- Freeradius-Users - lists.freeradius.org

attr_nas_filter_rule for VSA Alc-Nas-Filter-Rule-Shared
by Jan 'yanek' Bortl 25 Aug '21

25 Aug '21

Hello, we just discovered that latest version of Freeradius has support [1] for RFC4849 like mangling attribute NAS-Filter-Rule. We woud like enable this mangling also for VSA attribute Alc-Nas-Filter-Rule-Shared [2]. Is that somehow possible? [1] https://github.com/FreeRADIUS/freeradius-server/commit/36d045a464090893eea5… [2] https://github.com/FreeRADIUS/freeradius-server/pull/1160 -- Jan 'yanek' Bortl <yanek [at] yanek. cz> http://yanek.cz/ ----------------------------------------------------------------- "Maybe one day you will learn that your way is not the only way." Opher [StarGate: The Nox]

2 1

802.1X - ntlm, Secure LDAP and dynamic vlan
by Ray Burquest 25 Aug '21

25 Aug '21

Hi, I am setting up a pilot for 802.1X with dynamic VLAN assignment based on the domain of the user attempting to connect to the switch. Users will be authenticated through different means depending on their domain ie user(a)domainA.com<mailto:user@domainA.com> = ntlm user(a)domainB.com<mailto:user@domainB.com> = Secure LDAP unrecognised domain = default guest VLAN I have got ntlm authentication and Secure LDAP authentication working independently but I would like some guidance as to how and where I configure the selection process and then then how to return the VLAN information Thanks Ray Burquest Consultant Respiro Pty Ltd m: +61 466 557 149 e: rburquest(a)respiro.com.au<mailto:rburquest@respiro.com.au>

2 3

Config Issue
by Adam Taylor 23 Aug '21

23 Aug '21

Hey All, I have gone around and around with our FreeRadius server and I am at a lost for what is going on. The server at some point is replacing the username(a)ulm.edu<mailto:username@ulm.edu> (or username(a)warhawks.ulm.edu<mailto:username@warhawks.ulm.edu>) with anonymous(a)ulm.edu<mailto:anonymous@ulm.edu> and saying "Login Ok" Here is the thing....it's not doing this for every account...it seems to be random. Here is the logs I see when it does it: Aug 23 16:08:11 ulm-radius1 radiusd[17337]: (8062025) Login OK: [laurencenr(a)warhawks.ulm.edu] (from client wireless port 500 cli F0-1D-BC-AB-35-67 via TLS tunnel) Aug 23 16:08:11 ulm-radius1 radiusd[17337]: (8062025) Login OK: [anonymous(a)warhawks.ulm.edu] (from client wireless port 500 cli F0-1D-BC-AB-35-67) I can't seem to find where\when it is substituting anonymous in. Here is when someone else connects to the same SSID(uses same site config on radius): Aug 23 18:46:45 ulm-radius1 radiusd[17337]: (8897019) Login OK: [vuvd(a)warhawks.ulm.edu] (from client wireless port 256 cli 30-4B-07-5C-D9-7A via TLS tunnel) Aug 23 18:46:45 ulm-radius1 radiusd[17337]: (8897020) Login OK: [vuvd(a)warhawks.ulm.edu] (from client wireless port 256 cli 30-4B-07-5C-D9-7A) So what in the world is happening and where is anonymous slipping in from? Since the last login is "Anonymous"...that's what the WiFi controller shows as a user name. I can run debug and output that to you but that file gets HUGE very quickly as the server is production and quite busy. Was hoping someone would know at least where I could look. It's something with the inner/outer tunnels I think...I'm just not sure what/where or why. Thanks, Adam Taylor

2 3

VRF config from v2 to v3
by Richard Mealing 23 Aug '21

23 Aug '21

Hi there, A long time ago someone set up a freeradius server within our company and used the following patch places in policy.txt for vrf users - http://lists.freeradius.org/pipermail/freeradius-devel/2005-November/000699… After searching around I am not sure google has any answers for me for a v3 version. I wondered if anyone has the unlang config for this? Thanks, Rich

2 3

Send CoA/DM Requests over existing TLS connection
by Ünal Kayaduman 23 Aug '21

23 Aug '21

Hello, I want to send CoA over existing TLS connection that is established with client before. But, I am getting error as below. Is there anyone who can help me ? I also added my configurations below. *clients.conf* client 10.10.10.10 { ipaddr = 10.10.10.10 proto = tcp secret = testing123 } *tls.conf* listen { ipaddr = * port = 2083 type = auth+acct proto = tcp virtual_server = default limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } tls { private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem ca_file = ${cadir}/ca.pem dh_file = ${certdir}/dh fragment_size = 8192 ca_path = ${cadir} ca_path_reload_interval = 3600 cipher_list = "DEFAULT" cipher_server_preference = no tls_min_version = "1.2" tls_max_version = "1.3" cache { enable = no lifetime = 24 # hours } require_client_cert = no verify { } } } *default.conf* server default { authorize { if (&User-Name == "bob") { update coa { &User-Name = "%{User-Name}" &Calling-Station-Id = "%{Calling-Station-Id}" &NAS-IP-Address = "10.10.10.10" } } filter_username preprocess chap mschap digest suffix eap { ok = return } files -sql -ldap expiration logintime pap Autz-Type New-TLS-Connection { ok } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap digest eap } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { update reply { &User-Name !* ANY } } update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } if (EAP-Key-Name && &reply:EAP-Session-Id) { update reply { &EAP-Key-Name := &reply:EAP-Session-Id } } } pre-proxy { } post-proxy { eap } } *ERROR* Listening on auth+acct proto tcp address * port 2083 (TLS) bound to server default Ready to process requests ... new connection request on TCP socket Listening on auth+acct from client (10.10.10.10, 42673) -> (*, 2083, virtual-server=default) Waking up in 0.3 seconds. (0) (TLS) recv TLS 1.3 Handshake, Finished (0) tls_recv: Access-Request packet from host 10.10.10.10 port 42673, id=0, length=69 Threads: total/active/spare threads = 5/0/5 Thread 5 got semaphore Thread 5 handling request 0, (1 handled so far) (0) Received Access-Request Id 0 from 10.10.10.10:42673 to 0.0.0.0:2083 length 69 (0) NAS-IP-Address = 1.1.1.1 (0) Calling-Station-Id = "00010305AABB" (0) Framed-IP-Address = 192.168.1.1 (0) User-Name = "bob" (0) User-Password = "hello" (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) if (&User-Name == "bob") { (0) if (&User-Name == "bob") -> TRUE (0) if (&User-Name == "bob") { (0) update coa { (0) EXPAND %{User-Name} (0) --> bob (0) &User-Name = bob (0) EXPAND %{Calling-Station-Id} (0) --> 00010305AABB (0) &Calling-Station-Id = 00010305AABB (0) &NAS-IP-Address = 10.10.10.10 (0) } # update coa = noop (0) } # if (&User-Name == "bob") = noop (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = noop (0) } # policy filter_username = noop (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "bob", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) files: users: Matched entry bob at line 87 (0) files: EXPAND Hello, %{User-Name} (0) files: --> Hello, bob (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = updated (0) } # authorize = updated (0) Found Auth-Type = PAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Auth-Type PAP { (0) pap: Login attempt with password (0) pap: Comparing with "known good" Cleartext-Password (0) pap: User authenticated successfully (0) [pap] = ok (0) } # Auth-Type PAP = ok (0) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (0) post-auth { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (0) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (0) update { (0) No attributes updated for RHS &session-state: (0) } # update = noop (0) [exec] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) if (EAP-Key-Name && &reply:EAP-Session-Id) { (0) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (0) } # post-auth = noop (0) WARNING: Unknown destination 10.10.10.10:3799 for CoA request. (0) Sent Access-Accept Id 0 from 0.0.0.0:2083 to 10.10.10.10:42673 length 0 (0) Reply-Message = "Hello, bob" (0) (TLS) send TLS 1.3 Handshake, Finished (0) Finished request

2 2

Proxy PAP authentication and encapsulate it as EAP-TTLS
by Idan Sheinberg 22 Aug '21

22 Aug '21

Hi We are trying to integrate with JumpCloud's RADIUS services in to order to provide MFA/2FA integration for OpenVPN services Our RADIUS client is a PfSense appliance on AWS that doesn't support EAP-TTLS. Due to the need to support OTP, we are limited to the PAP protocol What we're interested in doing is setting an intermediary FreeRadius proxy in between, that'll accept PAP authentication request from our local appliance and proxy them to the remote endpoint encapsulated in EAP-TTLS requests (we have the remote endpoint server certificate): +----------------------+ +----------------------+ +-----------------------------+ | | | | | | | PfSense VPN | PAP | FreeRADIUS | EAP-TTLS/PAP | JumpCloud RADIUS | | +----------------> +-------------------------> | | Appliance | | Proxy | | Server | | | | | | | +----------------------+ +----------------------+ +-----------------------------+ I've successfully got standard PAP proxying working, but I have no clue as to how to get EAP-TTLS encapsulation working 1) Is such proxying setup even possible? 2) If so, could anyone please provide me with some general guidelines as to how to get such setup working? 10x -- Best Regards Idan Sheinberg Professional Coder

2 1

Checking RadSec client certificate attributes with 'check_client_connections'
by Arnaud LAURIOU 20 Aug '21

20 Aug '21

Hi, While checking RadSec client certificate attributes with 'check_client_connections', the radiusd main process usage increases up to 100%. I did some tests : same behaviour with just an 'ok' or a less trivial unlang check in the 'New-TLS-Connection' subsection. In debug mode, got no relevant logs, just thousands of lines containing 'Waking up in x.y seconds.' at the same timestamp as the CPU usage get high. How to fix this issue ? Regards, Arnaud

2 6

unsubscribe
by peter 19 Aug '21

19 Aug '21

Hi all, I would like to unsubscribe because in opensuse 15.1 my wifi suddenly died. Greetings Peter

2 1

freeradius tacacs site
by Саша Щербаков 19 Aug '21

19 Aug '21

Hi people, Looks like I can't enable tacacs site with freeradius 3.0.23 I've added two files to the default docker container /etc/freeradius/sites-enabled/tacacs /etc/freeradius/policy.d/tacacs and when I'm trying to start it I'm getting the following error freeradius | /etc/freeradius/policy.d/tacacs[18]: Failed to find "subrequest" as a module or policy. freeradius | /etc/freeradius/policy.d/tacacs[18]: Please verify that the configuration exists in /etc/freeradius/mods-enabled/subrequest. freeradius | /etc/freeradius/policy.d/tacacs[18]: Failed to parse "subrequest" subsection. freeradius | /etc/freeradius/sites-enabled/tacacs[106]: Errors parsing authenticate section. Detailed docker output below Recreating freeradius ... done Attaching to freeradius freeradius | FreeRADIUS Version 3.0.23 freeradius | Copyright (C) 1999-2021 The FreeRADIUS server project and contributors freeradius | There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A freeradius | PARTICULAR PURPOSE freeradius | You may redistribute copies of FreeRADIUS under the terms of the freeradius | GNU General Public License freeradius | For more information about these matters, see the file named COPYRIGHT freeradius | Starting - reading configuration files ... freeradius | including dictionary file /usr/share/freeradius/dictionary freeradius | including dictionary file /usr/share/freeradius /dictionary.dhcp freeradius | including dictionary file /usr/share/freeradius /dictionary.vqp freeradius | including dictionary file /etc/freeradius/dictionary freeradius | including configuration file /etc/freeradius/radiusd.conf freeradius | including configuration file /etc/freeradius/proxy.conf freeradius | including configuration file /etc/freeradius/clients.conf freeradius | including files in directory /etc/freeradius/mods-enabled/ freeradius | including configuration file /etc/freeradius /mods-enabled/ntlm_auth freeradius | including configuration file /etc/freeradius /mods-enabled/chap freeradius | including configuration file /etc/freeradius /mods-enabled/detail freeradius | including configuration file /etc/freeradius /mods-enabled/digest freeradius | including configuration file /etc/freeradius /mods-enabled/echo freeradius | including configuration file /etc/freeradius /mods-enabled/exec freeradius | including configuration file /etc/freeradius /mods-enabled/unix freeradius | including configuration file /etc/freeradius /mods-enabled/radutmp freeradius | including configuration file /etc/freeradius /mods-enabled/files freeradius | including configuration file /etc/freeradius /mods-enabled/linelog freeradius | including configuration file /etc/freeradius /mods-enabled/cache_eap freeradius | including configuration file /etc/freeradius /mods-enabled/logintime freeradius | including configuration file /etc/freeradius /mods-enabled/realm freeradius | including configuration file /etc/freeradius /mods-enabled/eap freeradius | including configuration file /etc/freeradius /mods-enabled/passwd freeradius | including configuration file /etc/freeradius /mods-enabled/expr freeradius | including configuration file /etc/freeradius /mods-enabled/totp freeradius | including configuration file /etc/freeradius /mods-enabled/expiration freeradius | including configuration file /etc/freeradius /mods-enabled/always freeradius | including configuration file /etc/freeradius /mods-enabled/preprocess freeradius | including configuration file /etc/freeradius /mods-enabled/unpack freeradius | including configuration file /etc/freeradius /mods-enabled/replicate freeradius | including configuration file /etc/freeradius /mods-enabled/detail.log freeradius | including configuration file /etc/freeradius /mods-enabled/pap freeradius | including configuration file /etc/freeradius /mods-enabled/soh freeradius | including configuration file /etc/freeradius /mods-enabled/mschap freeradius | including configuration file /etc/freeradius /mods-enabled/sradutmp freeradius | including configuration file /etc/freeradius /mods-enabled/utf8 freeradius | including configuration file /etc/freeradius /mods-enabled/attr_filter freeradius | including configuration file /etc/freeradius /mods-enabled/date freeradius | including configuration file /etc/freeradius /mods-enabled/dynamic_clients freeradius | including files in directory /etc/freeradius/policy.d/ freeradius | including configuration file /etc/freeradius /policy.d/abfab-tr freeradius | including configuration file /etc/freeradius/policy.d/dhcp freeradius | including configuration file /etc/freeradius /policy.d/canonicalization freeradius | including configuration file /etc/freeradius /policy.d/rfc7542 freeradius | including configuration file /etc/freeradius/policy.d/debug freeradius | including configuration file /etc/freeradius/policy.d/eap freeradius | including configuration file /etc/freeradius /policy.d/accounting freeradius | including configuration file /etc/freeradius/policy.d/filter freeradius | including configuration file /etc/freeradius/policy.d/cui freeradius | including configuration file /etc/freeradius /policy.d/control freeradius | including configuration file /etc/freeradius /policy.d/moonshot-targeted-ids freeradius | including configuration file /etc/freeradius /policy.d/operator-name freeradius | including configuration file /etc/freeradius/policy.d/tacacs freeradius | including files in directory /etc/freeradius/sites-enabled/ freeradius | including configuration file /etc/freeradius /sites-enabled/default freeradius | including configuration file /etc/freeradius /sites-enabled/inner-tunnel freeradius | including configuration file /etc/freeradius /sites-enabled/tacacs freeradius | main { freeradius | security { freeradius | user = "freerad" freeradius | group = "freerad" freeradius | allow_core_dumps = no freeradius | } freeradius | name = "freeradius" freeradius | prefix = "/usr" freeradius | localstatedir = "/var" freeradius | logdir = "/var/log/freeradius" freeradius | run_dir = "/var/run/freeradius" freeradius | } freeradius | main { freeradius | name = "freeradius" freeradius | prefix = "/usr" freeradius | localstatedir = "/var" freeradius | sbindir = "/usr/sbin" freeradius | logdir = "/var/log/freeradius" freeradius | run_dir = "/var/run/freeradius" freeradius | libdir = "/usr/lib/freeradius" freeradius | radacctdir = "/var/log/freeradius/radacct" freeradius | hostname_lookups = no freeradius | max_request_time = 30 freeradius | cleanup_delay = 5 freeradius | max_requests = 16384 freeradius | postauth_client_lost = no freeradius | pidfile = "/var/run/freeradius/freeradius.pid" freeradius | checkrad = "/usr/sbin/checkrad" freeradius | debug_level = 0 freeradius | proxy_requests = yes freeradius | log { freeradius | stripped_names = no freeradius | auth = no freeradius | auth_badpass = no freeradius | auth_goodpass = no freeradius | colourise = yes freeradius | msg_denied = "You are already logged in - access denied" freeradius | } freeradius | resources { freeradius | } freeradius | security { freeradius | max_attributes = 200 freeradius | reject_delay = 1.000000 freeradius | status_server = yes freeradius | } freeradius | } freeradius | radiusd: #### Loading Realms and Home Servers #### freeradius | proxy server { freeradius | retry_delay = 5 freeradius | retry_count = 3 freeradius | default_fallback = no freeradius | dead_time = 120 freeradius | wake_all_if_all_dead = no freeradius | } freeradius | home_server localhost { freeradius | ipaddr = 127.0.0.1 freeradius | port = 1812 freeradius | type = "auth" freeradius | secret = <<< secret >>> freeradius | response_window = 20.000000 freeradius | response_timeouts = 1 freeradius | max_outstanding = 65536 freeradius | zombie_period = 40 freeradius | status_check = "status-server" freeradius | ping_interval = 30 freeradius | check_interval = 30 freeradius | check_timeout = 4 freeradius | num_answers_to_alive = 3 freeradius | revive_interval = 120 freeradius | limit { freeradius | max_connections = 16 freeradius | max_requests = 0 freeradius | lifetime = 0 freeradius | idle_timeout = 0 freeradius | } freeradius | coa { freeradius | irt = 2 freeradius | mrt = 16 freeradius | mrc = 5 freeradius | mrd = 30 freeradius | } freeradius | } freeradius | home_server_pool my_auth_failover { freeradius | type = fail-over freeradius | home_server = localhost freeradius | } freeradius | realm example.com { freeradius | auth_pool = my_auth_failover freeradius | } freeradius | realm LOCAL { freeradius | } freeradius | radiusd: #### Loading Clients #### freeradius | client localhost { freeradius | ipaddr = 127.0.0.1 freeradius | require_message_authenticator = no freeradius | secret = <<< secret >>> freeradius | nas_type = "other" freeradius | proto = "*" freeradius | limit { freeradius | max_connections = 16 freeradius | lifetime = 0 freeradius | idle_timeout = 30 freeradius | } freeradius | } freeradius | client localhost_ipv6 { freeradius | ipv6addr = ::1 freeradius | require_message_authenticator = no freeradius | secret = <<< secret >>> freeradius | limit { freeradius | max_connections = 16 freeradius | lifetime = 0 freeradius | idle_timeout = 30 freeradius | } freeradius | } freeradius | Debug state unknown (cap_sys_ptrace capability not set) freeradius | systemd watchdog is disabled freeradius | # Creating Auth-Type = mschap freeradius | # Creating Auth-Type = digest freeradius | # Creating Auth-Type = eap freeradius | # Creating Auth-Type = PAP freeradius | # Creating Auth-Type = CHAP freeradius | # Creating Auth-Type = MS-CHAP freeradius | # Creating Autz-Type = New-TLS-Connection freeradius | # Creating Auth-Type = tacacs_pap freeradius | radiusd: #### Instantiating modules #### freeradius | modules { freeradius | # Loaded module rlm_exec freeradius | # Loading module "ntlm_auth" from file /etc/freeradius /mods-enabled/ntlm_auth freeradius | exec ntlm_auth { freeradius | wait = yes freeradius | program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" freeradius | shell_escape = yes freeradius | } freeradius | # Loaded module rlm_chap freeradius | # Loading module "chap" from file /etc/freeradius /mods-enabled/chap freeradius | # Loaded module rlm_detail freeradius | # Loading module "detail" from file /etc/freeradius /mods-enabled/detail freeradius | detail { freeradius | filename = "/var/log/freeradius /radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" freeradius | header = "%t" freeradius | permissions = 384 freeradius | locking = no freeradius | escape_filenames = no freeradius | log_packet_header = no freeradius | } freeradius | # Loaded module rlm_digest freeradius | # Loading module "digest" from file /etc/freeradius /mods-enabled/digest freeradius | # Loading module "echo" from file /etc/freeradius /mods-enabled/echo freeradius | exec echo { freeradius | wait = yes freeradius | program = "/bin/echo %{User-Name}" freeradius | input_pairs = "request" freeradius | output_pairs = "reply" freeradius | shell_escape = yes freeradius | } freeradius | # Loading module "exec" from file /etc/freeradius /mods-enabled/exec freeradius | exec { freeradius | wait = no freeradius | input_pairs = "request" freeradius | shell_escape = yes freeradius | timeout = 10 freeradius | } freeradius | # Loaded module rlm_unix freeradius | # Loading module "unix" from file /etc/freeradius /mods-enabled/unix freeradius | unix { freeradius | radwtmp = "/var/log/freeradius/radwtmp" freeradius | } freeradius | Creating attribute Unix-Group freeradius | # Loaded module rlm_radutmp freeradius | # Loading module "radutmp" from file /etc/freeradius /mods-enabled/radutmp freeradius | radutmp { freeradius | filename = "/var/log/freeradius/radutmp" freeradius | username = "%{User-Name}" freeradius | case_sensitive = yes freeradius | check_with_nas = yes freeradius | permissions = 384 freeradius | caller_id = yes freeradius | } freeradius | # Loaded module rlm_files freeradius | # Loading module "files" from file /etc/freeradius /mods-enabled/files freeradius | files { freeradius | filename = "/etc/freeradius/mods-config/files/authorize" freeradius | acctusersfile = "/etc/freeradius /mods-config/files/accounting" freeradius | preproxy_usersfile = "/etc/freeradius /mods-config/files/pre-proxy" freeradius | } freeradius | # Loaded module rlm_linelog freeradius | # Loading module "linelog" from file /etc/freeradius /mods-enabled/linelog freeradius | linelog { freeradius | filename = "/var/log/freeradius/linelog" freeradius | escape_filenames = no freeradius | syslog_severity = "info" freeradius | permissions = 384 freeradius | format = "This is a log message for %{User-Name}" freeradius | reference = "messages.%{%{reply:Packet-Type}:-default}" freeradius | } freeradius | # Loading module "log_accounting" from file /etc/ freeradius/mods-enabled/linelog freeradius | linelog log_accounting { freeradius | filename = "/var/log/freeradius/linelog-accounting" freeradius | escape_filenames = no freeradius | syslog_severity = "info" freeradius | permissions = 384 freeradius | format = "" freeradius | reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" freeradius | } freeradius | # Loaded module rlm_cache freeradius | # Loading module "cache_eap" from file /etc/freeradius /mods-enabled/cache_eap freeradius | cache cache_eap { freeradius | driver = "rlm_cache_rbtree" freeradius | key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" freeradius | ttl = 15 freeradius | max_entries = 0 freeradius | epoch = 0 freeradius | add_stats = no freeradius | } freeradius | # Loaded module rlm_logintime freeradius | # Loading module "logintime" from file /etc/freeradius /mods-enabled/logintime freeradius | logintime { freeradius | minimum_timeout = 60 freeradius | } freeradius | # Loaded module rlm_realm freeradius | # Loading module "IPASS" from file /etc/freeradius /mods-enabled/realm freeradius | realm IPASS { freeradius | format = "prefix" freeradius | delimiter = "/" freeradius | ignore_default = no freeradius | ignore_null = no freeradius | } freeradius | # Loading module "suffix" from file /etc/freeradius /mods-enabled/realm freeradius | realm suffix { freeradius | format = "suffix" freeradius | delimiter = "@" freeradius | ignore_default = no freeradius | ignore_null = no freeradius | } freeradius | # Loading module "bangpath" from file /etc/freeradius /mods-enabled/realm freeradius | realm bangpath { freeradius | format = "prefix" freeradius | delimiter = "!" freeradius | ignore_default = no freeradius | ignore_null = no freeradius | } freeradius | # Loading module "realmpercent" from file /etc/freeradius /mods-enabled/realm freeradius | realm realmpercent { freeradius | format = "suffix" freeradius | delimiter = "%" freeradius | ignore_default = no freeradius | ignore_null = no freeradius | } freeradius | # Loading module "ntdomain" from file /etc/freeradius /mods-enabled/realm freeradius | realm ntdomain { freeradius | format = "prefix" freeradius | delimiter = "\\" freeradius | ignore_default = no freeradius | ignore_null = no freeradius | } freeradius | # Loaded module rlm_eap freeradius | # Loading module "eap" from file /etc/freeradius /mods-enabled/eap freeradius | eap { freeradius | default_eap_type = "md5" freeradius | timer_expire = 60 freeradius | ignore_unknown_eap_types = no freeradius | cisco_accounting_username_bug = no freeradius | max_sessions = 16384 freeradius | } freeradius | # Loaded module rlm_passwd freeradius | # Loading module "etc_passwd" from file /etc/freeradius /mods-enabled/passwd freeradius | passwd etc_passwd { freeradius | filename = "/etc/passwd" freeradius | format = "*User-Name:Crypt-Password:" freeradius | delimiter = ":" freeradius | ignore_nislike = no freeradius | ignore_empty = yes freeradius | allow_multiple_keys = no freeradius | hash_size = 100 freeradius | } freeradius | # Loaded module rlm_expr freeradius | # Loading module "expr" from file /etc/freeradius /mods-enabled/expr freeradius | expr { freeradius | safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" freeradius | } freeradius | # Loaded module rlm_totp freeradius | # Loading module "totp" from file /etc/freeradius /mods-enabled/totp freeradius | # Loaded module rlm_expiration freeradius | # Loading module "expiration" from file /etc/freeradius /mods-enabled/expiration freeradius | # Loaded module rlm_always freeradius | # Loading module "reject" from file /etc/freeradius /mods-enabled/always freeradius | always reject { freeradius | rcode = "reject" freeradius | simulcount = 0 freeradius | mpp = no freeradius | } freeradius | # Loading module "fail" from file /etc/freeradius /mods-enabled/always freeradius | always fail { freeradius | rcode = "fail" freeradius | simulcount = 0 freeradius | mpp = no freeradius | } freeradius | # Loading module "ok" from file /etc/freeradius /mods-enabled/always freeradius | always ok { freeradius | rcode = "ok" freeradius | simulcount = 0 freeradius | mpp = no freeradius | } freeradius | # Loading module "handled" from file /etc/freeradius /mods-enabled/always freeradius | always handled { freeradius | rcode = "handled" freeradius | simulcount = 0 freeradius | mpp = no freeradius | } freeradius | # Loading module "invalid" from file /etc/freeradius /mods-enabled/always freeradius | always invalid { freeradius | rcode = "invalid" freeradius | simulcount = 0 freeradius | mpp = no freeradius | } freeradius | # Loading module "userlock" from file /etc/freeradius /mods-enabled/always freeradius | always userlock { freeradius | rcode = "userlock" freeradius | simulcount = 0 freeradius | mpp = no freeradius | } freeradius | # Loading module "notfound" from file /etc/freeradius /mods-enabled/always freeradius | always notfound { freeradius | rcode = "notfound" freeradius | simulcount = 0 freeradius | mpp = no freeradius | } freeradius | # Loading module "noop" from file /etc/freeradius /mods-enabled/always freeradius | always noop { freeradius | rcode = "noop" freeradius | simulcount = 0 freeradius | mpp = no freeradius | } freeradius | # Loading module "updated" from file /etc/freeradius /mods-enabled/always freeradius | always updated { freeradius | rcode = "updated" freeradius | simulcount = 0 freeradius | mpp = no freeradius | } freeradius | # Loaded module rlm_preprocess freeradius | # Loading module "preprocess" from file /etc/freeradius /mods-enabled/preprocess freeradius | preprocess { freeradius | huntgroups = "/etc/freeradius /mods-config/preprocess/huntgroups" freeradius | hints = "/etc/freeradius/mods-config/preprocess/hints" freeradius | with_ascend_hack = no freeradius | ascend_channels_per_line = 23 freeradius | with_ntdomain_hack = no freeradius | with_specialix_jetstream_hack = no freeradius | with_cisco_vsa_hack = no freeradius | with_alvarion_vsa_hack = no freeradius | } freeradius | # Loaded module rlm_unpack freeradius | # Loading module "unpack" from file /etc/freeradius /mods-enabled/unpack freeradius | # Loaded module rlm_replicate freeradius | # Loading module "replicate" from file /etc/freeradius /mods-enabled/replicate freeradius | # Loading module "auth_log" from file /etc/freeradius /mods-enabled/detail.log freeradius | detail auth_log { freeradius | filename = "/var/log/freeradius /radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" freeradius | header = "%t" freeradius | permissions = 384 freeradius | locking = no freeradius | escape_filenames = no freeradius | log_packet_header = no freeradius | } freeradius | # Loading module "reply_log" from file /etc/freeradius /mods-enabled/detail.log freeradius | detail reply_log { freeradius | filename = "/var/log/freeradius /radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" freeradius | header = "%t" freeradius | permissions = 384 freeradius | locking = no freeradius | escape_filenames = no freeradius | log_packet_header = no freeradius | } freeradius | # Loading module "pre_proxy_log" from file /etc/freeradius /mods-enabled/detail.log freeradius | detail pre_proxy_log { freeradius | filename = "/var/log/freeradius /radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" freeradius | header = "%t" freeradius | permissions = 384 freeradius | locking = no freeradius | escape_filenames = no freeradius | log_packet_header = no freeradius | } freeradius | # Loading module "post_proxy_log" from file /etc/ freeradius/mods-enabled/detail.log freeradius | detail post_proxy_log { freeradius | filename = "/var/log/freeradius /radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" freeradius | header = "%t" freeradius | permissions = 384 freeradius | locking = no freeradius | escape_filenames = no freeradius | log_packet_header = no freeradius | } freeradius | # Loaded module rlm_pap freeradius | # Loading module "pap" from file /etc/freeradius /mods-enabled/pap freeradius | pap { freeradius | normalise = yes freeradius | } freeradius | # Loaded module rlm_soh freeradius | # Loading module "soh" from file /etc/freeradius /mods-enabled/soh freeradius | soh { freeradius | dhcp = yes freeradius | } freeradius | # Loaded module rlm_mschap freeradius | # Loading module "mschap" from file /etc/freeradius /mods-enabled/mschap freeradius | mschap { freeradius | use_mppe = yes freeradius | require_encryption = no freeradius | require_strong = no freeradius | with_ntdomain_hack = yes freeradius | passchange { freeradius | } freeradius | allow_retry = yes freeradius | winbind_retry_with_normalised_username = no freeradius | } freeradius | # Loading module "sradutmp" from file /etc/freeradius /mods-enabled/sradutmp freeradius | radutmp sradutmp { freeradius | filename = "/var/log/freeradius/sradutmp" freeradius | username = "%{User-Name}" freeradius | case_sensitive = yes freeradius | check_with_nas = yes freeradius | permissions = 420 freeradius | caller_id = no freeradius | } freeradius | # Loaded module rlm_utf8 freeradius | # Loading module "utf8" from file /etc/freeradius /mods-enabled/utf8 freeradius | # Loaded module rlm_attr_filter freeradius | # Loading module "attr_filter.post-proxy" from file /etc/ freeradius/mods-enabled/attr_filter freeradius | attr_filter attr_filter.post-proxy { freeradius | filename = "/etc/freeradius /mods-config/attr_filter/post-proxy" freeradius | key = "%{Realm}" freeradius | relaxed = no freeradius | } freeradius | # Loading module "attr_filter.pre-proxy" from file /etc/ freeradius/mods-enabled/attr_filter freeradius | attr_filter attr_filter.pre-proxy { freeradius | filename = "/etc/freeradius /mods-config/attr_filter/pre-proxy" freeradius | key = "%{Realm}" freeradius | relaxed = no freeradius | } freeradius | # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter freeradius | attr_filter attr_filter.access_reject { freeradius | filename = "/etc/freeradius /mods-config/attr_filter/access_reject" freeradius | key = "%{User-Name}" freeradius | relaxed = no freeradius | } freeradius | # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter freeradius | attr_filter attr_filter.access_challenge { freeradius | filename = "/etc/freeradius /mods-config/attr_filter/access_challenge" freeradius | key = "%{User-Name}" freeradius | relaxed = no freeradius | } freeradius | # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter freeradius | attr_filter attr_filter.accounting_response { freeradius | filename = "/etc/freeradius /mods-config/attr_filter/accounting_response" freeradius | key = "%{User-Name}" freeradius | relaxed = no freeradius | } freeradius | # Loading module "attr_filter.coa" from file /etc/ freeradius/mods-enabled/attr_filter freeradius | attr_filter attr_filter.coa { freeradius | filename = "/etc/freeradius/mods-config/attr_filter/coa" freeradius | key = "%{User-Name}" freeradius | relaxed = no freeradius | } freeradius | # Loaded module rlm_date freeradius | # Loading module "date" from file /etc/freeradius /mods-enabled/date freeradius | date { freeradius | format = "%b %e %Y %H:%M:%S %Z" freeradius | utc = no freeradius | } freeradius | # Loading module "wispr2date" from file /etc/freeradius /mods-enabled/date freeradius | date wispr2date { freeradius | format = "%Y-%m-%dT%H:%M:%S" freeradius | utc = no freeradius | } freeradius | # Loaded module rlm_dynamic_clients freeradius | # Loading module "dynamic_clients" from file /etc/ freeradius/mods-enabled/dynamic_clients freeradius | instantiate { freeradius | } freeradius | # Instantiating module "detail" from file /etc/freeradius /mods-enabled/detail freeradius | # Instantiating module "files" from file /etc/freeradius /mods-enabled/files freeradius | reading pairlist file /etc/freeradius /mods-config/files/authorize freeradius | reading pairlist file /etc/freeradius /mods-config/files/accounting freeradius | reading pairlist file /etc/freeradius /mods-config/files/pre-proxy freeradius | # Instantiating module "linelog" from file /etc/freeradius /mods-enabled/linelog freeradius | # Instantiating module "log_accounting" from file /etc/ freeradius/mods-enabled/linelog freeradius | # Instantiating module "cache_eap" from file /etc/ freeradius/mods-enabled/cache_eap freeradius | rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked freeradius | # Instantiating module "logintime" from file /etc/ freeradius/mods-enabled/logintime freeradius | # Instantiating module "IPASS" from file /etc/freeradius /mods-enabled/realm freeradius | # Instantiating module "suffix" from file /etc/freeradius /mods-enabled/realm freeradius | # Instantiating module "bangpath" from file /etc/ freeradius/mods-enabled/realm freeradius | # Instantiating module "realmpercent" from file /etc/ freeradius/mods-enabled/realm freeradius | # Instantiating module "ntdomain" from file /etc/ freeradius/mods-enabled/realm freeradius | # Instantiating module "eap" from file /etc/freeradius /mods-enabled/eap freeradius | # Linked to sub-module rlm_eap_md5 freeradius | # Linked to sub-module rlm_eap_gtc freeradius | gtc { freeradius | challenge = "Password: " freeradius | auth_type = "PAP" freeradius | } freeradius | # Linked to sub-module rlm_eap_tls freeradius | tls { freeradius | tls = "tls-common" freeradius | } freeradius | tls-config tls-common { freeradius | verify_depth = 0 freeradius | ca_path = "/etc/freeradius/certs" freeradius | pem_file_type = yes freeradius | private_key_file = "/etc/freeradius/certs/server.pem" freeradius | certificate_file = "/etc/freeradius/certs/server.pem" freeradius | ca_file = "/etc/freeradius/certs/ca.pem" freeradius | private_key_password = <<< secret >>> freeradius | dh_file = "/etc/freeradius/certs/dh" freeradius | fragment_size = 1024 freeradius | include_length = yes freeradius | auto_chain = yes freeradius | check_crl = no freeradius | check_all_crl = no freeradius | ca_path_reload_interval = 0 freeradius | cipher_list = "DEFAULT" freeradius | cipher_server_preference = no freeradius | ecdh_curve = "prime256v1" freeradius | tls_max_version = "1.2" freeradius | tls_min_version = "1.2" freeradius | cache { freeradius | enable = no freeradius | lifetime = 24 freeradius | max_entries = 255 freeradius | } freeradius | verify { freeradius | skip_if_ocsp_ok = no freeradius | } freeradius | ocsp { freeradius | enable = no freeradius | override_cert_url = yes freeradius | url = "http://127.0.0.1/ocsp/" freeradius | use_nonce = yes freeradius | timeout = 0 freeradius | softfail = no freeradius | } freeradius | } freeradius | # Linked to sub-module rlm_eap_ttls freeradius | ttls { freeradius | tls = "tls-common" freeradius | default_eap_type = "md5" freeradius | copy_request_to_tunnel = no freeradius | use_tunneled_reply = no freeradius | virtual_server = "inner-tunnel" freeradius | include_length = yes freeradius | require_client_cert = no freeradius | } freeradius | tls: Using cached TLS configuration from previous invocation freeradius | # Linked to sub-module rlm_eap_peap freeradius | peap { freeradius | tls = "tls-common" freeradius | default_eap_type = "mschapv2" freeradius | copy_request_to_tunnel = no freeradius | use_tunneled_reply = no freeradius | proxy_tunneled_request_as_eap = yes freeradius | virtual_server = "inner-tunnel" freeradius | soh = no freeradius | require_client_cert = no freeradius | } freeradius | tls: Using cached TLS configuration from previous invocation freeradius | # Linked to sub-module rlm_eap_mschapv2 freeradius | mschapv2 { freeradius | with_ntdomain_hack = no freeradius | send_error = no freeradius | } freeradius | # Instantiating module "etc_passwd" from file /etc/ freeradius/mods-enabled/passwd freeradius | rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no freeradius | # Instantiating module "expiration" from file /etc/ freeradius/mods-enabled/expiration freeradius | # Instantiating module "reject" from file /etc/freeradius /mods-enabled/always freeradius | # Instantiating module "fail" from file /etc/freeradius /mods-enabled/always freeradius | # Instantiating module "ok" from file /etc/freeradius /mods-enabled/always freeradius | # Instantiating module "handled" from file /etc/freeradius /mods-enabled/always freeradius | # Instantiating module "invalid" from file /etc/freeradius /mods-enabled/always freeradius | # Instantiating module "userlock" from file /etc/ freeradius/mods-enabled/always freeradius | # Instantiating module "notfound" from file /etc/ freeradius/mods-enabled/always freeradius | # Instantiating module "noop" from file /etc/freeradius /mods-enabled/always freeradius | # Instantiating module "updated" from file /etc/freeradius /mods-enabled/always freeradius | # Instantiating module "preprocess" from file /etc/ freeradius/mods-enabled/preprocess freeradius | reading pairlist file /etc/freeradius /mods-config/preprocess/huntgroups freeradius | reading pairlist file /etc/freeradius /mods-config/preprocess/hints freeradius | # Instantiating module "auth_log" from file /etc/ freeradius/mods-enabled/detail.log freeradius | rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output freeradius | # Instantiating module "reply_log" from file /etc/ freeradius/mods-enabled/detail.log freeradius | # Instantiating module "pre_proxy_log" from file /etc/ freeradius/mods-enabled/detail.log freeradius | # Instantiating module "post_proxy_log" from file /etc/ freeradius/mods-enabled/detail.log freeradius | # Instantiating module "pap" from file /etc/freeradius /mods-enabled/pap freeradius | # Instantiating module "mschap" from file /etc/freeradius /mods-enabled/mschap freeradius | rlm_mschap (mschap): using internal authentication freeradius | # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter freeradius | reading pairlist file /etc/freeradius /mods-config/attr_filter/post-proxy freeradius | # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter freeradius | reading pairlist file /etc/freeradius /mods-config/attr_filter/pre-proxy freeradius | # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter freeradius | reading pairlist file /etc/freeradius /mods-config/attr_filter/access_reject freeradius | # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter freeradius | reading pairlist file /etc/freeradius /mods-config/attr_filter/access_challenge freeradius | # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter freeradius | reading pairlist file /etc/freeradius /mods-config/attr_filter/accounting_response freeradius | # Instantiating module "attr_filter.coa" from file /etc/ freeradius/mods-enabled/attr_filter freeradius | reading pairlist file /etc/freeradius /mods-config/attr_filter/coa freeradius | } # modules freeradius | radiusd: #### Loading Virtual Servers #### freeradius | server { # from file /etc/freeradius/radiusd.conf freeradius | } # server freeradius | server default { # from file /etc/freeradius /sites-enabled/default freeradius | # Loading authenticate {...} freeradius | Compiling Auth-Type PAP for attr Auth-Type freeradius | Compiling Auth-Type CHAP for attr Auth-Type freeradius | Compiling Auth-Type MS-CHAP for attr Auth-Type freeradius | # Loading authorize {...} freeradius | Ignoring "sql" (see raddb/mods-available/README.rst) freeradius | Ignoring "ldap" (see raddb/mods-available/README.rst) freeradius | Compiling Autz-Type New-TLS-Connection for attr Autz-Type freeradius | # Loading preacct {...} freeradius | # Loading accounting {...} freeradius | # Loading post-proxy {...} freeradius | # Loading post-auth {...} freeradius | Compiling Post-Auth-Type REJECT for attr Post-Auth-Type freeradius | Compiling Post-Auth-Type Challenge for attr Post-Auth-Type freeradius | Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type freeradius | } # server default freeradius | server inner-tunnel { # from file /etc/freeradius /sites-enabled/inner-tunnel freeradius | # Loading authenticate {...} freeradius | Compiling Auth-Type PAP for attr Auth-Type freeradius | Compiling Auth-Type CHAP for attr Auth-Type freeradius | Compiling Auth-Type MS-CHAP for attr Auth-Type freeradius | # Loading authorize {...} freeradius | # Loading session {...} freeradius | # Loading post-proxy {...} freeradius | # Loading post-auth {...} freeradius | # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:336 freeradius | Compiling Post-Auth-Type REJECT for attr Post-Auth-Type freeradius | } # server inner-tunnel freeradius | server tacacs { # from file /etc/freeradius /sites-enabled/tacacs freeradius | # Loading authenticate {...} freeradius | /etc/freeradius/policy.d/tacacs[18]: Failed to find "subrequest" as a module or policy. freeradius | /etc/freeradius/policy.d/tacacs[18]: Please verify that the configuration exists in /etc/freeradius/mods-enabled/subrequest. freeradius | /etc/freeradius/policy.d/tacacs[18]: Failed to parse "subrequest" subsection. freeradius | /etc/freeradius/sites-enabled/tacacs[106]: Errors parsing authenticate section. freeradius exited with code 1 Thanks in advance, --Alex -- Thanks, Alex Shcherbakov +38(093)690-32-46

2 1

Required Integration step freeRadius with RSA SecureID 8.4
by Das, Debjit 18 Aug '21

18 Aug '21

Hello freeRadius Team, Need some help to integrate freeRadius with RSA SecureID 8.4. RSA secureID 8.4 used for dual factor authentication, we want to enable free radius capabilities like agent and proxy authentication. We are building our New Radius Server utilizing FreeRadius running on Red Hat Enterprise Linux Server release 7.9 (Maipo), thus we would kindly request you to provide us the steps to integrate RSA AM 8.4 P6 with FreeRadius running on RHEL platform. Thanks in advance for your kind help. Thanks, Debjit

2 1