- Freeradius-Users - lists.freeradius.org

EAP-TLS, anonymous user ids, "WARNING: Outer and inner identities are the same"
by Jason Healy 31 Jul '21

31 Jul '21

Newbie EAP-TLS question here; we've been using FreeRADIUS for a long time with PEAP-MSCHAPv2 and are trying to make the switch to pure certificate-based auth. Here's the warning I'm getting: WARNING: Outer and inner identities are the same. User privacy is compromised. I couldn't find much about this on the list archives (just one post with an unspecified EAP type and non-anonymous ids). I understand that this is a problem with tunneled EAP types (because the outer request isn't secure), but I wasn't sure about EAP-TLS; it doesn't really have an inner/outer, right? I have a test cert deployed (both real-world client and eapol_test) that is validating on FreeRADIUS. We're using "@suffieldacademy.org" as the anonymized user id, which I believe is the IETF recommendation (anonymous(a)suffieldacademy.org being the second choice). In the FreeRADIUS config we are ignoring the user id and just relying on the certificate details to authorize the user. We are updating the User-Name attribute in the "check-eap-tls" virtual server, so the cert details are used in the User-Name that is reported back to the NAS. However, the warning is still there (before the virtual "check-eap-tls"), so that doesn't seem to be the way to quiet the message. So my questions are: 1) Is this warning an issue for EAP-TLS, or is it a harmless side effect of my using an anonymous user id in the request? 2a) If I'm doing it wrong, what should I send as the user id? My MDM only lets me set one user id, so I'm not sure what I would configure differently. If I leave it blank, it sends the certificate CN which seems like a much bigger privacy issue. 2b) If I'm correct that the warning isn't an issue in my use case, is there a way for me to quiet the warning (e.g., by updating the User-Name somehow so the check doesn't trigger the warning)? Just updating the reply:User-Name doesn't stop the error, though the NAS gets the correct value in the reply. Debug output below (apologies for not having the latest version, but we're targeting Debian Bullseye and there aren't official packages yet as Bullseye doesn't officially release until next month). Many thanks! Jason # freeradius -X FreeRADIUS Version 3.0.21 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/sa-check-eap-tls main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client mgmt-wifi-1 { ipv6addr = 2607:f460:1833:15::/64 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached systemd watchdog is disabled # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 instantiate { } # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" virtual_server = "sa-check-eap-tls" } tls-config tls-common { verify_depth = 0 pem_file_type = yes private_key_file = "/etc/ssl/private/sa-radius-eduroam-2026.suffieldacademy.org-key.pem" certificate_file = "/etc/ssl/private/sa-radius-eduroam-2026.suffieldacademy.org-crt.pem" ca_file = "/etc/ssl/private/sa-radius-eduroam-2026.suffieldacademy.org-root-and-intermediate.pem" private_key_password = <<< secret >>> fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server sa-check-eap-tls { # from file /etc/freeradius/3.0/sites-enabled/sa-check-eap-tls # Loading authorize {...} } # server sa-check-eap-tls radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 55009 Listening on proxy address :: port 35913 Ready to process requests (0) Received Access-Request Id 0 from 127.0.0.1:36986 to 127.0.0.1:1812 length 154 (0) User-Name = "@suffieldacademy.org" (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = "02-00-00-00-00-01" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Connect-Info = "CONNECT 11Mbps 802.11b" (0) EAP-Message = 0x020d001901407375666669656c6461636164656d792e6f7267 (0) Message-Authenticator = 0x91cf8cf6a1df3fa822a9ef8372a84043 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "suffieldacademy.org" for User-Name = "@suffieldacademy.org" (0) suffix: No such realm "suffieldacademy.org" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 13 length 25 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_tls to process data (0) eap_tls: Initiating new TLS session (0) eap_tls: Setting verify mode to require certificate from client (0) eap_tls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 14 length 6 (0) eap: EAP session adding &reply:State = 0xed196798ed176a4f (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 0 from 127.0.0.1:1812 to 127.0.0.1:36986 length 0 (0) EAP-Message = 0x010e00060d20 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xed196798ed176a4fafc8729dfaa7718e (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 1 from 127.0.0.1:36986 to 127.0.0.1:1812 length 343 (1) User-Name = "@suffieldacademy.org" (1) NAS-IP-Address = 127.0.0.1 (1) Calling-Station-Id = "02-00-00-00-00-01" (1) Framed-MTU = 1400 (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Connect-Info = "CONNECT 11Mbps 802.11b" (1) EAP-Message = 0x020e00c40d0016030100b9010000b50303edb1c3cd3c06f2e8a6892d59e9373d14cbab4d882e70ad6d260c090ef20c2a86000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000054000b000403000102000a000c000a001d0017001e001900180016000000170000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602 (1) State = 0xed196798ed176a4fafc8729dfaa7718e (1) Message-Authenticator = 0x4b74eb6ef3118ac0cf2b501def1b43b7 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "suffieldacademy.org" for User-Name = "@suffieldacademy.org" (1) suffix: No such realm "suffieldacademy.org" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 14 length 196 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0xed196798ed176a4f (1) eap: Finished EAP session with state 0xed196798ed176a4f (1) eap: Previous EAP request found for state 0xed196798ed176a4f, released from the list (1) eap: Peer sent packet with method EAP TLS (13) (1) eap: Calling submodule eap_tls to process data (1) eap_tls: Continuing EAP-TLS (1) eap_tls: Got final TLS record fragment (190 bytes) (1) eap_tls: WARNING: Total received TLS record fragments (190 bytes), does not equal indicated TLS record length (0 bytes) (1) eap_tls: [eaptls verify] = ok (1) eap_tls: Done initial handshake (1) eap_tls: (other): before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: TLS_accept: before SSL initialization (1) eap_tls: <<< recv TLS 1.3 [length 00b9] (1) eap_tls: TLS_accept: SSLv3/TLS read client hello (1) eap_tls: >>> send TLS 1.2 [length 003d] (1) eap_tls: TLS_accept: SSLv3/TLS write server hello (1) eap_tls: >>> send TLS 1.2 [length 0cf8] (1) eap_tls: TLS_accept: SSLv3/TLS write certificate (1) eap_tls: >>> send TLS 1.2 [length 014d] (1) eap_tls: TLS_accept: SSLv3/TLS write key exchange (1) eap_tls: >>> send TLS 1.2 [length 00ce] (1) eap_tls: TLS_accept: SSLv3/TLS write certificate request (1) eap_tls: >>> send TLS 1.2 [length 0004] (1) eap_tls: TLS_accept: SSLv3/TLS write server done (1) eap_tls: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_tls: TLS - In Handshake Phase (1) eap_tls: TLS - got 3949 bytes of data (1) eap_tls: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 15 length 1024 (1) eap: EAP session adding &reply:State = 0xed196798ec166a4f (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 1 from 127.0.0.1:1812 to 127.0.0.1:36986 length 0 (1) EAP-Message = 0x010f04000dc000000f6d160303003d0200003903035f07837dc5dc6b195285a53fccda39fa9859c791ca27ee97dfc418691071a29e00c030000011ff01000100000b000403000102001700001603030cf80b000cf4000cf100052b308205273082040fa003020102021016b495b805c129f9e47203b49ebf74eb300d06092a864886f70d01010b0500304d31193017060355040a0c105375666669656c642041636164656d793130302e06035504030c275375666669656c642041636164656d792053657276657220496e7465726d656469617465204341301e170d3231303732373139343630305a170d3236303831373030303030305a305031193017060355040a0c105375666669656c642041636164656d793133303106035504030c2a73612d7261646975732d656475726f616d2d323032362e7375666669656c6461636164656d792e6f726730820122300d06092a864886f70d01010105000382010f003082010a0282010100ac792ec4a2f2b24b9a77bcee (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xed196798ec166a4fafc8729dfaa7718e (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 2 from 127.0.0.1:36986 to 127.0.0.1:1812 length 153 (2) User-Name = "@suffieldacademy.org" (2) NAS-IP-Address = 127.0.0.1 (2) Calling-Station-Id = "02-00-00-00-00-01" (2) Framed-MTU = 1400 (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) Connect-Info = "CONNECT 11Mbps 802.11b" (2) EAP-Message = 0x020f00060d00 (2) State = 0xed196798ec166a4fafc8729dfaa7718e (2) Message-Authenticator = 0xcad4e715b6f0e83413c1962adef02ebf (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: Looking up realm "suffieldacademy.org" for User-Name = "@suffieldacademy.org" (2) suffix: No such realm "suffieldacademy.org" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 15 length 6 (2) eap: No EAP Start, assuming it's an on-going EAP conversation (2) [eap] = updated (2) [files] = noop (2) [expiration] = noop (2) [logintime] = noop (2) [pap] = noop (2) } # authorize = updated (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0xed196798ec166a4f (2) eap: Finished EAP session with state 0xed196798ec166a4f (2) eap: Previous EAP request found for state 0xed196798ec166a4f, released from the list (2) eap: Peer sent packet with method EAP TLS (13) (2) eap: Calling submodule eap_tls to process data (2) eap_tls: Continuing EAP-TLS (2) eap_tls: Peer ACKed our handshake fragment (2) eap_tls: [eaptls verify] = request (2) eap_tls: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 16 length 1024 (2) eap: EAP session adding &reply:State = 0xed196798ef096a4f (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 2 from 127.0.0.1:1812 to 127.0.0.1:36986 length 0 (2) EAP-Message = 0x011004000dc000000f6d74703a2f2f63726c2e73656375726577322e636f6d2f63726c2f62383965323134382d313266352d343766332d393336322d3039323931656238343939642f5375666669656c6425323041636164656d79253230536572766572253230496e7465726d65646961746525323043412e63726c300d06092a864886f70d01010b0500038201010041a5f1312f4076cca28e69bb3998f6d742065285bd100c6a2c2a56af40c029bd309969870fd2bc513ffc898fdec94796db27118672b2e9c40a5b5221b5f85042dd3a47c091b7d26f611d01a17d450d0fa94211cc802829ce9b46f13a431c9c77ae226da3a99da6d0b2935d8573924f194e2f65f41acdd61ac7375a9a2bb0194fb3d013a6dfe818ff6b5a3ed2fee8bed9f86502dc2a1b076aafc475589c65fcb10b3b8981743dd05029c03b8e2ce6fee43c89c2a05cfc6923cae98e35f3f560283294abe0683d21076cf448e5fe0072ce47db78f3e551cc7f08d5fbb0c1126d5fcf895ee5a9e8f6 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xed196798ef096a4fafc8729dfaa7718e (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 3 from 127.0.0.1:36986 to 127.0.0.1:1812 length 153 (3) User-Name = "@suffieldacademy.org" (3) NAS-IP-Address = 127.0.0.1 (3) Calling-Station-Id = "02-00-00-00-00-01" (3) Framed-MTU = 1400 (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) Connect-Info = "CONNECT 11Mbps 802.11b" (3) EAP-Message = 0x021000060d00 (3) State = 0xed196798ef096a4fafc8729dfaa7718e (3) Message-Authenticator = 0x48a6d115a3f3d4dbf67bfbae3eae0df6 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: Looking up realm "suffieldacademy.org" for User-Name = "@suffieldacademy.org" (3) suffix: No such realm "suffieldacademy.org" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 16 length 6 (3) eap: No EAP Start, assuming it's an on-going EAP conversation (3) [eap] = updated (3) [files] = noop (3) [expiration] = noop (3) [logintime] = noop (3) [pap] = noop (3) } # authorize = updated (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0xed196798ef096a4f (3) eap: Finished EAP session with state 0xed196798ef096a4f (3) eap: Previous EAP request found for state 0xed196798ef096a4f, released from the list (3) eap: Peer sent packet with method EAP TLS (13) (3) eap: Calling submodule eap_tls to process data (3) eap_tls: Continuing EAP-TLS (3) eap_tls: Peer ACKed our handshake fragment (3) eap_tls: [eaptls verify] = request (3) eap_tls: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 17 length 1024 (3) eap: EAP session adding &reply:State = 0xed196798ee086a4f (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 3 from 127.0.0.1:1812 to 127.0.0.1:36986 length 0 (3) EAP-Message = 0x011104000dc000000f6d6d792044657669636520526f6f742043418210784dbd16c8e641e2d5d90ce07d509ff8301d0603551d0e04160414ad7acdb8eeb3b0712a102b31388e5cd7598ec1f7300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186307d0603551d1f047630743072a070a06e866c687474703a2f2f63726c2e73656375726577322e636f6d2f63726c2f31363266616663332d646662662d343438322d623563612d6531393734363938646566302f5375666669656c6425323041636164656d79253230446576696365253230526f6f7425323043412e63726c300d06092a864886f70d01010b050003820101003cf28547280ac1f9af58be2174b48a88863871b3c918bd723f82168da1720031a86c9a54f09ee962fa8f002d5a9f694a94005581e3626ac126f8d3012274854f13b4aa007b04617d7b9220c12d4fc8e4aadc2df2c2c426e8010391f0c479a3934d91d916f54e7a3c54f7bbda51e8900408f9ff4a20d0c7 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xed196798ee086a4fafc8729dfaa7718e (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 4 from 127.0.0.1:36986 to 127.0.0.1:1812 length 153 (4) User-Name = "@suffieldacademy.org" (4) NAS-IP-Address = 127.0.0.1 (4) Calling-Station-Id = "02-00-00-00-00-01" (4) Framed-MTU = 1400 (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Connect-Info = "CONNECT 11Mbps 802.11b" (4) EAP-Message = 0x021100060d00 (4) State = 0xed196798ee086a4fafc8729dfaa7718e (4) Message-Authenticator = 0x1e86802a1d3a8f909350405386788df1 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: Looking up realm "suffieldacademy.org" for User-Name = "@suffieldacademy.org" (4) suffix: No such realm "suffieldacademy.org" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 17 length 6 (4) eap: No EAP Start, assuming it's an on-going EAP conversation (4) [eap] = updated (4) [files] = noop (4) [expiration] = noop (4) [logintime] = noop (4) [pap] = noop (4) } # authorize = updated (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0xed196798ee086a4f (4) eap: Finished EAP session with state 0xed196798ee086a4f (4) eap: Previous EAP request found for state 0xed196798ee086a4f, released from the list (4) eap: Peer sent packet with method EAP TLS (13) (4) eap: Calling submodule eap_tls to process data (4) eap_tls: Continuing EAP-TLS (4) eap_tls: Peer ACKed our handshake fragment (4) eap_tls: [eaptls verify] = request (4) eap_tls: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 18 length 917 (4) eap: EAP session adding &reply:State = 0xed196798e90b6a4f (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 4 from 127.0.0.1:1812 to 127.0.0.1:36986 length 0 (4) EAP-Message = 0x011203950d8000000f6d0203010001a3423040301d0603551d0e04160414a49c98816337cb47ea13e5d716eabfa6be9e9183300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820101003b62d851368e94b4370710509f61c5aebd1c77ded2122cd1774bf87098304438b2aba99d1f6925f0297eaca819b634d4d3d31b156ded4d4fd9a340c1b89a52b309169aae6821d8a38a3eff3b73821d12a8e719bbad68ac9641d70fed9d5ff310d12a15c94789e9419d582f69a6ade11f7c9b6cb8ba1685bc60ba4c90270f65b6676ed4eb1564f20fcdeb9f8d3f5fb62285e17ae9ef21a37768069e1993ded19128c26f1ec9669a9b1f77b39d721684b434ae7476afd873e97cebcf636f7e706ea44cb8419f6be5cad3353a4f37b5caf2c71ef775eba499b0f74232f89656d856891b358257bde93dfd053005b3ad007f79baf17f1ab33edd4ced67f7d645ff20160303014d0c00014903001741041966 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xed196798e90b6a4fafc8729dfaa7718e (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 5 from 127.0.0.1:36986 to 127.0.0.1:1812 length 1565 (5) User-Name = "@suffieldacademy.org" (5) NAS-IP-Address = 127.0.0.1 (5) Calling-Station-Id = "02-00-00-00-00-01" (5) Framed-MTU = 1400 (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) Connect-Info = "CONNECT 11Mbps 802.11b" (5) EAP-Message = 0x021205800dc000000e501603030cc00b000cbc000cb90004f0308204ec308203d4a00302010202103888adb8c63f74e45be610200664b4b7300d06092a864886f70d01010b0500304d31193017060355040a0c105375666669656c642041636164656d793130302e06035504030c275375666669656c642041636164656d792044657669636520496e7465726d656469617465204341301e170d3231303733303232343530305a170d3232303733303232353530375a304a31193017060355040a0c105375666669656c642041636164656d79312d302b06035504030c2454657374205573657220285465737444657669636520534552313233343536373839302930820122300d06092a864886f70d01010105000382010f003082010a0282010100910abd4f615f6b4785766b9ac52235fe3dfd969ee40f949d9ba6a217abc3abfcc8c00a3ef4825d0c32186472a77e7fce7305031f4ffa9881c115e6d2035bb09152c67d73b23d0bef9aa6c811b58a134d32adf008 (5) State = 0xed196798e90b6a4fafc8729dfaa7718e (5) Message-Authenticator = 0xa94983a613ff0986e6a71723b562c382 (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: Looking up realm "suffieldacademy.org" for User-Name = "@suffieldacademy.org" (5) suffix: No such realm "suffieldacademy.org" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 18 length 1408 (5) eap: No EAP Start, assuming it's an on-going EAP conversation (5) [eap] = updated (5) [files] = noop (5) [expiration] = noop (5) [logintime] = noop (5) [pap] = noop (5) } # authorize = updated (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0xed196798e90b6a4f (5) eap: Finished EAP session with state 0xed196798e90b6a4f (5) eap: Previous EAP request found for state 0xed196798e90b6a4f, released from the list (5) eap: Peer sent packet with method EAP TLS (13) (5) eap: Calling submodule eap_tls to process data (5) eap_tls: Continuing EAP-TLS (5) eap_tls: Peer indicated complete TLS record size will be 3664 bytes (5) eap_tls: Expecting 3 TLS record fragments (5) eap_tls: Got first TLS record fragment (1398 bytes). Peer indicated more fragments to follow (5) eap_tls: [eaptls verify] = first fragment (5) eap_tls: ACKing Peer's TLS record fragment (5) eap_tls: [eaptls process] = handled (5) eap: Sending EAP Request (code 1) ID 19 length 6 (5) eap: EAP session adding &reply:State = 0xed196798e80a6a4f (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 5 from 127.0.0.1:1812 to 127.0.0.1:36986 length 0 (5) EAP-Message = 0x011300060d00 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0xed196798e80a6a4fafc8729dfaa7718e (5) Finished request Waking up in 4.9 seconds. (6) Received Access-Request Id 6 from 127.0.0.1:36986 to 127.0.0.1:1812 length 1561 (6) User-Name = "@suffieldacademy.org" (6) NAS-IP-Address = 127.0.0.1 (6) Calling-Station-Id = "02-00-00-00-00-01" (6) Framed-MTU = 1400 (6) NAS-Port-Type = Wireless-802.11 (6) Service-Type = Framed-User (6) Connect-Info = "CONNECT 11Mbps 802.11b" (6) EAP-Message = 0x0213057c0d4041301e170d3139303730333136313930305a170d3339303730333136303030305a304d31193017060355040a0c105375666669656c642041636164656d793130302e06035504030c275375666669656c642041636164656d792044657669636520496e7465726d65646961746520434130820122300d06092a864886f70d01010105000382010f003082010a0282010100b9025c18a6eaa607aa4e41105bba6eb9c715cfcba59dc536d480a04d4b31d00e2a32138821a47aab35a8e9f889a6c527d6156477e09878326467fdbe98d853263ca81bd49fb1c5a0199a7a55ce3cfa9a6e08d2efeae464652166964536b93e75e8683a2484777109fe62f295231bae432c2fe60ff4d24b73dcb2f4628ad8b9bacb0b38b189ccbc8f0dd492083071f9454b323f028e8970fe2efd06c1c7838d20a821187852e6e76ad70989c07ada0480543114389b3ae5fde013d9f1c7f0bac7a03323f0d95f309e33ea8556477a222ff4f26a0c149a79017a385a856ef27ac7 (6) State = 0xed196798e80a6a4fafc8729dfaa7718e (6) Message-Authenticator = 0xfd86936da3d74e65255829cc51c5b39a (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: Looking up realm "suffieldacademy.org" for User-Name = "@suffieldacademy.org" (6) suffix: No such realm "suffieldacademy.org" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 19 length 1404 (6) eap: No EAP Start, assuming it's an on-going EAP conversation (6) [eap] = updated (6) [files] = noop (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = noop (6) } # authorize = updated (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0xed196798e80a6a4f (6) eap: Finished EAP session with state 0xed196798e80a6a4f (6) eap: Previous EAP request found for state 0xed196798e80a6a4f, released from the list (6) eap: Peer sent packet with method EAP TLS (13) (6) eap: Calling submodule eap_tls to process data (6) eap_tls: Continuing EAP-TLS (6) eap_tls: Got additional TLS record fragment (1398 bytes). Peer indicated more fragments to follow (6) eap_tls: [eaptls verify] = more fragments (6) eap_tls: ACKing Peer's TLS record fragment (6) eap_tls: [eaptls process] = handled (6) eap: Sending EAP Request (code 1) ID 20 length 6 (6) eap: EAP session adding &reply:State = 0xed196798eb0d6a4f (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) Sent Access-Challenge Id 6 from 127.0.0.1:1812 to 127.0.0.1:36986 length 0 (6) EAP-Message = 0x011400060d00 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0xed196798eb0d6a4fafc8729dfaa7718e (6) Finished request Waking up in 4.9 seconds. (7) Received Access-Request Id 7 from 127.0.0.1:36986 to 127.0.0.1:1812 length 1027 (7) User-Name = "@suffieldacademy.org" (7) NAS-IP-Address = 127.0.0.1 (7) Calling-Station-Id = "02-00-00-00-00-01" (7) Framed-MTU = 1400 (7) NAS-Port-Type = Wireless-802.11 (7) Service-Type = Framed-User (7) Connect-Info = "CONNECT 11Mbps 802.11b" (7) EAP-Message = 0x0214036a0d00b6f31ac23415e410a63f23f2ffecdbb5b804a40ccb008f0030e30a188ce9efe11a0b555d21c0d2fbc332c9c4e7567a3bf44202f12ca460e0d1df0f53b457525c54e8820b1eaae5caaf38078d91e0f89793b1fd1d485a10b6e0fbb1f4a62e1daa1e00b1b583fdc08dcdc0e044bc0c94e962f102940748cbba6303b7c30203010001a3423040301d0603551d0e04160414a49c98816337cb47ea13e5d716eabfa6be9e9183300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820101003b62d851368e94b4370710509f61c5aebd1c77ded2122cd1774bf87098304438b2aba99d1f6925f0297eaca819b634d4d3d31b156ded4d4fd9a340c1b89a52b309169aae6821d8a38a3eff3b73821d12a8e719bbad68ac9641d70fed9d5ff310d12a15c94789e9419d582f69a6ade11f7c9b6cb8ba1685bc60ba4c90270f65b6676ed4eb1564f20fcdeb9f8d3f5fb62285e17ae9ef21a377 (7) State = 0xed196798eb0d6a4fafc8729dfaa7718e (7) Message-Authenticator = 0x29e0289da62d9fab4a04502cc5f3f368 (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: Looking up realm "suffieldacademy.org" for User-Name = "@suffieldacademy.org" (7) suffix: No such realm "suffieldacademy.org" (7) [suffix] = noop (7) eap: Peer sent EAP Response (code 2) ID 20 length 874 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [files] = noop (7) [expiration] = noop (7) [logintime] = noop (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0xed196798eb0d6a4f (7) eap: Finished EAP session with state 0xed196798eb0d6a4f (7) eap: Previous EAP request found for state 0xed196798eb0d6a4f, released from the list (7) eap: Peer sent packet with method EAP TLS (13) (7) eap: Calling submodule eap_tls to process data (7) eap_tls: Continuing EAP-TLS (7) eap_tls: Got final TLS record fragment (868 bytes) (7) eap_tls: [eaptls verify] = ok (7) eap_tls: Done initial handshake (7) eap_tls: TLS_accept: SSLv3/TLS write server done (7) eap_tls: <<< recv TLS 1.2 [length 0cc0] (7) eap_tls: TLS - Creating attributes from certificate OIDs (7) eap_tls: TLS - Creating attributes from certificate OIDs (7) eap_tls: TLS-Cert-Serial := "460d875635c64859ebabee3bba64e93f" (7) eap_tls: TLS-Cert-Expiration := "390703160000Z" (7) eap_tls: TLS-Cert-Valid-Since := "190703161900Z" (7) eap_tls: TLS-Cert-Subject := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (7) eap_tls: TLS-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Root CA" (7) eap_tls: TLS-Cert-Common-Name := "Suffield Academy Device Intermediate CA" (7) eap_tls: TLS - Creating attributes from certificate OIDs (7) eap_tls: TLS-Client-Cert-Serial := "3888adb8c63f74e45be610200664b4b7" (7) eap_tls: TLS-Client-Cert-Expiration := "220730225507Z" (7) eap_tls: TLS-Client-Cert-Valid-Since := "210730224500Z" (7) eap_tls: TLS-Client-Cert-Subject := "/O=Suffield Academy/CN=Test User (TestDevice SER1234567890)" (7) eap_tls: TLS-Client-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (7) eap_tls: TLS-Client-Cert-Common-Name := "Test User (TestDevice SER1234567890)" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Email := "USERNAME(a)suffieldacademy.org" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Dns := "FILEMAKER_ID" (7) eap_tls: TLS-Client-Cert-Subject-Alt-Name-Upn := "Test User (TestDevice SER1234567890)" (7) eap_tls: TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:3E:93:53:11:87:4F:79:3B:00:46:29:37:DB:15:7D:50:48:DA:3F:B9\nDirName:/O=Suffield Academy/CN=Suffield Academy Device Root CA\nserial:46:0D:87:56:35:C6:48:59:EB:AB:EE:3B:BA:64:E9:3F\n" (7) eap_tls: TLS-Client-Cert-X509v3-Subject-Key-Identifier += "33:6E:27:C7:39:B0:26:C5:9F:35:61:E3:F1:37:A1:51:C0:AF:35:12" (7) eap_tls: TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (7) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" (7) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (7) eap_tls: TLS_accept: SSLv3/TLS read client certificate (7) eap_tls: <<< recv TLS 1.2 [length 0046] (7) eap_tls: TLS_accept: SSLv3/TLS read client key exchange (7) eap_tls: <<< recv TLS 1.2 [length 0108] (7) eap_tls: TLS_accept: SSLv3/TLS read certificate verify (7) eap_tls: TLS_accept: SSLv3/TLS read change cipher spec (7) eap_tls: <<< recv TLS 1.2 [length 0010] (7) eap_tls: TLS_accept: SSLv3/TLS read finished (7) eap_tls: >>> send TLS 1.2 [length 0001] (7) eap_tls: TLS_accept: SSLv3/TLS write change cipher spec (7) eap_tls: >>> send TLS 1.2 [length 0010] (7) eap_tls: TLS_accept: SSLv3/TLS write finished (7) eap_tls: (other): SSL negotiation finished successfully (7) eap_tls: TLS - Connection Established (7) eap_tls: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (7) eap_tls: TLS-Session-Version = "TLS 1.2" (7) eap_tls: TLS - got 51 bytes of data (7) eap_tls: [eaptls process] = handled (7) eap: Sending EAP Request (code 1) ID 21 length 61 (7) eap: EAP session adding &reply:State = 0xed196798ea0c6a4f (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) Challenge { ... } # empty sub-section is ignored (7) session-state: Saving cached attributes (7) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (7) TLS-Session-Version = "TLS 1.2" (7) Sent Access-Challenge Id 7 from 127.0.0.1:1812 to 127.0.0.1:36986 length 0 (7) EAP-Message = 0x0115003d0d8000000033140303000101160303002820c44dde9158efed9aece8c93ee8753b97e7e7cb3b5a86a995ae4745e0563177d6272983cdb2f385 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0xed196798ea0c6a4fafc8729dfaa7718e (7) Finished request Waking up in 4.9 seconds. (8) Received Access-Request Id 8 from 127.0.0.1:36986 to 127.0.0.1:1812 length 153 (8) User-Name = "@suffieldacademy.org" (8) NAS-IP-Address = 127.0.0.1 (8) Calling-Station-Id = "02-00-00-00-00-01" (8) Framed-MTU = 1400 (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) Connect-Info = "CONNECT 11Mbps 802.11b" (8) EAP-Message = 0x021500060d00 (8) State = 0xed196798ea0c6a4fafc8729dfaa7718e (8) Message-Authenticator = 0xeba025748d58c526df75cc7d256c079e (8) Restoring &session-state (8) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (8) &session-state:TLS-Session-Version = "TLS 1.2" (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "suffieldacademy.org" for User-Name = "@suffieldacademy.org" (8) suffix: No such realm "suffieldacademy.org" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 21 length 6 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0xed196798ea0c6a4f (8) eap: Finished EAP session with state 0xed196798ea0c6a4f (8) eap: Previous EAP request found for state 0xed196798ea0c6a4f, released from the list (8) eap: Peer sent packet with method EAP TLS (13) (8) eap: Calling submodule eap_tls to process data (8) eap_tls: Continuing EAP-TLS (8) eap_tls: Peer ACKed our handshake fragment. handshake is finished (8) eap_tls: [eaptls verify] = success (8) eap_tls: [eaptls process] = success (8) eap_tls: Validating certificate (8) Virtual server sa-check-eap-tls received request (8) User-Name = "@suffieldacademy.org" (8) NAS-IP-Address = 127.0.0.1 (8) Calling-Station-Id = "02-00-00-00-00-01" (8) Framed-MTU = 1400 (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) Connect-Info = "CONNECT 11Mbps 802.11b" (8) EAP-Message = 0x021500060d00 (8) State = 0xed196798ea0c6a4fafc8729dfaa7718e (8) Message-Authenticator = 0xeba025748d58c526df75cc7d256c079e (8) Event-Timestamp = "Jul 30 2021 22:19:59 EDT" (8) EAP-Type = TLS (8) TLS-Cert-Serial := "460d875635c64859ebabee3bba64e93f" (8) TLS-Cert-Expiration := "390703160000Z" (8) TLS-Cert-Valid-Since := "190703161900Z" (8) TLS-Cert-Subject := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (8) TLS-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Root CA" (8) TLS-Cert-Common-Name := "Suffield Academy Device Intermediate CA" (8) TLS-Client-Cert-Serial := "3888adb8c63f74e45be610200664b4b7" (8) TLS-Client-Cert-Expiration := "220730225507Z" (8) TLS-Client-Cert-Valid-Since := "210730224500Z" (8) TLS-Client-Cert-Subject := "/O=Suffield Academy/CN=Test User (TestDevice SER1234567890)" (8) TLS-Client-Cert-Issuer := "/O=Suffield Academy/CN=Suffield Academy Device Intermediate CA" (8) TLS-Client-Cert-Common-Name := "Test User (TestDevice SER1234567890)" (8) TLS-Client-Cert-Subject-Alt-Name-Email := "USERNAME(a)suffieldacademy.org" (8) TLS-Client-Cert-Subject-Alt-Name-Dns := "FILEMAKER_ID" (8) TLS-Client-Cert-Subject-Alt-Name-Upn := "Test User (TestDevice SER1234567890)" (8) TLS-Client-Cert-X509v3-Authority-Key-Identifier += "keyid:3E:93:53:11:87:4F:79:3B:00:46:29:37:DB:15:7D:50:48:DA:3F:B9\nDirName:/O=Suffield Academy/CN=Suffield Academy Device Root CA\nserial:46:0D:87:56:35:C6:48:59:EB:AB:EE:3B:BA:64:E9:3F\n" (8) TLS-Client-Cert-X509v3-Subject-Key-Identifier += "33:6E:27:C7:39:B0:26:C5:9F:35:61:E3:F1:37:A1:51:C0:AF:35:12" (8) TLS-Client-Cert-X509v3-Basic-Constraints += "CA:FALSE" (8) TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" (8) TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (8) WARNING: Outer and inner identities are the same. User privacy is compromised. (8) server sa-check-eap-tls { (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/sa-check-eap-tls (8) authorize { (8) update reply { (8) User-Name := "EAP-TLS Updated" (8) } # update reply = noop (8) update config { (8) &Auth-Type := Accept (8) } # update config = noop (8) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (8) auth_log: --> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20210730 (8) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20210730 (8) auth_log: EXPAND %t (8) auth_log: --> Fri Jul 30 22:19:59 2021 (8) [auth_log] = ok (8) } # authorize = ok (8) Found Auth-Type = Accept (8) Auth-Type = Accept, accepting the user (8) } # server sa-check-eap-tls (8) Virtual server sending reply (8) User-Name := "EAP-TLS Updated" (8) eap: Sending EAP Success (code 3) ID 21 length 4 (8) eap: Freeing handler (8) [eap] = ok (8) } # authenticate = ok (8) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (8) post-auth { (8) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (8) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (8) update { (8) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-RSA-AES256-GCM-SHA384' (8) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2' (8) } # update = noop (8) [exec] = noop (8) policy remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) { (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else { (8) [noop] = noop (8) } # else = noop (8) } # policy remove_reply_message_if_eap = noop (8) } # post-auth = noop (8) Sent Access-Accept Id 8 from 127.0.0.1:1812 to 127.0.0.1:36986 length 0 (8) User-Name := "EAP-TLS Updated" (8) MS-MPPE-Recv-Key = 0x384da21259dec571f742f183335e2019e995dc038196eae046b4e091c76d1075 (8) MS-MPPE-Send-Key = 0xa0a6bc57390ba56b1b538bc0e377231d6379de8e7265ddc348ed7d684cba7762 (8) EAP-Message = 0x03150004 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) Finished request

2 2

Reload Freeradius server without Restart
by Bassem Mettichi 30 Jul '21

30 Jul '21

Hello, is there any method to reload freeradius after update configuration files ( clients.conf, radiusd.conf, defaults, ...) without restarting server i have tested this after adding new client on clients.conf but it doesn't work for me: kill -HUP $(cat var/run/radiusd.pid) Thanks Bassem

3 3

Can I delete "stopped" records from the FreeRadius table radacct directly with SQL?
by Roland.Baldin＠telekom.de 30 Jul '21

30 Jul '21

Hi, I am new to this mailing list and I am very existing about to get in touch with you. We are using in one of our IoT services the FreeRadius server and we are happy with it. During the last year the tables radacct and radpostauth got really big. Unfortunately I cannot stop the radius server and do some cleanup. I have to do it during operation. My question is: Can I delete the records for which acctstoptime IS NOT NULL form the radacct table and can I delete records from radpostauth table without any problems to the current productive system? I scanned the network about it very much but unfortunately and I couldn’t find some hint about it ☹ Maybe you can help. Regards, Roland ____________________________________________________ DEUTSCHE TELEKOM IOT GMBH Squad IoT Creators Roland Baldin IoT Engineer Pascalstr. 11, 10587 Berlin, Germany +49 (160)70 33 606 roland.baldin(a)telekom.de<mailto:roland.baldin@telekom.de> https://iot.telekom.com/en https://iotcreators.com/en/ LIFE IS FOR SHARING. The compulsory statement can be found here: https://iot.telekom.com/en/compulsory-statement We care – Enabling more sustainability and participation. Further information on the Telekom Sustainability Initiative: https://wecare.telekom.com/en/label/

2 2

FreeRADIUS 3 Mac-Auth Issue
by Taylor Hawkins 28 Jul '21

28 Jul '21

Greetings, Running FreeRADIUS Version 3.0.13 on CentOS7. Referencing official Mac-Auth wiki page: https://wiki.freeradius.org/guide/mac-auth Per wiki, created/modified the below files: - raddb/mods-available/files (replaced existing file per wiki instructions with provided content) - raddb/authorized_macs (created new file with my list of MAC addresses with provided syntax) - raddb/sites-available/default (added the canonicalisation policy and new files call per wiki) Running radius -X resulted in a deprecation warning of the compat line, and an invalid syntax error for the files module. Removing the compat line results in the debug output provided below, where it states it was unable to find "files" as a module or policy as called in the preacct section of the sites-enabled/default file. This is the files module as it appears in mods-available and mods-enabled: files authorized_macs { # The default key attribute to use for matches. The content # of this attribute is used to match the "name" of the # entry. key = %{Calling-Station-ID} usersfile = ${confdir}/authorized_macs } This is the authorize section of default: 273 authorize { 274 preprocess 275 276 # If cleaning up the Calling-Station-Id... 277 rewrite_calling_station_id 278 279 # Now check against the authorized_macs file 280 authorized_macs 281 282 if (!ok) { 283 # No match was found, so reject 284 reject 285 } 286 else { 287 # The MAC address was found, so update Auth-Type 288 # to accept this auth. 289 update control { 290 Auth-Type := Accept 291 } 292 } 293 } This is the preacct section of default: 400 preacct { 401 preprocess 402 403 # 404 # Merge Acct-[Input|Output]-Gigawords and Acct-[Input-Output]-Octets 405 # into a single 64bit counter Acct-[Input|Output]-Octets64. 406 # 407 # acct_counters64 408 409 # 410 # Session start times are *implied* in RADIUS. 411 # The NAS never sends a "start time". Instead, it sends 412 # a start packet, *possibly* with an Acct-Delay-Time. 413 # The server is supposed to conclude that the start time 414 # was "Acct-Delay-Time" seconds in the past. 415 # 416 # The code below creates an explicit start time, which can 417 # then be used in other modules. It will be *mostly* correct. 418 # Any errors are due to the 1-second resolution of RADIUS, 419 # and the possibility that the time on the NAS may be off. 420 # 421 # The start time is: NOW - delay - session_length 422 # 423 424 # update request { 425 # FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}" 426 # } 427 428 429 # 430 # Ensure that we have a semi-unique identifier for every 431 # request, and many NAS boxes are broken. 432 acct_unique 433 434 # 435 # Look for IPASS-style 'realm/', and if not found, look for 436 # '@realm', and decide whether or not to proxy, based on 437 # that. 438 # 439 # Accounting requests are generally proxied to the same 440 # home server as authentication requests. 441 # IPASS 442 suffix 443 # ntdomain 444 445 # 446 # Read the 'acct_users' file 447 files 448 } Here is the debug log: FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "authorized_macs" from file /etc/raddb/mods-enabled/files files authorized_macs { usersfile = "/etc/raddb/authorized_macs" key = "%{Calling-Station-ID}" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "authorized_macs" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/authorized_macs # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} /etc/raddb/sites-enabled/default[447]: Failed to find "files" as a module or policy. /etc/raddb/sites-enabled/default[447]: Please verify that the configuration exists in /etc/raddb/mods-enabled/files. /etc/raddb/sites-enabled/default[400]: Errors parsing preacct section. Any assistance is greatly appreciated. Thanks, Taylor

1 1

2FA - Active Directory ntlm_auth and yubikey
by Steven Vacaroaia 28 Jul '21

28 Jul '21

Hi, I have been scouring the Internet for a few days now looking for information about setting up 2 FA with AD (ntlm_auth) and Yubikey I found this , which was very useful but it seems to rely on adding the yubikey to the AD account . I was hoping to be able to do it without making changes to the AD accounts Is this possible ? http://lists.freeradius.org/pipermail/freeradius-users/2021-February/099521… Basically, the workflow that I am looking for is 1. configure Apache website with AddRadiusAuth pointing to radius server (DONE) 2. configure freeradius ntlm_auth ( by leveraging samba/winbind) (DONE) I was able to connect to the website using my AD credentials 3. configure self-hosted yubico server to validate yubikeys (DONE) tested 3. install and configure freeradius yubikey This I am not sure how to test 4. configure freeradius to authenticate via ntlm_auth and, if successful, via yubikey This where I am stuck Here are some details 10.10.30.111 - Yubikey validation server 10.10.30.112 - where Apache website is hosted 10.10.30.114 - FreeRADIUS Version 3.0.16 ".. ntlm_auth: Program executed successfully (0) [ntlm_auth] = ok (0) if (ok) { (0) if (ok) -> TRUE (0) if (ok) { (0) update reply { (0) EXPAND %{randstr:aaaaaaaaaaaaaaaa} (0) --> t6cJ6I2cWiGii1aG (0) State := 0x7436634a364932635769476969316147 (0) Reply-Message := "Please enter OTP" (0) } # update reply = noop (0) policy challenge { (0) update control { (0) &Response-Packet-Type = Access-Challenge (0) } # update control = noop (0) [handled] = handled (0) } # policy challenge = handled (0) } # if (ok) = handled (0) } # Auth-Type ntlm_auth = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 105 from 10.10.30.114:1812 to 10.10.30.112:1026 length 0 (0) State := 0x7436634a364932635769476969316147 (0) Reply-Message := "Please enter OTP" (0) Finished request Waking up in 4.9 seconds. .." sites-enabled excerpt if (!control:Auth-Type) { update control { Auth-Type = "ntlm_auth" } } } authenticate { Auth-Type ntlm_auth { ntlm_auth if (ok) { update reply { State := "%{randstr:aaaaaaaaaaaaaaaa}" Reply-Message := "Please enter OTP" } challenge } } Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } mschap digest ntlm_auth yubikey eap ..." /mods-enabled/yubikey "... yubikey { id_length = 12 split = yes decrypt = no validate = yes validation { servers { uri = ' http://10.10.30.111/wsapi/2.0/verify?id=%d&otp=%s' } client_id = 1 api_key = 'my_key' pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} uses = 0 retry_delay = 30 lifetime = 0 idle_timeout = 60 spread = yes } } } ..." Any guidance / help will be greatly appreciated Also, if there is a better scalable/ enterprise ready way to configure freeradius 2FA with AD and Yubikey I'll be happy to look into it Many thanks Steven

2 1

Multiple Calling of SQL Statements
by Selahattin CILEK 28 Jul '21

28 Jul '21

I want FreeRADIUS 3.0.22 (I can't update now, sorry.) to reject anonymous logins *a**nd* log every successful login to the database. To that end, I wrote three MySQL stored procedures. 1. is_login_allowed -> Checks if the user in the database and has not exceeded his quota etc. 2. log_login -> Logs a successful login to the database. 3. log_mac -> Logs the MAC address of the user's device. Of course, I thought, the most reasonable place to achieve my goal was to place my sproc calls in the inner tunnel, since we always get the real user name there, at least that is my thinking. Here is the site script for my inner tunnel: server inner-tunnel-ttls { listen { ipaddr = 127.0.0.1 port = 18127 type = auth } authorize { * # Custom Script** ** if ("%{sql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) {** ** reject** ** }** ** else {** ** "%{sql: CALL log_login('%{User-Name}', '%{Calling-Station-Id}', '%{NAS-IP-Address}')}"** ** "%{sql: CALL log_mac('%{Calling-Station-Id}', '%{User-Name}')}"** ** }* eap { ok = return } sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } session { sql } post-auth { update outer.reply { User-Name += &request:User-Name Class += &reply:Class Idle-Timeout += &reply:Idle-Timeout Acct-Interim-Interval += &reply:Acct-Interim-Interval } if (1) { update reply { User-Name !* ANY Message-Authenticator !* ANY EAP-Message !* ANY Proxy-State !* ANY MS-MPPE-Encryption-Types !* ANY MS-MPPE-Encryption-Policy !* ANY MS-MPPE-Send-Key !* ANY MS-MPPE-Recv-Key !* ANY } update { &outer.session-state: += &reply: } } Post-Auth-Type REJECT { -sql attr_filter.access_reject update outer.session-state { &Module-Failure-Message := &request:Module-Failure-Message } } } pre-proxy { } post-proxy { eap } } It is simple, isn't it? And it should work, right? It *does* work. The problem is that for each successful login, I see 4 entries in the database, which suggests that the sproc is called 4 times simultaneously or in quick succession. Can anyone explain to me why this is happening and is there a way I can fix this? Thank you in advance... SCilek -- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

2 4

Accommodating miss behaving NAS?
by David Herselman 28 Jul '21

28 Jul '21

Hi, We have a legacy ADSL system whereby the Telco handles PPPoE termination of the circuits, proxying authentication and accounting records through to us. We have several instances where the NASs appear to be miss-behaving and looking for recommendations around this. Authorization and authentication appears to be working as intended, accounting is also initially as expected in that we receive accounting start, interim updates and then an accounting stop. We however then continue to receive interim update accounting records where the utilisation is not added to the radacct table. We do have a request logged with the Telco regarding this behaviour, but our legacy FR v1 system would continue to associate accounting data and my understanding of the mods-config/sql/main/mysql/queries.conf file is that the following query should still continue to update the closed session as well (pretty sure the following is unmodified): # # Update an existing session and calculate the interval # between the last data we received for the session and this # update. This can be used to find stale sessions. # query = "\ UPDATE ${....acct_table1} \ SET \ acctupdatetime = (@acctupdatetime_old:=acctupdatetime), \ acctupdatetime = FROM_UNIXTIME(\ %{integer:Event-Timestamp}), \ acctinterval = %{integer:Event-Timestamp} - \ UNIX_TIMESTAMP(@acctupdatetime_old), \ framedipaddress = '%{Framed-IP-Address}', \ acctsessiontime = %{%{Acct-Session-Time}:-NULL}, \ acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' \ << 32 | '%{%{Acct-Input-Octets}:-0}', \ acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' \ << 32 | '%{%{Acct-Output-Octets}:-0}' \ WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" FR 3.0.17+dfsg-1.1 appears to only update accounting up until the stop being received, ignoring subsequent updates: [admin@unix-01 ~]# mysql -u root -p**************** radius -e 'SELECT username,acctstarttime,acctstoptime,framedipaddress,callingstationid,acctinputoctets,acctoutputoctets FROM radacct WHERE acctuniqueid="50decbeb537ebe5860a8fdf11221017f"'; +------------------------------+---------------------+---------------------+-----------------+------------------+-----------------+------------------+ | username | acctstarttime | acctstoptime | framedipaddress | callingstationid | acctinputoctets | acctoutputoctets | +------------------------------+---------------------+---------------------+-----------------+------------------+-----------------+------------------+ | user60d1(a)realm.company.co.za<mailto:user60d1@realm.company.co.za> | 2021-07-24 11:11:08 | 2021-07-25 18:50:23 | 41.247.86.6 | 0112223333 | 199564666 | 321290299 | +------------------------------+---------------------+---------------------+-----------------+------------------+-----------------+------------------+ [admin@unix-01 ~]# grep '50decbeb537ebe5860a8fdf11221017f' /var/log/freeradius/radacct/*/*; /var/log/freeradius/radacct/196.43.3.76/detail-20210724: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # start /var/log/freeradius/radacct/196.43.3.76/detail-20210724: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update /var/log/freeradius/radacct/196.43.3.76/detail-20210724: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update /var/log/freeradius/radacct/196.43.3.76/detail-20210725: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update /var/log/freeradius/radacct/196.43.3.76/detail-20210725: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # stop /var/log/freeradius/radacct/196.43.3.77/detail-20210725: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update /var/log/freeradius/radacct/196.43.3.77/detail-20210725: Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" # interim-update Herewith the relevant accounting packets for Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f". Green entries above are the 'start', 'interim-updates' and then a 'stop'. The red entries above are interim-updates we receive after the stop and the purple is the in/out counters as per the stop packet having been received: Sat Jul 24 11:11:13 2021 X-Ascend-Xmit-Rate = 20480000 Acct-Authentic = RADIUS NAS-IP-Address = 196.43.47.51 Attr-26.1431.7 = 0x4144534c Framed-Protocol = PPP Attr-26.1431.3 = 0x494e5445524e4554 NAS-Port-Type = PPPoEoQinQ Acct-Status-Type = Start Calling-Station-Id = "0112223333" NAS-Port = 2686963842 User-Name = "user60d1(a)realm.company.co.za" Class = 0x4e31 X-Ascend-Data-Rate = 20480000 Acct-Delay-Time = 0 Framed-IP-Address = 41.247.86.6 NAS-Port-Id = "10/2/1:125.130" Acct-Session-Time = 5 Attr-26.1431.4 = 0x00005000 Acct-Session-Id = "B74D8B03E91BB460FBD922" Service-Type = Framed-User Telkom-Access-Type = "DSL" Proxy-State = 0x3739 Event-Timestamp = "Jul 24 2021 11:11:13 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627117873 Sat Jul 24 17:10:26 2021 NAS-Port = 2686963842 Attr-26.1431.7 = 0x4144534c X-Ascend-Xmit-Rate = 20480000 Calling-Station-Id = "0112223333" Class = 0x4e31 NAS-Port-Type = PPPoEoQinQ Framed-IP-Address = 41.247.86.6 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port-Id = "10/2/1:125.130" Acct-Input-Gigawords = 0 NAS-IP-Address = 196.43.47.51 Acct-Output-Octets = 65339784 Acct-Output-Packets = 138132 Acct-Input-Packets = 145488 User-Name = "user60d1(a)realm.company.co.za" Acct-Authentic = RADIUS Acct-Session-Time = 21558 Attr-26.1431.3 = 0x494e5445524e4554 Acct-Status-Type = Interim-Update Acct-Input-Octets = 33612675 Acct-Session-Id = "B74D8B03E91BB460FBD922" Acct-Delay-Time = 0 Acct-Output-Gigawords = 0 Attr-26.1431.4 = 0x00005000 X-Ascend-Data-Rate = 20480000 Telkom-Access-Type = "DSL" Proxy-State = 0x313936 Event-Timestamp = "Jul 24 2021 17:10:26 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627139426 Sat Jul 24 23:13:24 2021 Acct-Input-Gigawords = 0 NAS-Port-Id = "10/2/1:125.130" Acct-Output-Octets = 124192829 Attr-26.1431.7 = 0x4144534c Acct-Delay-Time = 0 X-Ascend-Xmit-Rate = 20480000 X-Ascend-Data-Rate = 20480000 Attr-26.1431.4 = 0x00005000 Acct-Input-Packets = 295296 NAS-Port = 2686963842 Acct-Input-Octets = 86715171 User-Name = "user60d1(a)realm.company.co.za" Acct-Status-Type = Interim-Update NAS-IP-Address = 196.43.47.51 Acct-Output-Packets = 271352 Attr-26.1431.3 = 0x494e5445524e4554 Framed-Protocol = PPP Class = 0x4e31 Framed-IP-Address = 41.247.86.6 Service-Type = Framed-User Acct-Output-Gigawords = 0 Calling-Station-Id = "0112223333" Acct-Authentic = RADIUS NAS-Port-Type = PPPoEoQinQ Acct-Session-Time = 43336 Acct-Session-Id = "B74D8B03E91BB460FBD922" Telkom-Access-Type = "DSL" Proxy-State = 0x3634 Event-Timestamp = "Jul 24 2021 23:13:24 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627161204 Sun Jul 25 05:15:19 2021 Acct-Input-Octets = 118004756 Attr-26.1431.4 = 0x00005000 Acct-Status-Type = Interim-Update Acct-Input-Packets = 425898 X-Ascend-Xmit-Rate = 20480000 User-Name = "user60d1(a)realm.company.co.za" Framed-Protocol = PPP NAS-Port = 2686963842 Attr-26.1431.7 = 0x4144534c Class = 0x4e31 NAS-Port-Type = PPPoEoQinQ Acct-Output-Octets = 179007110 Framed-IP-Address = 41.247.86.6 Acct-Output-Packets = 390444 Service-Type = Framed-User X-Ascend-Data-Rate = 20480000 Acct-Session-Id = "B74D8B03E91BB460FBD922" Acct-Session-Time = 65052 Acct-Output-Gigawords = 0 NAS-IP-Address = 196.43.47.51 Calling-Station-Id = "0112223333" Acct-Delay-Time = 0 Attr-26.1431.3 = 0x494e5445524e4554 Acct-Input-Gigawords = 0 Acct-Authentic = RADIUS NAS-Port-Id = "10/2/1:125.130" Telkom-Access-Type = "DSL" Proxy-State = 0x323432 Event-Timestamp = "Jul 25 2021 05:15:19 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627182919 Sun Jul 25 18:50:23 2021 Calling-Station-Id = "0112223333" Acct-Terminate-Cause = Lost-Carrier Acct-Output-Octets = 321290299 NAS-Port-Type = PPPoEoQinQ Acct-Authentic = RADIUS Acct-Input-Packets = 798410 Attr-26.1431.3 = 0x494e5445524e4554 Acct-Status-Type = Stop Acct-Input-Gigawords = 0 Framed-Protocol = PPP NAS-Port = 2686963842 X-Ascend-Data-Rate = 20480000 Attr-26.1431.7 = 0x4144534c Acct-Delay-Time = 0 User-Name = "user60d1(a)realm.company.co.za" Attr-26.1431.4 = 0x00005000 Class = 0x4e31 NAS-Port-Id = "10/2/1:125.130" Service-Type = Framed-User Acct-Session-Id = "B74D8B03E91BB460FBD922" NAS-IP-Address = 196.43.47.51 Acct-Input-Octets = 199564666 Acct-Session-Time = 113955 Acct-Output-Gigawords = 0 Framed-IP-Address = 41.247.86.6 X-Ascend-Xmit-Rate = 20480000 Acct-Output-Packets = 742386 Telkom-Access-Type = "DSL" Proxy-State = 0x323235 Event-Timestamp = "Jul 25 2021 18:50:23 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627231823 Sun Jul 25 11:16:58 2021 NAS-Port-Id = "10/2/1:125.130" Acct-Status-Type = Interim-Update NAS-IP-Address = 196.43.47.51 Class = 0x4e31 X-Ascend-Data-Rate = 20480000 Acct-Input-Packets = 600825 Attr-26.1431.4 = 0x00005000 X-Ascend-Xmit-Rate = 20480000 Framed-IP-Address = 41.247.86.6 Acct-Session-Id = "B74D8B03E91BB460FBD922" Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Acct-Delay-Time = 0 User-Name = "user60d1(a)realm.company.co.za" Framed-Protocol = PPP Acct-Session-Time = 86751 Attr-26.1431.7 = 0x4144534c Service-Type = Framed-User Calling-Station-Id = "0112223333" Attr-26.1431.3 = 0x494e5445524e4554 Acct-Input-Octets = 155655292 Acct-Output-Octets = 243066595 NAS-Port-Type = PPPoEoQinQ NAS-Port = 2686963842 Acct-Output-Packets = 557229 Acct-Authentic = RADIUS Telkom-Access-Type = "DSL" Proxy-State = 0x3439 Event-Timestamp = "Jul 25 2021 11:16:58 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627204618 Sun Jul 25 17:14:09 2021 Acct-Delay-Time = 0 NAS-Port-Id = "10/2/1:125.130" Acct-Output-Packets = 708535 Service-Type = Framed-User Calling-Station-Id = "0112223333" Acct-Session-Id = "B74D8B03E91BB460FBD922" X-Ascend-Data-Rate = 20480000 Class = 0x4e31 Acct-Authentic = RADIUS Framed-IP-Address = 41.247.86.6 NAS-Port = 2686963842 User-Name = "user60d1(a)realm.company.co.za" Acct-Output-Octets = 305092740 Acct-Session-Time = 108182 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Attr-26.1431.4 = 0x00005000 Framed-Protocol = PPP Acct-Status-Type = Interim-Update Acct-Input-Packets = 761669 Attr-26.1431.7 = 0x4144534c Attr-26.1431.3 = 0x494e5445524e4554 NAS-Port-Type = PPPoEoQinQ Acct-Input-Octets = 190814584 NAS-IP-Address = 196.43.47.51 X-Ascend-Xmit-Rate = 20480000 Telkom-Access-Type = "DSL" Proxy-State = 0x3133 Event-Timestamp = "Jul 25 2021 17:14:09 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "50decbeb537ebe5860a8fdf11221017f" Timestamp = 1627226049 Regards David Herselman

2 1

Package server updates and 3.0.23-2
by Matthew Newton 28 Jul '21

28 Jul '21

As a few people noticed, in certain circumstances there can be a segfault with version 3.0.23. We have released new packages which fix this issue. https://packages.networkradius.com/ There have also been changes to the packages server. It was not previously possible for us to host more than one version of the packages due to limitations in the repository software being used. This has now been fixed. As a consequence of this, those on Ubuntu and Debian may receive a warning about the "Suite" changing. This is harmless and will need to be accepted. The package instructions on the web site have been updated to remove usage of gnupg (thanks to those who pointed out that this method is now deprecated). Finally a note that the package URLs will be changing soon. However we will continue to keep redirects from the old location so that existing repo configurations will not need to be updated. -- Matthew

4 6

Some new features in the v3.0.x branch
by Alan DeKok 27 Jul '21

27 Jul '21

There are some interesting new features available now in the v3.0.x branch. Initial documentation is here: https://github.com/FreeRADIUS/freeradius-server/tree/v3.0.x/raddb/certs/rea… In short, it's now trivial to have one EAP module serve multiple realms, each with their own certificate chain. I've also added Server Name Indication (SNI) for RadSec. This allows for the same kind of realm selection in RadSec. SNI also allows tools like haproxy to accept many TLS connections, and then forward "realm A" to home server A (over TCP), and "realm B" to home server B. This configuration allows for increased scalability and load balancing. Any questions or comments? Alan DeKok.

2 2

RV: Freeradius does not save avpair sent by ASR1002 - Delegated-IPv6-Prefix
by Gustavo Saracho 27 Jul '21

27 Jul '21

Hi! I have the following scenario. An ASR1002 with software version 03.13.10.S. The ASR has configured the IPv6 prefixes to assign to the clients, and once it assigns them it sends the avpairs to a Freeradius. The problem is that in the packet capture you can see that the ASR sends it to the avpair in the "accounting-request" packet to the freeradius, but the freeradius does not store it. What I mean by freeradius not storing, is that after a query is made from a platform to freeradius to see what ipv6 is assigned to each client and does not show it. This on another router, an ASR9000 works fine, the issue may be is in the ASR1002. this is a packet capture on freeradius. The problem is that I don't know if it is something to set in the ASR1002 to store it in freeradius or if it is freeradius itself. RADIUS Protocol Code: Accounting-Request (4) Packet identifier: 0xa7 (167) Length: 560 Authenticator: 991cd55b999e09f0aae58fadfba325e1 Attribute Value Pairs AVP: t=Acct-Session-Id(44) l=20 val=0/1/0/640_007BB7FE AVP: t=Vendor-Specific(26) l=24 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=26 vnd=ciscoSystems(9) AVP: t=Framed-Protocol(7) l=6 val=PPP(1) AVP: t=Framed-IPv6-Prefix(97) l=20 val=2001:X:X::/64 AVP: t=Framed-Interface-Id(96) l=10 val=218d36286581b516 AVP: t=Framed-IP-Address(8) l=6 val=X.X.X.153 AVP: t=Delegated-IPv6-Prefix(123) l=20 val=2001:X:X:X::/64 AVP: t=User-Name(1) l=10 val=dsl99902 AVP: t=Vendor-Specific(26) l=35 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=31 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=31 vnd=ciscoSystems(9) AVP: t=Acct-Session-Time(46) l=6 val=321 AVP: t=Acct-Input-Octets(42) l=6 val=2736962 AVP: t=Acct-Output-Octets(43) l=6 val=2746557 AVP: t=Vendor-Specific(26) l=38 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=39 vnd=ciscoSystems(9) AVP: t=Acct-Input-Packets(47) l=6 val=6797 AVP: t=Acct-Output-Packets(48) l=6 val=6902 AVP: t=Vendor-Specific(26) l=36 vnd=ciscoSystems(9) AVP: t=Vendor-Specific(26) l=37 vnd=ciscoSystems(9) AVP: t=Acct-Authentic(45) l=6 val=RADIUS(1) AVP: t=Acct-Status-Type(40) l=6 val=Interim-Update(3) AVP: t=Calling-Station-Id(31) l=14 val=c0c9e3af6747 AVP: t=NAS-Port-Type(61) l=6 val=Ethernet(15) AVP: t=NAS-Port(5) l=6 val=134218368 AVP: t=NAS-Port-Id(87) l=11 val=0/1/0/640 AVP: t=Vendor-Specific(26) l=41 vnd=ciscoSystems(9) AVP: t=Class(25) l=3 val=30 AVP: t=Service-Type(6) l=6 val=Framed(2) AVP: t=NAS-IP-Address(4) l=6 val=X.X.X.207 AVP: t=PMIP6-Home-HN-Prefix(151) l=10 val=[invalid reserved byte for IPv6 prefix] AVP: t=Acct-Delay-Time(41) l=6 val=0 **Config in ASR1002:** aaa authentication login default group tacacs+ local enable line aaa authentication ppp ADSL group radius local aaa authentication ppp viaTACACS group tacacs+ local aaa authentication ppp NINGUNO none aaa authorization console aaa authorization exec default group tacacs+ local if-authenticated aaa authorization network ADSL group radius local if-authenticated aaa authorization network viaTACACS group tacacs+ local if-authenticated aaa authorization network NINGUNO none aaa authorization configuration IA_PD group radius aaa accounting send counters ipv6 aaa accounting delay-start all aaa accounting update periodic 3 aaa accounting include auth-profile delegated-ipv6-prefix aaa accounting commands 15 default action-type start-stop group tacacs+ ! aaa accounting network ADSL action-type start-stop periodic interval 5 group radius ! ipv6 dhcp pool DHCPv6Local prefix-delegation pool ClientesDinamicos lifetime 7200 300 address prefix 2001:X:X::/64 lifetime 7200 300 dns-server 2001:X:X::65 dns-server 2001:X:X::66 sntp address 2001:X:X:X::1 accounting ADSL ! interface Virtual-Template46 description Servicio PPPoE con IPv6 ip unnumbered Loopback0 ipv6 enable no ipv6 nd prefix framed-ipv6-prefix ipv6 nd other-config-flag ipv6 nd router-preference High no ipv6 nd ra suppress ipv6 nd ra lifetime 7200 ipv6 nd ra interval 5 ipv6 dhcp server DHCPv6Local peer default ip address pool LNS1-POOL peer default ipv6 pool LinksPE-CE ppp authentication pap ADSL ppp authorization ADSL ppp accounting ADSL ppp ipcp dns X.X.X.65 X.X.X.65 ppp ipv6cp address unique ! **pool LNS1-POOL and pool LinksPE-CE are defined in the config.** **this is an example of the queries to the freeradius database, in the avpair of delegatedipv6prefix nothing is returned:** <DATA> <ROW> <radacctid>913607839</radacctid> <acctsessionid>0/1/0/640_004EB3C1</acctsessionid> <acctuniqueid>7a73d0dd85554bbb30a9ce57b3804b46</acctuniqueid> <username>dsl99902</username> <realm></realm> <nasipaddress>X.X.X.207</nasipaddress> <nasportid>0/1/0/640</nasportid> <nasporttype>Ethernet</nasporttype> <acctstarttime>2021-05-18 10:33:15</acctstarttime> <acctupdatetime>2021-05-19 13:14:56</acctupdatetime> <acctstoptime>NULL</acctstoptime> <acctinterval>62</acctinterval> <acctsessiontime>96101</acctsessiontime> <acctauthentic>RADIUS</acctauthentic> <connectinfo_start></connectinfo_start> <connectinfo_stop></connectinfo_stop> <acctinputoctets>2341181058</acctinputoctets> <acctoutputoctets>2496301024</acctoutputoctets> <calledstationid></calledstationid> <callingstationid>c47154448e08</callingstationid> <acctterminatecause></acctterminatecause> <servicetype>Framed-User</servicetype> <framedprotocol>PPP</framedprotocol> <framedipaddress>X.X.X.172</framedipaddress> <framedipv6address></framedipv6address> <framedipv6prefix>2001:X:X::/64</framedipv6prefix> <framedinterfaceid>0:3b61:0:3b58</framedinterfaceid> <delegatedipv6prefix></delegatedipv6prefix> </ROW> </DATA> if someone can give me some help or guide me where I can focus my analysis, I would appreciate it. Best Regards!

2 1