207004331e30f33d1e124710448204a6e25d9755400000000000000008df3fed6694b35de41b212cb1934fa5f3424d673bf77a35e00616e6161646d406c6e752e7365 server (null) { PEAP: Setting User-Name to XXX(a)XXX.YY Sending tunneled request EAP-Message = 0x020700481a0207004331e30f33d1e124710448204a6e25d9755400000000000000008df3fed6694b35de41b212cb1934fa5f3424d673bf77a35e00616e6161646d406c6e752e7365 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "XXX(a)XXX.YY" State = 0x6d8c88d76d8b92c17ae789947f3c59f7 Calling-Station-Id = "00-21-00-d1-4b-12" Called-Station-Id = "00-27-0d-0b-73-30:e" NAS-Port = 29 NAS-IP-Address = ****** NAS-Identifier = "WLC-03" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "402" server inner-tunnel { +- entering group authorize {...} ++[mschap] returns noop [suffix] Looking up realm "XXX.YY" for User-Name = "XXX(a)XXX.YY" [suffix] Found realm "XXX.YY" [suffix] Adding Stripped-User-Name = "XXX" [suffix] Adding Realm = "XXX.YY" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 7 length 72 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for XXX(a)XXX.YY with NT-Password [mschap] expand: %{Stripped-User-Name} -> XXX [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=XXX [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] expand: --domain=%{%{mschap:NT-Domain}:-XXX.YY} -> --domain=XXX.YY [mschap] mschap2: 4f [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=dfa47fd86ca54f4c [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=8df3fed6694b35de41b212cb1934fa5f3424d673bf77a35e Exec-Program output: NT_KEY: 2EBA93A16D9710267492F18DCECF976B Exec-Program-Wait: plaintext: NT_KEY: 2EBA93A16D9710267492F18DCECF976B Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800331a0307002e533d33463938464544443536383339444238354239373630333137383231354144323643383837304239 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d8c88d76c8492c17ae789947f3c59f7 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d33463938464544443536383339444238354239373630333137383231354144323643383837304239 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d8c88d76c8492c17ae789947f3c59f7 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 146 to ****** port 32768 EAP-Message = 0x0108005b1900170301005059a0d3a675e31e8fc6d47fda4b7492977ebdc0452c0e942ba1b5551f62eacf262f6d53617f01affe37c82f4fc57a26b67e4b7a866ede35f70531f854cbb3ca25414eafac826012bf9f069e4d4304f358 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x61d6d78867dece39fc17cc5aff936f9d Finished request 6. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 140 with timestamp +281 Cleaning up request 1 ID 141 with timestamp +281 Cleaning up request 2 ID 142 with timestamp +281 Cleaning up request 3 ID 143 with timestamp +282 Cleaning up request 4 ID 144 with timestamp +282 Cleaning up request 5 ID 145 with timestamp +282 Cleaning up request 6 ID 146 with timestamp +282 Ready to process requests. -- Aniss Nazerian, IT-Department, Linnaeus University Phone: +46-470-708183, E-mail:aniss.nazerian@vxu.se O< ascii ribbon campaign - stop html mail - www.asciiribbon.org

1 0