- Freeradius-Users - lists.freeradius.org

EAP TLS: how the radius server track clients
by Jim Shi 03 May '20

03 May '20

Hi, I have a question about how the radius server keep track of clients in EAP TLS. My understanding is that EAP TLS involves a series of requests/responses. Hence the radius server needs to keep track of status for each client during the handshake. How does the radius server keep track of clients? Based on 'User-Name' in the radius packet request? Thanks Jim

2 1

Re: Freeradius-Users Digest, Vol 181, Issue 4
by Gleb Lisikh 03 May '20

03 May '20

>> I was able to overcome the need for Cleartext password in MSCHAPv2 EAP inner tunnel authentication by adding python to /usr/local/etc/raddb/sites-enabled/inner-tunnel, as well as returning NT-Password in the config return. No other types of hashing have been otherwise recognized by mschap. > Alan: Yes, that's what you were told. Not really... unless I completely missed one of your responses, Alan. The advice was to use PAP for authentication and LDAP or SQL for storing an encrypted password. None of those work for me due to the the client authentication requirements, which I clearly stated. > >It seems like a workable solution for now, unless this would be considered as not in line with best practices and/or will have some undesirable consequences. > Alan: As said before, Cleartext-Password and NT-Password are your only options. As such, using them is necessary. Again, had NT-Password been mentioned somewhere I would have tried it right away. Sorry if I did miss something in your responses. But your overall hints and guidance were very useful! for my in finding the solution. > Alan: This isn't about "best practices" or "undesirable consequences". Nothing else works, so these are your *only* practices. Good to know. Thanks for confirming. We can close this thread. Thanks again! Gleb On Sun, May 3, 2020 at 6:00 AM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Proxy when SIP Request method is MESSAGE (João Vitor Arruda) > 2. Re: Proxy when SIP Request method is MESSAGE (Matthew Newton) > 3. Re: Best/simplest authentication method to validate an > encrypted user/password against encrypted known-good. (Gleb Lisikh) > 4. Re: Best/simplest authentication method to validate an > encrypted user/password against encrypted known-good. (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 2 May 2020 10:30:31 -0300 > From: João Vitor Arruda <joao.arruda(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Proxy when SIP Request method is MESSAGE > Message-ID: > <CABQ6UzXVOeDBqqeozA-6L92HM=ZW4b0q6gnkHzD7LX= > B6n32gg(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Hello, > > I currently have FS being used as a B2BUA for voice calls (INVITE SIP > Request method) but I also need to process some MESSAGE type SIP > requests. > > I'm wondering if there is a way to configure FS to completely proxy > those messages.without acting like a B2BUA. > > In my initial try I got a "chatplan" configured to handle those > messages with a lua script that use: freeswitch.Event("info", > "SMS::SEND_MESSAGE"); > > This kinda working but the problem i'm having is that FS will reply > "202 Accepted" to the original sender before it even forward it to the > final destination which breaks our ability to really confirm that the > message was accepted by the final destination. > > Joao Arruda > > > ------------------------------ > > Message: 2 > Date: Sat, 2 May 2020 15:54:43 +0100 > From: Matthew Newton <mcn(a)freeradius.org> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Proxy when SIP Request method is MESSAGE > Message-ID: <472f48e9-50f1-1b8a-6a9d-3dbbbabc0231(a)freeradius.org> > Content-Type: text/plain; charset=utf-8; format=flowed > > On 02/05/2020 14:30, João Vitor Arruda wrote: > > I currently have FS being used as a B2BUA for voice calls (INVITE SIP > > Request method) but I also need to process some MESSAGE type SIP > > requests. > > Wrong list... > > -- > Matthew > > > ------------------------------ > > Message: 3 > Date: Sat, 2 May 2020 13:24:13 -0400 > From: Gleb Lisikh <in4bit.general(a)gmail.com> > To: Alan DeKok <aland(a)deployingradius.com> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Best/simplest authentication method to validate an > encrypted user/password against encrypted known-good. > Message-ID: > < > CAKMAD3nrkKwkkeUam9cYVA9yuO9bqXe3XC8MmUu+1PJttfnzyw(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > I was able to overcome the need for Cleartext password in MSCHAPv2 EAP > inner tunnel authentication by adding python > to /usr/local/etc/raddb/sites-enabled/*inner-tunnel,* as well as returning > *NT-Password* in the config return. > No other types of hashing have been otherwise recognized by mschap. > > It seems like a workable solution for now, unless this would be considered > as not in line with best practices and/or will have some undesirable > consequences. > > Any comments are welcome. > > Thank you, > > Gleb > > > > > On Fri, May 1, 2020 at 5:13 PM Gleb Lisikh <in4bit.general(a)gmail.com> > wrote: > > > Thanks a lot Alan! I am making progress at least in my understanding of > > how everything flows. > > > > The client uses EAP and MSCHAPv2 for EAP/TLS inner-tunnel > authentication. > > And mschap requires Cleartext-Password for known good password. Is there > > any way to substitute such password with an encrypted (e.g. SHA1) string? > > To your earlier point, I can do the following for PAP (in default or/and > > inner-tunnel authorize section) to provide with a hashed password: > > ########## > > config = ( ('SHA-Password', 'aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d'), > ) > > return (radiusd.RLM_MODULE_OK, reply, config) > > ######### > > > > But the Auth-Type is preset to MSCHAPv2, and the mschap demands for > > Cleartext, and fails if it does not get it. > > > > Anything I can do to overcome this Cleartext problem? > > > > On a side note, I'd also rather not use SQL or LDAP for proving an > > encrypted password, but this does not seem to be solving the problem of > > mschap needing only Cleartext either, unless I am terribly confused > > > > Regards, > > > > Gleb > > > > > > On Wed, Apr 29, 2020 at 6:02 PM Alan DeKok <aland(a)deployingradius.com> > > wrote: > > > >> On Apr 29, 2020, at 5:03 PM, Gleb Lisikh <in4bit.general(a)gmail.com> > >> wrote: > >> > I'd like to be able to authenticate a user by comparing password > >> provided > >> > with the client's authentication request with what's in a password > >> store. > >> > It can be easily done by Clear-Text password, of course, but I cannot > >> have > >> > a known good password in that password store in Clear-Text form - only > >> > encrypted (doesn't really matter how). > >> > >> It does matter how. FreeRADIUS has to understand the encrypted form > in > >> order to authenticate the user. > >> > >> > So ideally, i'd like to get an encrypted password string from a > client, > >> and > >> > compare it with an encrypted password string retrieved from the known > >> good > >> > password store. > >> > >> RADIUS doesn't work that way. > >> > >> You can get the clear-text password from the user. It's in the > >> User-Password attribute. You can get the encrypted password from a > >> database such as SQL or LDAP. The "pap" module will then compare the > two. > >> > >> > The retrieval of the known good password is done in the > >> > python module. And I'd rather not use SQL instead for the Python. > >> > >> The python module should just hand the encrypted password to > >> FreeRADIUS, and let FreeRADIUS do the work. > >> > >> See mods-available/pap for documentation on what encrypted formats are > >> supported. > >> > >> > EAP methods encrypt the whole message using the user passwords as a > key > >> (as > >> > far as I understand it), which complicates the matter... > >> > >> No. EAP methods do something rather more complex, like TLS. > >> > >> Alan DeKok. > >> > >> > > > ------------------------------ > > Message: 4 > Date: Sat, 2 May 2020 15:01:33 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: glisikh(a)in4bit.com > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Best/simplest authentication method to validate an > encrypted user/password against encrypted known-good. > Message-ID: <8AC079A7-17C4-4B20-BD06-747DB1BB0105(a)deployingradius.com> > Content-Type: text/plain; charset=us-ascii > > On May 2, 2020, at 1:24 PM, Gleb Lisikh <in4bit.general(a)gmail.com> wrote: > > > > I was able to overcome the need for Cleartext password in MSCHAPv2 EAP > inner tunnel authentication by adding python to > /usr/local/etc/raddb/sites-enabled/inner-tunnel, as well as returning > NT-Password in the config return. > > No other types of hashing have been otherwise recognized by mschap. > > Yes, that's what you were told. > > > It seems like a workable solution for now, unless this would be > considered as not in line with best practices and/or will have some > undesirable consequences. > > As said before, Cleartext-Password and NT-Password are your only > options. As such, using them is necessary. > > This isn't about "best practices" or "undesirable consequences". > Nothing else works, so these are your *only* practices. > > Alan DeKok. > > > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 181, Issue 4 > ************************************************ >

2 1

Best/simplest authentication method to validate an encrypted user/password against encrypted known-good.
by Gleb Lisikh 02 May '20

02 May '20

Hi guys! I am running into a bit of a problem where I least expected, so looking for a general advice here. I'd like to be able to authenticate a user by comparing password provided with the client's authentication request with what's in a password store. It can be easily done by Clear-Text password, of course, but I cannot have a known good password in that password store in Clear-Text form - only encrypted (doesn't really matter how). So ideally, i'd like to get an encrypted password string from a client, and compare it with an encrypted password string retrieved from the known good password store. The retrieval of the known good password is done in the python module. And I'd rather not use SQL instead for the Python. EAP methods encrypt the whole message using the user passwords as a key (as far as I understand it), which complicates the matter... Any advice as to what standard mechanism(s)/method(s) can be used in such case? I hope I explained it well enough... Thank you so much! Gleb

3 5

Proxy when SIP Request method is MESSAGE
by João Vitor Arruda 02 May '20

02 May '20

Hello, I currently have FS being used as a B2BUA for voice calls (INVITE SIP Request method) but I also need to process some MESSAGE type SIP requests. I'm wondering if there is a way to configure FS to completely proxy those messages.without acting like a B2BUA. In my initial try I got a "chatplan" configured to handle those messages with a lua script that use: freeswitch.Event("info", "SMS::SEND_MESSAGE"); This kinda working but the problem i'm having is that FS will reply "202 Accepted" to the original sender before it even forward it to the final destination which breaks our ability to really confirm that the message was accepted by the final destination. Joao Arruda

2 1

How to force EAP-Identity Request sending after EAP START
by JAVIER SANDOVAL 01 May '20

01 May '20

Hi experts, I would appreciate your help, I am not that familiar with freeradius. I am using FreeRADIUS Version 3.0.20. I do not success Radius server to initiate EAP-Identity Request after START as stated in https://wiki.freeradius.org/modules/Rlm_eap#How_Freeradius_can_handle_EAPST… I get a reject reject, it seems something more is needed partial log: (0) eap: Got EAP_START message (0) [eap] = handled (0) } # authorize = handled (0) There was no response configured: rejecting request Kind regards, Javier

2 6

Freeradius-client
by erwin＠generex.de 30 Apr '20

30 Apr '20

Hi, How can I communicate to an external server encrypted (TLS)? Thanks, Erwin

2 1

Brocade attribute with AD
by Luke Smith 29 Apr '20

29 Apr '20

I'm curious to see if anyone using freeradius with Brocade and Active Directory and how they are successfully getting logins to work. I know that I need to add the attribute brocade-admin and I've got that configured on my AD and propagated but when I go to the Brocade/Extreme device I login with the AD credentials but the attribute doesn't get passed along. If I edit my client.conf file I can make a local username work just fine, but I don't want to manage user accounts out of freeradius, I want that managed by AD. Anyone have any insight? Thanks in advance! Luke Smith Director Network/IT Colorado Valley Communications direct: 979.247.8122 | mobile: 979.249.7376 email: lukes(a)coloradovalley.com<mailto:lukes@coloradovalley.com> url: http://www.cvctx.com<http://www.cvctx.com/> Confidentiality Notice: The information herein transmitted or attached is intended only for the person or entity to which this e-mail is addressed and may contain confidential and/or legally privileged material. Any review, retransmission, dissemination, other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you have received this in error, please contact the sender immediately and delete the material from any and all computers, servers, and e-mail programs. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.

2 1

Re: The RADIUS client has mangled the State attribute
by Kyle Keilson 29 Apr '20

29 Apr '20

I've reviewed the debug output and it appears to point to the attr_filter.post_proxy filter. I should mention that the defaults for the attr_filter are in use and have not been changed. Here is the output when the server is processing packets: (0) Received Access-Request Id 150 from 192.168.1.5:61168 to 192.168.1.4:1812 length 381 (0) User-Name = "testuser(a)ringlingtest.com" (0) Service-Type = Framed-User (0) Cisco-AVPair = "service-type=Framed" (0) Framed-MTU = 1485 (0) EAP-Message = 0x02010018014b4b45494c534f4e4064657061756c2e656475 (0) Message-Authenticator = 0x168a719ee6ceaba1d478fa2f469bf647 (0) Cisco-AVPair = "audit-session-id=B5BF26D800000D54C6C4F544" (0) Cisco-AVPair = "method=dot1x" (0) Cisco-AVPair = "client-iif-id=855639101" (0) Cisco-AVPair = "vlan-id=5" (0) NAS-IP-Address = 192.168.1.5 (0) NAS-Port-Id = "capwap_9000013c" (0) NAS-Port-Type = Wireless-802.11 (0) NAS-Port = 6018 (0) Called-Station-Id = "07-4c-d9-2e-12-c0:eduroam" (0) Calling-Station-Id = "e0-32-7e-72-b4-9a" (0) Airespace-Wlan-Id = 4 (0) Cisco-AVPair = "cisco-wlan-ssid=eduroam" (0) NAS-Identifier = "test-controller" (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy split_username_nai { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) -> TRUE (0) if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) { (0) update request { (0) EXPAND %{1} (0) --> testuser (0) &Stripped-User-Name := testuser (0) } # update request = noop (0) if ("%{3}" != '') { (0) EXPAND %{3} (0) --> ringlingtest.com (0) if ("%{3}" != '') -> TRUE (0) if ("%{3}" != '') { (0) update request { (0) EXPAND %{3} (0) --> ringlingtest.com (0) &Stripped-User-Domain = ringlingtest.com (0) } # update request = noop (0) } # if ("%{3}" != '') = noop (0) [updated] = updated (0) } # if (&User-Name && (&User-Name =~ /^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) = updated (0) ... skipping else: Preceding "if" was taken (0) } # policy split_username_nai = updated (0) if (noop || !&Stripped-User-Domain) { (0) if (noop || !&Stripped-User-Domain) -> FALSE (0) if (&Stripped-User-Domain != "ringling.edu") { (0) if (&Stripped-User-Domain != "ringling.edu") -> TRUE (0) if (&Stripped-User-Domain != "ringling.edu") { (0) update { (0) control:Load-Balance-Key := &Calling-Station-ID -> 'e0-32-7e-72-b4-9a' (0) control:Proxy-To-Realm := 'DEFAULT' (0) request:Operator-Name := "1ringling.edu" (0) } # update = noop (0) return (0) } # if (&Stripped-User-Domain != "ringling.edu") = noop (0) } # authorize = updated (0) Starting proxy to home server 163.253.30.2 port 1812 (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (0) pre-proxy { (0) attr_filter.pre-proxy: EXPAND %{Realm} (0) attr_filter.pre-proxy: --> DEFAULT (0) attr_filter.pre-proxy: Matched entry DEFAULT at line 50 (0) [attr_filter.pre-proxy] = updated (0) } # pre-proxy = updated (0) Proxying request to home server 163.253.30.2 port 1812 timeout 30.000000 (0) Sent Access-Request Id 59 from 0.0.0.0:42392 to 163.253.30.2:1812 length 160 (0) User-Name = "testuser" (0) EAP-Message = 0x02010018014b4b45494c534f4e4064657061756c2e656475 (0) Message-Authenticator = 0x168a719ee6ceaba1d478fa2f469bf647 (0) NAS-IP-Address = 192.168.1.4 (0) Called-Station-Id = "08-4f-f9-2e-13-c0:eduroam" (0) Calling-Station-Id = "e0-32-7e-72-b4-9a" (0) NAS-Identifier = "test-controller" (0) Operator-Name := "1ringling.edu" (0) Proxy-State = 0x313530 Waking up in 0.3 seconds. (0) Marking home server 163.253.30.2 port 1812 alive (0) Clearing existing &reply: attributes (0) Received Access-Reject Id 59 from 163.253.30.2:1812 to 199.27.242.193:42392 length 89 (0) Message-Authenticator = 0xde3171110d3a45e469ec27c03d000dad (0) EAP-Message = 0x04010004 (0) Reply-Message = "Empty Realm Forwarded by ringling.edu." (0) Proxy-State = 0x313530 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) post-proxy { (0) attr_filter.post-proxy: EXPAND %{Realm} (0) attr_filter.post-proxy: --> DEFAULT (0) attr_filter.post-proxy: Matched entry DEFAULT at line 102 (0) [attr_filter.post-proxy] = updated (0) eap: No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = updated (0) Login incorrect (Home Server says so): [testuser(a)ringlingtest.com] (from client test-controller port 6018 cli e0-32-7e-72-b4-9a) (0) Using Post-Auth-Type Reject (0) # Executing group from file /etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> testuser(a)ringlingtest.com (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> TRUE (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) update reply { (0) &Reply-Message !* ANY (0) } # update reply = noop (0) } # if (&reply:EAP-Message && &reply:Reply-Message) = noop (0) ... skipping else: Preceding "if" was taken (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect: [testuser(a)ringlingtest.com] (from client amplify-controller port 6018 cli e0-32-7e-72-b4-9a) (0) Sent Access-Reject Id 150 from 199.27.242.193:1812 to 192.168.1.5:61168 length 0 (0) Message-Authenticator = 0xde3171110d3a45e469ec27c03d000dad (0) EAP-Message = 0x04010004 (0) Finished request Waking up in 4.9 seconds. Kyle Keilson Manager, macOS Technology and Help Desk Institutional Technology Ringling College of Art and Design 2700 N Tamiami Trail Sarasota, FL 34234 Office: 941.359.7633 Web: www.ringling.edu <http://www.ringling.edu/> On 4/29/20, 12:26 PM, "Freeradius-Users on behalf of Alan DeKok" <freeradius-users-bounces+kkeilson=ringling.edu(a)lists.freeradius.org on behalf of aland(a)deployingradius.com> wrote: On Apr 29, 2020, at 12:21 PM, Kyle Keilson <kkeilson(a)ringling.edu> wrote: > > I’ve installed CentOS 8 with FreeRadius 3.0.17 and encountering an issue with eap proxied requests. When a client is proxied to another server, the EAP response is: > > eap: The RADIUS client has mangled the State attribute, OR you are forcing EAP in the wrong situation > > I’ve also noticed that the username from the EAP request is filtering out the suffix before proxying to another server. Any thoughts on why this is occurring? Because you configured it to do this. That isn't the default configuration. In order to see *why* this is happening, read the debug output. > Below is the output from radiusd -X command: That isn't helpful. See the docs: https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwiki.freer… We need to see the debug when the server is processing packets. Nothing else will help. Alan DeKok. - List info/subscribe/unsubscribe? See https://nam01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freera…

2 2

eap: The RADIUS client has mangled the State attribute
by Kyle Keilson 29 Apr '20

29 Apr '20

I’ve installed CentOS 8 with FreeRadius 3.0.17 and encountering an issue with eap proxied requests. When a client is proxied to another server, the EAP response is: eap: The RADIUS client has mangled the State attribute, OR you are forcing EAP in the wrong situation I’ve also noticed that the username from the EAP request is filtering out the suffix before proxying to another server. Any thoughts on why this is occurring? Below is the output from radiusd -X command: [root@radius /etc/raddb ]# radiusd -X FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ldap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/status including configuration file /etc/raddb/sites-enabled/eduroam main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } name = "radiusd" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 0.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server eduroam_us_1 { ipaddr = 163.253.31.2 port = 1812 type = "auth+acct" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server eduroam_us_2 { ipaddr = 163.253.30.2 port = 1812 type = "auth+acct" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } realm NULL { } realm ringling.edu { authhost = LOCAL accthost = LOCAL } home_server_pool eduroamus_loadbalance { type = load-balance home_server = eduroam_us_1 home_server = eduroam_us_2 } realm DEFAULT { pool = eduroamus_loadbalance } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client test-controller { ipaddr = 192.168.1.5 netmask = 32 require_message_authenticator = no secret = <<< secret >>> shortname = "test-controller" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = mschap # Creating Autz-Type = Status-Server # Creating Acct-Type = Status-Server radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "memberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no } } Creating attribute LDAP-Group instantiate { } # Instantiating module "reject" from file /etc/raddb/mods-enabled/always # Instantiating module "fail" from file /etc/raddb/mods-enabled/always # Instantiating module "ok" from file /etc/raddb/mods-enabled/always # Instantiating module "handled" from file /etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always # Instantiating module "noop" from file /etc/raddb/mods-enabled/always # Instantiating module "updated" from file /etc/raddb/mods-enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "PROFILE=SYSTEM" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:357 } # server inner-tunnel server status { # from file /etc/raddb/sites-enabled/status # Loading authorize {...} } # server status server eduroam { # from file /etc/raddb/sites-enabled/eduroam # Loading authenticate {...} # Loading authorize {...} # Loading accounting {...} # Loading pre-proxy {...} # Loading post-proxy {...} } # server eduroam radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "status" ipaddr = 127.0.0.1 port = 18121 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on status address 127.0.0.1 port 18121 bound to server status Listening on proxy address * port 42913 Listening on proxy address :: port 46427 Ready to process requests Regards, Kyle Keilson Institutional Technology Ringling College of Art and Design 2700 N Tamiami Trail Sarasota, FL 34234 Office: 941.359.7633 Web: www.ringling.edu<http://www.ringling.edu/>

2 1

Accept any request using freeradius.db
by Yağız Önen 28 Apr '20

28 Apr '20

Hello everyone, I am trying to accept all incoming requests using freeradius.db. SQL is connected to freeradius and working fine. I added an entry in radcheck table: DEFAULT | Auth-Type | := | Accept However, I cannot get Accept-Accept. When I add the entry in raddb/users: DEFAULT Auth-Type := Accept I get Accept-Accept from all users. What am I doing wrong in database? Thank you. The response is: (0) Received Access-Request Id 164 from 192.168.67.229:41667 to 192.168.67.229:1812 length 74 (0) User-Name = "test" (0) User-Password = "hellasdo1" (0) NAS-IP-Address = 127.0.1.1 (0) NAS-Port = 10 (0) Message-Authenticator = 0x5728f535d2d332599c9c4dd351860896 (0) # Executing section authorize from file /opt/sinecins/bin/freeradius/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/) </(a)(.+)%5C.(.+)$/)>) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/) </(a)(.+)%5C.(.+)$/)>) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "test", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) IPASS: Checking for prefix before "/" (0) IPASS: No '/' in User-Name = "test", looking up realm NULL (0) IPASS: No such realm "NULL" (0) [IPASS] = noop (0) ntdomain: Checking for prefix before "\" (0) ntdomain: No '\' in User-Name = "test", looking up realm NULL (0) ntdomain: No such realm "NULL" (0) [ntdomain] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> test (0) sql: SQL-User-Name set to 'test' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id (0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id rlm_sql (sql): Reserved connection (2) rlm_sql (sql): Released connection (2) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_sqlite: Opening SQLite database "/opt/sinecins/bin/freeradius.db" (0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql: --> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY priority (0) sql: User not found in any groups rlm_sql (sql): Released connection (1) (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /opt/sinecins/bin/freeradius/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (3) (0) sql: EXPAND %{User-Name} (0) sql: --> test (0) sql: SQL-User-Name set to 'test' (0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (0) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'hellasdo1', 'Access-Reject', '2020-04-27 19:10:59') (0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test', 'hellasdo1', 'Access-Reject', '2020-04-27 19:10:59') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (3) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> test (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [test] (from client client1 port 10) (0) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (0) Sending delayed response (0) Sent Access-Reject Id 164 from 192.168.67.229:1812 to 192.168.67.229:41667 length 20 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 164 with timestamp +4 Ready to process requests

2 1