- Freeradius-Users - lists.freeradius.org

Freeradius-client
by erwin＠generex.de 30 Apr '20

30 Apr '20

Hi, How can I communicate to an external server encrypted (TLS)? Thanks, Erwin

2 1

Brocade attribute with AD
by Luke Smith 29 Apr '20

29 Apr '20

I'm curious to see if anyone using freeradius with Brocade and Active Directory and how they are successfully getting logins to work. I know that I need to add the attribute brocade-admin and I've got that configured on my AD and propagated but when I go to the Brocade/Extreme device I login with the AD credentials but the attribute doesn't get passed along. If I edit my client.conf file I can make a local username work just fine, but I don't want to manage user accounts out of freeradius, I want that managed by AD. Anyone have any insight? Thanks in advance! Luke Smith Director Network/IT Colorado Valley Communications direct: 979.247.8122 | mobile: 979.249.7376 email: lukes(a)coloradovalley.com<mailto:lukes@coloradovalley.com> url: http://www.cvctx.com<http://www.cvctx.com/> Confidentiality Notice: The information herein transmitted or attached is intended only for the person or entity to which this e-mail is addressed and may contain confidential and/or legally privileged material. Any review, retransmission, dissemination, other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this in error, please contact the sender immediately and delete the material from any and all computers, servers, and e-mail programs. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

2 1

Re: The RADIUS client has mangled the State attribute
by Kyle Keilson 29 Apr '20

29 Apr '20

I've reviewed the debug output and it appears to point to the attr_filter.post_proxy filter. I should mention that the defaults for the attr_filter are in use and have not been changed. Here is the output when the server is processing packets: (0) Received Access-Request Id 150 from 192.168.1.5:61168 to 192.168.1.4:1812 length 381 (0) User-Name = "testuser(a)ringlingtest.com" (0) Service-Type = Framed-User (0) Cisco-AVPair = "service-type=Framed" (0) Framed-MTU = 1485 (0) EAP-Message = 0x02010018014b4b45494c534f4e4064657061756c2e656475 (0) Message-Authenticator = 0x168a719ee6ceaba1d478fa2f469bf647 (0) Cisco-AVPair = "audit-session-id=B5BF26D800000D54C6C4F544" (0) Cisco-AVPair = "method=dot1x" (0) Cisco-AVPair = "client-iif-id=855639101" (0) Cisco-AVPair = "vlan-id=5" (0) NAS-IP-Address = 192.168.1.5 (0) NAS-Port-Id = "capwap_9000013c" (0) NAS-Port-Type = Wireless-802.11 (0) NAS-Port = 6018 (0) Called-Station-Id = "07-4c-d9-2e-12-c0:eduroam" (0) Calling-Station-Id = "e0-32-7e-72-b4-9a" (0) Airespace-Wlan-Id = 4 (0) Cisco-AVPair = "cisco-wlan-ssid=eduroam" (0) NAS-Identifier = "test-controller" (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy split_username_nai { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) -> TRUE (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) update request { (0) EXPAND %{1} (0) --> testuser (0) &Stripped-User-Name := testuser (0) } # update request = noop (0) if ("%{3}" != '') { (0) EXPAND %{3} (0) --> ringlingtest.com (0) if ("%{3}" != '') -> TRUE (0) if ("%{3}" != '') { (0) update request { (0) EXPAND %{3} (0) --> ringlingtest.com (0) &Stripped-User-Domain = ringlingtest.com (0) } # update request = noop (0) } # if ("%{3}" != '') = noop (0) [updated] = updated (0) } # if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) = updated (0) ... skipping else: Preceding "if" was taken (0) } # policy split_username_nai = updated (0) if (noop || !&Stripped-User-Domain) { (0) if (noop || !&Stripped-User-Domain) -> FALSE (0) if (&Stripped-User-Domain != "ringling.edu") { (0) if (&Stripped-User-Domain != "ringling.edu") -> TRUE (0) if (&Stripped-User-Domain != "ringling.edu") { (0) update { (0) control:Load-Balance-Key := &Calling-Station-ID -> 'e0-32-7e-72-b4-9a' (0) control:Proxy-To-Realm := 'DEFAULT' (0) request:Operator-Name := "1ringling.edu" (0) } # update = noop (0) return (0) } # if (&Stripped-User-Domain != "ringling.edu") = noop (0) } # authorize = updated (0) Starting proxy to home server 163.253.30.2 port 1812 (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (0) pre-proxy { (0) attr_filter.pre-proxy: EXPAND %{Realm} (0) attr_filter.pre-proxy: --> DEFAULT (0) attr_filter.pre-proxy: Matched entry DEFAULT at line 50 (0) [attr_filter.pre-proxy] = updated (0) } # pre-proxy = updated (0) Proxying request to home server 163.253.30.2 port 1812 timeout 30.000000 (0) Sent Access-Request Id 59 from 0.0.0.0:42392 to 163.253.30.2:1812 length 160 (0) User-Name = "testuser" (0) EAP-Message = 0x02010018014b4b45494c534f4e4064657061756c2e656475 (0) Message-Authenticator = 0x168a719ee6ceaba1d478fa2f469bf647 (0) NAS-IP-Address = 192.168.1.4 (0) Called-Station-Id = "08-4f-f9-2e-13-c0:eduroam" (0) Calling-Station-Id = "e0-32-7e-72-b4-9a" (0) NAS-Identifier = "test-controller" (0) Operator-Name := "1ringling.edu" (0) Proxy-State = 0x313530 Waking up in 0.3 seconds. (0) Marking home server 163.253.30.2 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 59 from 163.253.30.2:1812 to 199.27.242.193:42392 length 89 (0) Message-Authenticator = 0xde3171110d3a45e469ec27c03d000dad (0) EAP-Message = 0x04010004 (0) Reply-Message = "Empty Realm Forwarded by ringling.edu." (0) Proxy-State = 0x313530 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) post-proxy { (0) attr_filter.post-proxy: EXPAND %{Realm} (0) attr_filter.post-proxy: --> DEFAULT (0) attr_filter.post-proxy: Matched entry DEFAULT at line 102 (0) [attr_filter.post-proxy] = updated (0) eap: No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = updated (0) Login incorrect (Home Server says so): [testuser(a)ringlingtest.com] (from client test-controller port 6018 cli e0-32-7e-72-b4-9a) (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> testuser(a)ringlingtest.com (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> TRUE (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) update reply { (0) &Reply-Message !* ANY (0) } # update reply = noop (0) } # if (&reply:EAP-Message && &reply:Reply-Message) = noop (0) ... skipping else: Preceding "if" was taken (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect: [testuser(a)ringlingtest.com] (from client amplify-controller port 6018 cli e0-32-7e-72-b4-9a) (0) Sent Access-Reject Id 150 from 199.27.242.193:1812 to 192.168.1.5:61168 length 0 (0) Message-Authenticator = 0xde3171110d3a45e469ec27c03d000dad (0) EAP-Message = 0x04010004 (0) Finished request Waking up in 4.9 seconds. Kyle Keilson Manager, macOS Technology and Help Desk Institutional Technology Ringling College of Art and Design 2700 N Tamiami Trail Sarasota, FL 34234 Office: 941.359.7633 Web: www.ringling.edu <http://www.ringling.edu/> On 4/29/20, 12:26 PM, "Freeradius-Users on behalf of Alan DeKok" <freeradius-users-bounces+kkeilson=ringling.edu(a)lists.freeradius.org on behalf of aland(a)deployingradius.com> wrote: On Apr 29, 2020, at 12:21 PM, Kyle Keilson <kkeilson(a)ringling.edu> wrote: > > I’ve installed CentOS 8 with FreeRadius 3.0.17 and encountering an issue with eap proxied requests. When a client is proxied to another server, the EAP response is: > > eap: The RADIUS client has mangled the State attribute, OR you are forcing EAP in the wrong situation > > I’ve also noticed that the username from the EAP request is filtering out the suffix before proxying to another server. Any thoughts on why this is occurring? Because you configured it to do this. That isn't the default configuration. In order to see *why* this is happening, read the debug output. > Below is the output from radiusd -X command: That isn't helpful. See the docs: https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwiki.freer… We need to see the debug when the server is processing packets. Nothing else will help. Alan DeKok. - List info/subscribe/unsubscribe? See https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freera…

2 2

eap: The RADIUS client has mangled the State attribute
by Kyle Keilson 29 Apr '20

29 Apr '20

I’ve installed CentOS 8 with FreeRadius 3.0.17 and encountering an issue with eap proxied requests. When a client is proxied to another server, the EAP response is: eap: The RADIUS client has mangled the State attribute, OR you are forcing EAP in the wrong situation I’ve also noticed that the username from the EAP request is filtering out the suffix before proxying to another server. Any thoughts on why this is occurring? Below is the output from radiusd -X command: [root@radius /etc/raddb ]# radiusd -X FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ldap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/status including configuration file /etc/raddb/sites-enabled/eduroam main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 0.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server eduroam_us_1 { ipaddr = 163.253.31.2 port = 1812 type = "auth+acct" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server eduroam_us_2 { ipaddr = 163.253.30.2 port = 1812 type = "auth+acct" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm NULL { } realm ringling.edu { authhost = LOCAL accthost = LOCAL } home_server_pool eduroamus_loadbalance { type = load-balance home_server = eduroam_us_1 home_server = eduroam_us_2 } realm DEFAULT { pool = eduroamus_loadbalance } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client test-controller { ipaddr = 192.168.1.5 netmask = 32 require_message_authenticator = no secret = <<< secret >>> shortname = "test-controller" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = mschap # Creating Autz-Type = Status-Server # Creating Acct-Type = Status-Server radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "PROFILE=SYSTEM" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:357 } # server inner-tunnel server status { # from file /etc/raddb/sites-enabled/status # Loading authorize {...} } # server status server eduroam { # from file /etc/raddb/sites-enabled/eduroam # Loading authenticate {...} # Loading authorize {...} # Loading accounting {...} # Loading pre-proxy {...} # Loading post-proxy {...} } # server eduroam radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "status" ipaddr = 127.0.0.1 port = 18121 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on status address 127.0.0.1 port 18121 bound to server status Listening on proxy address * port 42913 Listening on proxy address :: port 46427 Ready to process requests Regards, Kyle Keilson Institutional Technology Ringling College of Art and Design 2700 N Tamiami Trail Sarasota, FL 34234 Office: 941.359.7633 Web: www.ringling.edu<http://www.ringling.edu/>

2 1

Accept any request using freeradius.db
by Yağız Önen 28 Apr '20

28 Apr '20

Hello everyone, I am trying to accept all incoming requests using freeradius.db. SQL is connected to freeradius and working fine. I added an entry in radcheck table: DEFAULT | Auth-Type | := | Accept However, I cannot get Accept-Accept. When I add the entry in raddb/users: DEFAULT Auth-Type := Accept I get Accept-Accept from all users. What am I doing wrong in database? Thank you. The response is: (0) Received Access-Request Id 164 from 192.168.67.229:41667 to 192.168.67.229:1812 length 74 (0) User-Name = "test" (0) User-Password = "hellasdo1" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 10 (0) Message-Authenticator = 0x5728f535d2d332599c9c4dd351860896 (0) # Executing section authorize from file /opt/sinecins/bin/freeradius/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/) </(a)(.+)%5C.(.+)$/)>) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/) </(a)(.+)%5C.(.+)$/)>) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "test", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) IPASS: Checking for prefix before "/" (0) IPASS: No '/' in User-Name = "test", looking up realm NULL (0) IPASS: No such realm "NULL" (0) [IPASS] = noop (0) ntdomain: Checking for prefix before "\" (0) ntdomain: No '\' in User-Name = "test", looking up realm NULL (0) ntdomain: No such realm "NULL" (0) [ntdomain] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> test (0) sql: SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id rlm_sql (sql): Reserved connection (2) rlm_sql (sql): Released connection (2) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_sqlite: Opening SQLite database "/opt/sinecins/bin/freeradius.db" (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /opt/sinecins/bin/freeradius/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (0) sql: EXPAND %{User-Name} (0) sql: --> test (0) sql: SQL-User-Name set to 'test' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'hellasdo1', 'Access-Reject', '2020-04-27 19:10:59') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'hellasdo1', 'Access-Reject', '2020-04-27 19:10:59') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (3) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test] (from client client1 port 10) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 164 from 192.168.67.229:1812 to 192.168.67.229:41667 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 164 with timestamp +4 Ready to process requests

2 1

Sqlippool error
by Philemon Jaomalaza 28 Apr '20

28 Apr '20

Hello everyone, on freeradius 3.0.18, I used sqlippool in its default configuration but it gives the following error when I start freeradius: including configuration file /etc/freeradius/mods-config/sql/ippool/mysql/queries.conf /etc/freeradius/mods-config/sql/ippool/mysql/queries.conf[114]: Parse error: Unterminated string Errors reading or parsing /etc/freeradius/radiusd.conf someone can help me ? JMLZ

2 2

users file, ip address and mask
by Marcin Romanowski 28 Apr '20

28 Apr '20

Hello, Every user when is authenticating as username uses its ip address In users file I have that config: 192.168.49.81 Cleartext-Password := 'cisco' Cisco-Service-info = 'QU;1433600000;D;1433600000' This works but I'd like to match network 192.168.49.0/25 Cleartext-Password := 'cisco' Cisco-Service-info = 'QU;1433600000;D;1433600000' Is it possible Best regards MR

2 2

Freeradius dynamic vlan assignment
by Heikki Lavaste 28 Apr '20

28 Apr '20

Hi, I've some client devices connected to a switch. Is there a way to set the vlan that radius assigns to be tagged/untagged? I saw some examples of a HP/Aruba VSA that can do this, but anything vendor neutral way to do the same? Example user: dot1x Cleartext-Password := "linux" Service-Type = login, Tunnel-Type = VLAN , Tunnel-Medium-Type = IEEE-802 , Tunnel-Private-Group-ID = 100 Kind regards Heikki Lavaste

2 1

rlm_python / v4.x vs. rlm_python3 / v3.x
by Heikki Hannikainen 28 Apr '20

28 Apr '20

Hi, I'd like to ask for clarification on Python 3 support status, from the python code point of view. From what I see here, and in the ticket (https://github.com/FreeRADIUS/freeradius-server/issues/2351) rlm_python3 appears to work alright for those who have tested it. On the other hand, https://freeradius.org/modules/?mod=rlm_python3 lists rlm_python3 as deprecated, although @alandekok does suggest using it on Freeradius 3.x on this mailing list this month. If one were to write python code, in Python 3, right now, should one target the stable Freeradius 3.x branch on rlm_python3, or Freeradius master/4.x branch with rlm_python compiled against Python 3? The API towards Python code probably doesn't change much between the two? - Hessu

5 9

How can I use Radiusclient to authenticate supplicants
by erwin＠generex.de 28 Apr '20

28 Apr '20

Hi, I want to authenticate via radiusclient supplicants /etc/radiusclient/radiusclient.conf: https://pastebin.com/gAdNbWxD /etc/radiusclient/servers https://pastebin.com/4AXf75i RADIUS server is running Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 58396 Listening on proxy address :: port 60516 Ready to process requests Execution of radiusclient results in # /usr/sbin/radiusclient -f radiusclient.conf -p 1812 -s Segmentation fault Where can I found more documentation of radiusclient (usage)? What is the meaning of '-s' and '[-a] a1=v1 [a2=v2[...[aN=vN]...]]]'? Is the radiusclient able to authenticate supplicants? Thanks, Erwin

2 1