- Freeradius-Users - lists.freeradius.org

Authorization Computers using MAC address
by James Ngo 07 Feb '20

07 Feb '20

Hello everyone, So I have already setup the Freeradius server, authenticate WIFI users using username and password. All working smoothly so far. Our office also have about 5 desktop computers, sharing the same EdgesSwitch How could I go about authorizing only our office computers using its MAC addresses? This is to prevent outside guests/visitors plug our LAN cables to their laptops I see in the "radcheck", there is "attribute" for user/password is "Cleartext-Password" when using username/password. Can I change this to something that accommodate MAC address? Or I have to come up with a complete new setup? Thank you very much for your helps Kind regards James

2 1

sphinx-build failures
by Aleksey Romanov 06 Feb '20

06 Feb '20

Hi, I am trying to build documentation from .rst files I tried both binary debian package and downloaded freeradius-server-3.0.20.tar.gz one from the website. 1. conf.py file was missing, I added an empty one 2. Then I will get warnings about non-existing entries and finally missing contents.rst ar@xdebian:~/radius-work/freeradius-server/doc$ make -f Makefile.sphinx html sphinx-build -b html -d _build/doctrees . _build/html Running Sphinx v1.8.4 making output directory... building [mo]: targets for 0 po files that are out of date building [html]: targets for 17 source files that are out of date updating environment: 17 added, 0 changed, 0 removed reading sources... [100%] vendor/cisco /home/ar/radius-work/freeradius-server/doc/developer/coding-methods.rst:35: WARNING: Unexpected indentation. /home/ar/radius-work/freeradius-server/doc/developer/coding-methods.rst:35: WARNING: Inline emphasis start-string without end-string. /home/ar/radius-work/freeradius-server/doc/developer/coding-methods.rst:36: WARNING: Block quote ends without a blank line; unexpected unindent. /home/ar/radius-work/freeradius-server/doc/developer/module_interface.rst:20: WARNING: Bullet list ends without a blank line; unexpected unindent. /home/ar/radius-work/freeradius-server/doc/developer/module_interface.rst:22: WARNING: Block quote ends without a blank line; unexpected unindent. /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'aaa' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'ldap_howto' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'load-balance' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'coding-methods' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'DIFFS' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'release-method' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'cisco' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'configurable_failover' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'processing_users_file' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'proxy' /home/ar/radius-work/freeradius-server/doc/index.rst:6: WARNING: toctree contains reference to nonexisting document 'variables' /home/ar/radius-work/freeradius-server/doc/modules/ldap_howto.rst:977: WARNING: Literal block expected; none found. Sphinx error: master file /home/ar/radius-work/freeradius-server/doc/contents.rst not found make: *** [Makefile.sphinx:35: html] Error 2 Please, help Thanks, Aleksey

2 1

Help Upgrading from 3.0.19 to 3.0.20
by Aurélio de Souza Ribeiro Neto 05 Feb '20

05 Feb '20

Hello All, I'm trying to upgrade from 3.0.19 to 3.0.20 and I'm having this problem: Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql): Processing generate_sql_clients Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql): Reserved connection (0) Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas Tue Feb 4 10:40:53 2020 : Debug: rlm_sql (sql): Adding client 127.0.0.1 (Local Host) to global clients list Tue Feb 4 10:40:53 2020 : Debug: Adding client 127.0.0.1/32 (127.0.0.1) to prefix tree 32 Tue Feb 4 10:40:53 2020 : Error: Failed to add duplicate client Local Host Tue Feb 4 10:40:53 2020 : Warning: Failed to add client, possible duplicate? Bad talloc magic value - unknown value talloc abort: Bad talloc magic value - unknown value Aborted (core dumped) Full log attached. In 3.0.19 I don't have this issue using the same settings and database. Any hint? Thanks

3 7

perl module variable scope question
by P. R.M. 05 Feb '20

05 Feb '20

I'm using the perl module to handle the backend logic between freeradius & a mysql database. * The first step in the authentication/authorization process is to have perl query the database for a given username. * Perl then queries the DB and returns the cleartext password if the username is found & is valid. * next, the cleartext password is handed off to the CHAP module for verification * afterwards, control goes back to the perl module (in post-auth section), when it runs another query in order to pull the reply attributes for the given user I'd like to avoid running the 2nd query in post-auth, and simply run a single query that returns all of the reply attributes if the username is valid. The problem is that the perl module has to exit its context & return control back to the CHAP module in order to verify the password. I don't want to prematurely set the reply attributes in the 'authorize' section if the user will subsequently be rejected due to a bad password. So, I need a way to save&pass the results of the initial query (w/ the attributes data) from the 'authorize' function to the 'post_auth' function. Global variables don't seem like they would be a good idea (not sure how this would work in terms of concurrency/thread safety). Any ideas on how to persist data from one perl module function call to the next? The only other option I considered was having the perl module do the CHAP/PAP authentication, but I would much rather leave this task to freeradius. Please help, thanks

2 1

LDAP group - samaccountname
by Olivier Mahieu 04 Feb '20

04 Feb '20

Hello, Using the LDAP module in post-auth section (PEAP-MSCHAPv2); the correct user group is not found for VLAN assignment. I think it has to do with the samaccountname. 5c5cAdministrator instead of Administrator. Where do I have to look? Thanks! Verzonden vanuit Mail<https://go.microsoft.com/fwlink/?LinkId=550986> voor Windows 10

2 3

OpenDirectory Authentication fails
by Carsten Kirschner 04 Feb '20

04 Feb '20

We have freeradius with the open directory plugin, which accesses a mac server to authenticate users. This works for most users, but we have a few users that experience errors what I cannot understand. In the inner tunnel the OpenDirectory plugin accesses the server and when it fails it logs a weird value for shortUserName (HWeissbrodt7.0.0A?؎???). For the users which can use the radius server username_string and shortUserName are the same. I traced the debug print to https://github.com/ether42/freeradius-ldap-kerberos/blob/master/radius/free… which suggests — for me — that it is a problem with the open directory communication, but I am neither sure nor can I see how the shortUserName can become that strange in the first place. I attached the radiusd -X output and the ldapsearch result. Snippet to highlight the error: (32) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) eap_mschapv2: authenticate { (32) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (32) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (32) mschap: No NT-Password configured. Trying OpenDirectory Authentication (32) mschap: OD username_string = HWeissbrodt, OD shortUserName=HWeissbrodt7.0.0A?؎??? (length = 23) (32) mschap: Stepbuf server challenge : ffffffa0ffffff80235f5efffffff8ffffff8728400551ffffffb60d62ffffff9570 (32) mschap: Stepbuf peer challenge : ffffff9cffffff95ffffff8d2c7e0effffffddffffffad7cffffffa8ffffffefffffffee4cffffff90ffffffe7ffffffca (32) mschap: Stepbuf p24 : 7656ffffffba1743125b11ffffffdb56ffffffd119ffffffa9ffffffa77fffffffbb5b3afffffffcffffffb6ffffffba216834 (32) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError (32) eap_mschapv2: [mschap] = reject Thanks Carsten Kirschner Full -XC output root@server radius # /usr/local/sbin/radiusd -XC FreeRADIUS Version 3.0.19 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/opendirectory including configuration file /usr/local/etc/raddb/mods-enabled/sql including configuration file /usr/local/etc/raddb/mods-config/sql/main/sqlite/queries.conf including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/debug including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = digest # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = opendirectory radiusd: #### Instantiating modules #### modules { # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no use_open_directory = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_opendirectory # Loading module "opendirectory" from file /usr/local/etc/raddb/mods-enabled/opendirectory # Loaded module rlm_sql # Loading module "sql" from file /usr/local/etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_sqlite" server = "" port = 0 login = "" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-Group}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" auto_escape = no accounting { reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } accounting-off { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = (%{%{integer:Event-Timestamp}:-strftime('%%s', 'now')} - strftime('%%s', acctstarttime)), acctterminatecause = '%{Acct-Terminate-Cause}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= %{integer:Event-Timestamp}" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, framedipv6address, framedipv6prefix, framedinterfaceid, delegatedipv6prefix) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', %{%{integer:Event-Timestamp}:-date('now')}, %{%{integer:Event-Timestamp}:-date('now')}, NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Framed-IPv6-Address}', '%{Framed-IPv6-Prefix}', '%{Framed-Interface-Id}', '%{Delegated-IPv6-Prefix}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = %{%{integer:Event-Timestamp}:-date('now')}, acctinterval = 0, framedipaddress = '%{Framed-IP-Address}', framedipv6address = '%{Framed-IPv6-Address}', framedipv6prefix = '%{Framed-IPv6-Prefix}', framedinterfaceid = '%{Framed-Interface-Id}', delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = %{%{integer:Event-Timestamp}:-date('now')}, acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = %{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0}, acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 | %{%{Acct-Output-Octets}:-0}, acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked Creating attribute SQL-Group instantiate { } # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.intern.corussoft.de.private_key.pem" certificate_file = "/usr/local/etc/raddb/certs/server.intern.corussoft.de.725D267E5DA231F7A889EC58A4D28DE496E1DA15.cert.pem" ca_file = "/usr/local/etc/raddb/certs/server.intern.corussoft.de.725D267E5DA231F7A889EC58A4D28DE496E1DA15.chain.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "sql" from file /usr/local/etc/raddb/mods-enabled/sql rlm_sql_sqlite: libsqlite version: 3.28.0 sqlite { filename = "/var/db/radius/freeradius.db" busy_timeout = 200 } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): 0 of 0 connections in use. You may need to increase "spare" rlm_sql (sql): Opening additional connection (0), 1 of 1 pending slots used rlm_sql_sqlite: Opening SQLite database "/var/db/radius/freeradius.db" rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Adding client 192.168.10.15 (Server) to global clients list rlm_sql (192.168.10.15): Client "Server" (sql) added rlm_sql (sql): Adding client 192.168.10.1 (Sophos Firewall) to global clients list rlm_sql (192.168.10.1): Client "Sophos Firewall" (sql) added rlm_sql (sql): Released connection (0) } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:336 } # server inner-tunnel radiusd: #### Skipping IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Configuration appears to be OK Failing connection attempt: (31) Received Access-Request Id 32 from 192.168.10.1:38494 to 192.168.10.15:1812 length 272 (31) User-Name = "HWeissbrodt" (31) NAS-Identifier = "Corussoft" (31) Called-Station-Id = "00-1A-8C-E1-C0-D9:Corussoft" (31) NAS-Port-Type = Wireless-802.11 (31) NAS-Port = 8 (31) Calling-Station-Id = "B0-CA-68-7B-D9-13" (31) Connect-Info = "CONNECT 54Mbps 802.11a" (31) Acct-Session-Id = "5DF89C40-0001C80F" (31) WLAN-Pairwise-Cipher = 1027076 (31) WLAN-Group-Cipher = 1027076 (31) WLAN-AKM-Suite = 1027073 (31) Framed-MTU = 1400 (31) EAP-Message = 0x026d003f15800000003517030300302cac76e0e9b0fccf66f8ebcbb026bcffc0682bca99f353e43849441c60ea8e4cf26a7cbdbf8b563b11a6fc359107ff71 (31) State = 0xf9a2b0edfccfa53d3b7e5de4bf637ef2 (31) Message-Authenticator = 0x6c653166aae32c928b1a52d3f0bdcb8a (31) Restoring &session-state (31) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (31) &session-state:TLS-Session-Version = "TLS 1.2" (31) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (31) authorize { (31) [preprocess] = ok (31) [chap] = noop (31) [mschap] = noop (31) [digest] = noop (31) suffix: Checking for suffix after "@" (31) suffix: No '@' in User-Name = "HWeissbrodt", looking up realm NULL (31) suffix: No such realm "NULL" (31) [suffix] = noop (31) eap: Peer sent EAP Response (code 2) ID 109 length 63 (31) eap: Continuing tunnel setup (31) [eap] = ok (31) } # authorize = ok (31) Found Auth-Type = eap (31) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (31) authenticate { (31) eap: Expiring EAP session with state 0xf9a2b0edfccfa53d (31) eap: Finished EAP session with state 0xf9a2b0edfccfa53d (31) eap: Previous EAP request found for state 0xf9a2b0edfccfa53d, released from the list (31) eap: Peer sent packet with method EAP TTLS (21) (31) eap: Calling submodule eap_ttls to process data (31) eap_ttls: Authenticate (31) eap_ttls: Continuing EAP-TLS (31) eap_ttls: Peer indicated complete TLS record size will be 53 bytes (31) eap_ttls: Got complete TLS record (53 bytes) (31) eap_ttls: [eaptls verify] = length included (31) eap_ttls: [eaptls process] = ok (31) eap_ttls: Session established. Proceeding to decode tunneled attributes (31) eap_ttls: Got tunneled request (31) eap_ttls: EAP-Message = 0x020000100148576569737362726f6474 (31) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (31) eap_ttls: Got tunneled identity of HWeissbrodt (31) eap_ttls: Setting default EAP type for tunneled EAP session (31) eap_ttls: Sending tunneled request (31) Virtual server inner-tunnel received request (31) EAP-Message = 0x020000100148576569737362726f6474 (31) FreeRADIUS-Proxied-To = 127.0.0.1 (31) User-Name = "HWeissbrodt" (31) WARNING: Outer and inner identities are the same. User privacy is compromised. (31) server inner-tunnel { (31) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (31) authorize { (31) policy filter_username { (31) if (&User-Name) { (31) if (&User-Name) -> TRUE (31) if (&User-Name) { (31) if (&User-Name =~ / /) { (31) if (&User-Name =~ / /) -> FALSE (31) if (&User-Name =~ /@[^@]*@/ ) { (31) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (31) if (&User-Name =~ /\.\./ ) { (31) if (&User-Name =~ /\.\./ ) -> FALSE (31) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (31) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (31) if (&User-Name =~ /\.$/) { (31) if (&User-Name =~ /\.$/) -> FALSE (31) if (&User-Name =~ /(a)\./) { (31) if (&User-Name =~ /(a)\./) -> FALSE (31) } # if (&User-Name) = notfound (31) } # policy filter_username = notfound (31) [chap] = noop (31) [mschap] = noop (31) suffix: Checking for suffix after "@" (31) suffix: No '@' in User-Name = "HWeissbrodt", looking up realm NULL (31) suffix: No such realm "NULL" (31) [suffix] = noop (31) update control { (31) &Proxy-To-Realm := LOCAL (31) } # update control = noop (31) eap: Peer sent EAP Response (code 2) ID 0 length 16 (31) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (31) [eap] = ok (31) } # authorize = ok (31) Found Auth-Type = eap (31) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (31) authenticate { (31) eap: Peer sent packet with method EAP Identity (1) (31) eap: Calling submodule eap_mschapv2 to process data (31) eap_mschapv2: Issuing Challenge (31) eap: Sending EAP Request (code 1) ID 1 length 43 (31) eap: EAP session adding &reply:State = 0xe56f92e7e56e8870 (31) [eap] = handled (31) } # authenticate = handled (31) } # server inner-tunnel (31) Virtual server sending reply (31) EAP-Message = 0x0101002b1a0101002610a080235f5ef88728400551b60d629570667265657261646975732d332e302e3139 (31) Message-Authenticator = 0x00000000000000000000000000000000 (31) State = 0xe56f92e7e56e8870040d68add7a0fd37 (31) eap_ttls: Got tunneled Access-Challenge (31) eap: Sending EAP Request (code 1) ID 110 length 91 (31) eap: EAP session adding &reply:State = 0xf9a2b0edffcca53d (31) [eap] = handled (31) } # authenticate = handled (31) Using Post-Auth-Type Challenge (31) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (31) Challenge { ... } # empty sub-section is ignored (31) session-state: Saving cached attributes (31) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (31) TLS-Session-Version = "TLS 1.2" (31) Sent Access-Challenge Id 32 from 192.168.10.15:1812 to 192.168.10.1:38494 length 0 (31) EAP-Message = 0x016e005b158000000051170303004cd2bcac73d14014ac7c20d51e15566d472b0e676b016dc74c0088b5214755fe92916624e6b4427a51f3cf26720f247206252750d4d66ddfaa75953755c3864faf073be832c45cc1a2d67d14fe (31) Message-Authenticator = 0x00000000000000000000000000000000 (31) State = 0xf9a2b0edffcca53d3b7e5de4bf637ef2 (31) Finished request Waking up in 4.8 seconds. (32) Received Access-Request Id 33 from 192.168.10.1:38494 to 192.168.10.15:1812 length 328 (32) User-Name = "HWeissbrodt" (32) NAS-Identifier = "Corussoft" (32) Called-Station-Id = "00-1A-8C-E1-C0-D9:Corussoft" (32) NAS-Port-Type = Wireless-802.11 (32) NAS-Port = 8 (32) Calling-Station-Id = "B0-CA-68-7B-D9-13" (32) Connect-Info = "CONNECT 54Mbps 802.11a" (32) Acct-Session-Id = "5DF89C40-0001C80F" (32) WLAN-Pairwise-Cipher = 1027076 (32) WLAN-Group-Cipher = 1027076 (32) WLAN-AKM-Suite = 1027073 (32) Framed-MTU = 1400 (32) EAP-Message = 0x026e007715800000006d17030300682cac76e0e9b0fcd00aaac7e6a46cd6ac3d3d0ba98ead722f9a387082bb1c83bd9d07535f284a6c410d18ba24342f4c0e114952ba6f3621e39b1ca0de37a0441d887181629d1b02baaf96958e2b06aca8b9e0cbb2b4276cbaabf7059014ee3a33679b7c535d56d9ff (32) State = 0xf9a2b0edffcca53d3b7e5de4bf637ef2 (32) Message-Authenticator = 0x8f766a6554c23d52ff028b06394a64ff (32) Restoring &session-state (32) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (32) &session-state:TLS-Session-Version = "TLS 1.2" (32) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (32) authorize { (32) [preprocess] = ok (32) [chap] = noop (32) [mschap] = noop (32) [digest] = noop (32) suffix: Checking for suffix after "@" (32) suffix: No '@' in User-Name = "HWeissbrodt", looking up realm NULL (32) suffix: No such realm "NULL" (32) [suffix] = noop (32) eap: Peer sent EAP Response (code 2) ID 110 length 119 (32) eap: Continuing tunnel setup (32) [eap] = ok (32) } # authorize = ok (32) Found Auth-Type = eap (32) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (32) authenticate { (32) eap: Expiring EAP session with state 0xe56f92e7e56e8870 (32) eap: Finished EAP session with state 0xf9a2b0edffcca53d (32) eap: Previous EAP request found for state 0xf9a2b0edffcca53d, released from the list (32) eap: Peer sent packet with method EAP TTLS (21) (32) eap: Calling submodule eap_ttls to process data (32) eap_ttls: Authenticate (32) eap_ttls: Continuing EAP-TLS (32) eap_ttls: Peer indicated complete TLS record size will be 109 bytes (32) eap_ttls: Got complete TLS record (109 bytes) (32) eap_ttls: [eaptls verify] = length included (32) eap_ttls: [eaptls process] = ok (32) eap_ttls: Session established. Proceeding to decode tunneled attributes (32) eap_ttls: Got tunneled request (32) eap_ttls: EAP-Message = 0x020100461a02010041319c958d2c7e0eddad7ca8efee4c90e7ca00000000000000007656ba1743125b11db56d119a9a77fbb5b3afcb6ba2168340048576569737362726f6474 (32) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (32) eap_ttls: Sending tunneled request (32) Virtual server inner-tunnel received request (32) EAP-Message = 0x020100461a02010041319c958d2c7e0eddad7ca8efee4c90e7ca00000000000000007656ba1743125b11db56d119a9a77fbb5b3afcb6ba2168340048576569737362726f6474 (32) FreeRADIUS-Proxied-To = 127.0.0.1 (32) User-Name = "HWeissbrodt" (32) State = 0xe56f92e7e56e8870040d68add7a0fd37 (32) WARNING: Outer and inner identities are the same. User privacy is compromised. (32) server inner-tunnel { (32) session-state: No cached attributes (32) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) authorize { (32) policy filter_username { (32) if (&User-Name) { (32) if (&User-Name) -> TRUE (32) if (&User-Name) { (32) if (&User-Name =~ / /) { (32) if (&User-Name =~ / /) -> FALSE (32) if (&User-Name =~ /@[^@]*@/ ) { (32) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (32) if (&User-Name =~ /\.\./ ) { (32) if (&User-Name =~ /\.\./ ) -> FALSE (32) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (32) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (32) if (&User-Name =~ /\.$/) { (32) if (&User-Name =~ /\.$/) -> FALSE (32) if (&User-Name =~ /(a)\./) { (32) if (&User-Name =~ /(a)\./) -> FALSE (32) } # if (&User-Name) = notfound (32) } # policy filter_username = notfound (32) [chap] = noop (32) [mschap] = noop (32) suffix: Checking for suffix after "@" (32) suffix: No '@' in User-Name = "HWeissbrodt", looking up realm NULL (32) suffix: No such realm "NULL" (32) [suffix] = noop (32) update control { (32) &Proxy-To-Realm := LOCAL (32) } # update control = noop (32) eap: Peer sent EAP Response (code 2) ID 1 length 70 (32) eap: No EAP Start, assuming it's an on-going EAP conversation (32) [eap] = updated (32) [files] = noop (32) sql: EXPAND %{User-Name} (32) sql: --> HWeissbrodt (32) sql: SQL-User-Name set to 'HWeissbrodt' rlm_sql (sql): Reserved connection (8) (32) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (32) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'HWeissbrodt' ORDER BY id (32) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'HWeissbrodt' ORDER BY id rlm_sql (sql): Reserved connection (9) rlm_sql (sql): Released connection (9) Need 7 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (11), 1 of 28 pending slots used rlm_sql_sqlite: Opening SQLite database "/var/db/radius/freeradius.db" (32) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (32) sql: --> SELECT groupname FROM radusergroup WHERE username = 'HWeissbrodt' ORDER BY priority (32) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'HWeissbrodt' ORDER BY priority (32) sql: User not found in any groups rlm_sql (sql): Released connection (8) (32) [sql] = notfound (32) [expiration] = noop (32) [logintime] = noop (32) [pap] = noop (32) } # authorize = updated (32) Found Auth-Type = eap (32) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) authenticate { (32) eap: Expiring EAP session with state 0xe56f92e7e56e8870 (32) eap: Finished EAP session with state 0xe56f92e7e56e8870 (32) eap: Previous EAP request found for state 0xe56f92e7e56e8870, released from the list (32) eap: Peer sent packet with method EAP MSCHAPv2 (26) (32) eap: Calling submodule eap_mschapv2 to process data (32) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) eap_mschapv2: authenticate { (32) mschap: WARNING: No Cleartext-Password configured. Cannot create NT-Password (32) mschap: WARNING: No Cleartext-Password configured. Cannot create LM-Password (32) mschap: No NT-Password configured. Trying OpenDirectory Authentication (32) mschap: OD username_string = HWeissbrodt, OD shortUserName=HWeissbrodt7.0.0A?؎??? (length = 23) (32) mschap: Stepbuf server challenge : ffffffa0ffffff80235f5efffffff8ffffff8728400551ffffffb60d62ffffff9570 (32) mschap: Stepbuf peer challenge : ffffff9cffffff95ffffff8d2c7e0effffffddffffffad7cffffffa8ffffffefffffffee4cffffff90ffffffe7ffffffca (32) mschap: Stepbuf p24 : 7656ffffffba1743125b11ffffffdb56ffffffd119ffffffa9ffffffa77fffffffbb5b3afffffffcffffffb6ffffffba216834 (32) mschap: ERROR: rlm_mschap: authentication failed - status = eUndefinedError (32) eap_mschapv2: [mschap] = reject (32) eap_mschapv2: } # authenticate = reject (32) eap: Sending EAP Failure (code 4) ID 1 length 4 (32) eap: Freeing handler (32) [eap] = reject (32) } # authenticate = reject (32) Failed to authenticate the user (32) Using Post-Auth-Type Reject (32) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (32) Post-Auth-Type REJECT { (32) sql: EXPAND .query (32) sql: --> .query (32) sql: Using query template 'query' rlm_sql (sql): Reserved connection (10) (32) sql: EXPAND %{User-Name} (32) sql: --> HWeissbrodt (32) sql: SQL-User-Name set to 'HWeissbrodt' (32) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (32) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'HWeissbrodt', '', 'Access-Reject', '2020-01-15 14:42:19') (32) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'HWeissbrodt', '', 'Access-Reject', '2020-01-15 14:42:19') (32) sql: SQL query returned: success (32) sql: 1 record(s) updated rlm_sql (sql): Released connection (10) (32) [sql] = ok (32) attr_filter.access_reject: EXPAND %{User-Name} (32) attr_filter.access_reject: --> HWeissbrodt (32) attr_filter.access_reject: Matched entry DEFAULT at line 11 (32) [attr_filter.access_reject] = updated (32) update outer.session-state { (32) &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: rlm_mschap: authentication failed - status = eUndefinedError' (32) } # update outer.session-state = noop (32) } # Post-Auth-Type REJECT = updated (32) } # server inner-tunnel (32) Virtual server sending reply (32) EAP-Message = 0x04010004 (32) Message-Authenticator = 0x00000000000000000000000000000000 (32) eap_ttls: Got tunneled Access-Reject (32) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (32) eap: Sending EAP Failure (code 4) ID 110 length 4 (32) eap: Failed in EAP select (32) [eap] = invalid (32) } # authenticate = invalid (32) Failed to authenticate the user (32) Using Post-Auth-Type Reject (32) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (32) Post-Auth-Type REJECT { (32) attr_filter.access_reject: EXPAND %{User-Name} (32) attr_filter.access_reject: --> HWeissbrodt (32) attr_filter.access_reject: Matched entry DEFAULT at line 11 (32) [attr_filter.access_reject] = updated (32) [eap] = noop (32) policy remove_reply_message_if_eap { (32) if (&reply:EAP-Message && &reply:Reply-Message) { (32) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (32) else { (32) [noop] = noop (32) } # else = noop (32) } # policy remove_reply_message_if_eap = noop (32) } # Post-Auth-Type REJECT = updated (32) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (32) Sending delayed response (32) Sent Access-Reject Id 33 from 192.168.10.15:1812 to 192.168.10.1:38494 length 44 (32) EAP-Message = 0x046e0004 (32) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. (25) Cleaning up request packet ID 26 with timestamp +201 (26) Cleaning up request packet ID 27 with timestamp +201 (27) Cleaning up request packet ID 28 with timestamp +201 (28) Cleaning up request packet ID 29 with timestamp +201 (29) Cleaning up request packet ID 30 with timestamp +201 (30) Cleaning up request packet ID 31 with timestamp +201 (31) Cleaning up request packet ID 32 with timestamp +201 (32) Cleaning up request packet ID 33 with timestamp +201 Ldap Search output: administrator@server raddb % ldapsearch -h 127.0.0.1 -vvv -b "uid=hweissbrodt,cn=users,dc=server,dc=intern,dc=corussoft,dc=de" -x -s sub "(objectclass=*)" ldap_initialize( ldap://127.0.0.1 ) filter: (objectclass=*) requesting: All userApplication attributes # extended LDIF # # LDAPv3 # base <uid=hweissbrodt,cn=users,dc=server,dc=intern,dc=corussoft,dc=de> with scope subtree # filter: (objectclass=*) # requesting: ALL # # HWeissbrodt, users, server.intern.corussoft.de dn: uid=HWeissbrodt,cn=users,dc=server,dc=intern,dc=corussoft,dc=de apple-keyword: CS apple-keyword: Entwickler cn: Hendrik Weissbrodt uid: HWeissbrodt mail: hendrik.weissbrodt(a)corussoft.de givenName: Hendrik uidNumber: 1037 gidNumber: 20 objectClass: person objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top objectClass: extensibleObject objectClass: apple-user apple-generateduid: AF5EBB25-A592-419A-AAE4-32B8D232230C loginShell: /bin/bash sn: Weissbrodt apple-user-homequota: 20000000000 authAuthority: ;ApplePasswordServer;<long hex stuff redacted> root@server.intern.corussoft.de:192.168.10.15 authAuthority: ;Kerberosv5;;HWeissbrodt(a)SERVER.INTERN.CORUSSOFT.DE;SERVER.INTE RN.CORUSSOFT.DE; altSecurityIdentities: Kerberos:HWeissbrodt@SERVER.INTERN.CORUSSOFT.DE apple-user-homeurl:: PGhvbWVfZGlyPjx1cmw+c21iOi8vc2VydmVyLmludGVybi5jb3J1c3NvZ nQuZGUvVXNlcnM8L3VybD48cGF0aD5IV2Vpc3Nicm9kdDwvcGF0aD48L2hvbWVfZGlyPg== homeDirectory: /Network/Servers/server.intern.corussoft.de/Volumes/Macintosh H D/Users/HWeissbrodt # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1

2 1

ERROR: Failed to create pair - failed to parse time string
by Никита Борисенков 04 Feb '20

04 Feb '20

Hello, everything works for me, but the messages in the debug output confuse me. (0) perl: ERROR: Failed to create pair - failed to parse time string "фев 4 2020 16:46:57 MSK" (0) perl: ERROR: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'фев 4 2020 16:46:57 MSK' I understand that the date string contains non-English letters. Is this attribute populated by the service itself? What can I configure to prevent these errors? FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/perl including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/sql including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/chap including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/control-socket including configuration file /etc/freeradius/3.0/sites-enabled/abills main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 262144 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes colourise = no msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### Debugger not attached # Creating Auth-Type = PAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = Perl radiusd: #### Instantiating modules #### modules { # Loaded module rlm_perl # Loading module "perl" from file /etc/freeradius/3.0/mods-enabled/perl perl { filename = "/usr/abills/libexec/rlm_perl.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_post_auth = "post_auth" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/3.0/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 0 login = "abills" password = <<< secret >>> radius_db = "abills" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "" default_user_profile = "" client_query = "SET sql_mode=''; SELECT ip, INET_NTOA(ip), CONCAT('NAS_', id), nas_type, DECODE(mng_password, '******') FROM nas GROUP BY ip" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = ".query" type { accounting-on { } accounting-off { } start { } interim-update { } stop { } } } post-auth { reference = ".query" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap instantiate { } # Instantiating module "perl" from file /etc/freeradius/3.0/mods-enabled/perl # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "sql" from file /etc/freeradius/3.0/mods-enabled/sql rlm_sql_mysql: libmysql version: 10.3.18 mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "abills" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 10 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'abills' on Localhost via UNIX socket, server version 10.3.18-MariaDB-0+deb10u1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 9 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'abills' on Localhost via UNIX socket, server version 10.3.18-MariaDB-0+deb10u1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 8 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'abills' on Localhost via UNIX socket, server version 10.3.18-MariaDB-0+deb10u1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 7 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'abills' on Localhost via UNIX socket, server version 10.3.18-MariaDB-0+deb10u1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 6 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'abills' on Localhost via UNIX socket, server version 10.3.18-MariaDB-0+deb10u1, protocol version 10 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SET sql_mode=''; SELECT ip, INET_NTOA(ip), CONCAT('NAS_', id), nas_type, DECODE(mng_password, '******') FROM nas GROUP BY ip rlm_sql (sql): Reserved connection (0) rlm_sql (sql): Executing select query: SET sql_mode=''; SELECT ip, INET_NTOA(ip), CONCAT('NAS_', id), nas_type, DECODE(mng_password, '******') FROM nas GROUP BY ip rlm_sql (sql): Adding client 10.8.0.2 (NAS_6) to global clients list rlm_sql (10.8.0.2): Client "NAS_6" (sql) added rlm_sql (sql): Adding client 10.8.0.3 (NAS_7) to global clients list rlm_sql (10.8.0.3): Client "NAS_7" (sql) added rlm_sql (sql): Adding client 10.8.0.4 (NAS_8) to global clients list rlm_sql (10.8.0.4): Client "NAS_8" (sql) added rlm_sql (sql): Adding client 192.168.1.2 (NAS_9) to global clients list rlm_sql (192.168.1.2): Client "NAS_9" (sql) added rlm_sql (sql): Adding client 192.168.1.3 (NAS_4) to global clients list rlm_sql (192.168.1.3): Client "NAS_4" (sql) added rlm_sql (sql): Adding client 192.168.1.4 (NAS_1) to global clients list rlm_sql (192.168.1.4): Client "NAS_1" (sql) added rlm_sql (sql): Released connection (0) # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server default { # from file /etc/freeradius/3.0/sites-enabled/abills # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "control" listen { socket = "/var/run/freeradius/freeradius.sock" peercred = yes } } listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on command file /var/run/freeradius/freeradius.sock Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Ready to process requests (0) Received Accounting-Request Id 107 from 192.168.1.2:59720 to 62.109.17.189:1813 length 164 (0) Acct-Session-Id = "5E39757A55C400" (0) User-Name = "bna-test" (0) Acct-Status-Type = Stop (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) Acct-Authentic = RADIUS (0) Acct-Session-Time = 87 (0) Acct-Output-Octets = 0 (0) Acct-Input-Octets = 0 (0) Acct-Output-Packets = 0 (0) Acct-Input-Packets = 0 (0) Calling-Station-Id = "2E:8E:B0:85:1F:9C" (0) NAS-Port-Type = Async (0) Acct-Terminate-Cause = User-Request (0) Framed-IP-Address = 10.67.15.11 (0) NAS-Identifier = "shatsk-server" (0) NAS-Port = 365 (0) Acct-Delay-Time = 0 (0) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/abills (0) preacct { (0) [preprocess] = ok (0) } # preacct = ok (0) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/abills (0) accounting { (0) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'bna-test' (0) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '192.168.1.2' (0) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '365' (0) perl: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' (0) perl: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' (0) perl: $RAD_REQUEST{'Framed-IP-Address'} = &request:Framed-IP-Address -> '10.67.15.11' (0) perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '2E:8E:B0:85:1F:9C' (0) perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'shatsk-server' (0) perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Async' (0) perl: $RAD_REQUEST{'Acct-Status-Type'} = &request:Acct-Status-Type -> 'Stop' (0) perl: $RAD_REQUEST{'Acct-Delay-Time'} = &request:Acct-Delay-Time -> '0' (0) perl: $RAD_REQUEST{'Acct-Input-Octets'} = &request:Acct-Input-Octets -> '0' (0) perl: $RAD_REQUEST{'Acct-Output-Octets'} = &request:Acct-Output-Octets -> '0' (0) perl: $RAD_REQUEST{'Acct-Session-Id'} = &request:Acct-Session-Id -> '5E39757A55C400' (0) perl: $RAD_REQUEST{'Acct-Authentic'} = &request:Acct-Authentic -> 'RADIUS' (0) perl: $RAD_REQUEST{'Acct-Session-Time'} = &request:Acct-Session-Time -> '87' (0) perl: $RAD_REQUEST{'Acct-Input-Packets'} = &request:Acct-Input-Packets -> '0' (0) perl: $RAD_REQUEST{'Acct-Output-Packets'} = &request:Acct-Output-Packets -> '0' (0) perl: $RAD_REQUEST{'Acct-Terminate-Cause'} = &request:Acct-Terminate-Cause -> 'User-Request' (0) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'фев 4 2020 16:46:57 MSK' (0) perl: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' (0) perl: &request:OUTBYTE = $RAD_REQUEST{'OUTBYTE'} -> '0' (0) perl: &request:Acct-Output-Packets = $RAD_REQUEST{'Acct-Output-Packets'} -> '0' (0) perl: &request:OUTBYTE2 = $RAD_REQUEST{'OUTBYTE2'} -> '0' (0) perl: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' (0) perl: &request:Acct-Delay-Time = $RAD_REQUEST{'Acct-Delay-Time'} -> '0' (0) perl: &request:Acct-Output-Gigawords = $RAD_REQUEST{'Acct-Output-Gigawords'} -> '0' (0) perl: &request:Acct-Session-Time = $RAD_REQUEST{'Acct-Session-Time'} -> '87' (0) perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'shatsk-server' (0) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '365' (0) perl: &request:INBYTE2 = $RAD_REQUEST{'INBYTE2'} -> '0' (0) perl: &request:INTERIUM_INBYTE = $RAD_REQUEST{'INTERIUM_INBYTE'} -> '0' (0) perl: &request:Acct-Status-Type = $RAD_REQUEST{'Acct-Status-Type'} -> 'Stop' (0) perl: &request:Acct-Output-Octets = $RAD_REQUEST{'Acct-Output-Octets'} -> '0' (0) perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Async' (0) perl: &request:Acct-Input-Packets = $RAD_REQUEST{'Acct-Input-Packets'} -> '0' (0) perl: &request:INBYTE = $RAD_REQUEST{'INBYTE'} -> '0' (0) perl: &request:Acct-Input-Octets = $RAD_REQUEST{'Acct-Input-Octets'} -> '0' (0) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '192.168.1.2' (0) perl: ERROR: Failed to create pair - failed to parse time string "фев 4 2020 16:46:57 MSK" (0) perl: ERROR: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'фев 4 2020 16:46:57 MSK' (0) perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '2E:8E:B0:85:1F:9C' (0) perl: &request:Acct-Authentic = $RAD_REQUEST{'Acct-Authentic'} -> 'RADIUS' (0) perl: &request:Framed-IP-Address = $RAD_REQUEST{'Framed-IP-Address'} -> '10.67.15.11' (0) perl: &request:INTERIUM_OUTBYTE2 = $RAD_REQUEST{'INTERIUM_OUTBYTE2'} -> '0' (0) perl: &request:Acct-Input-Gigawords = $RAD_REQUEST{'Acct-Input-Gigawords'} -> '0' (0) perl: &request:Acct-Terminate-Cause = $RAD_REQUEST{'Acct-Terminate-Cause'} -> '1' (0) perl: &request:Connect-Info = $RAD_REQUEST{'Connect-Info'} -> '' (0) perl: &request:Acct-Session-Id = $RAD_REQUEST{'Acct-Session-Id'} -> '5E39757A55C400' (0) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'bna-test' (0) perl: &request:INTERIUM_INBYTE2 = $RAD_REQUEST{'INTERIUM_INBYTE2'} -> '0' (0) perl: &request:INTERIUM_OUTBYTE = $RAD_REQUEST{'INTERIUM_OUTBYTE'} -> '0' (0) [perl] = ok (0) } # accounting = ok (0) Sent Accounting-Response Id 107 from 62.109.17.189:1813 to 192.168.1.2:59720 length 0 (0) Finished request (0) Cleaning up request packet ID 107 with timestamp +6 Ready to process requests (1) Received Access-Request Id 110 from 192.168.1.2:35706 to 62.109.17.189:1812 length 164 (1) Service-Type = Framed-User (1) Framed-Protocol = PPP (1) User-Name = "bna-test" (1) MS-CHAP-Challenge = 0x250079a903f6fdb042702a7fcf7b41de (1) MS-CHAP2-Response = 0x92005b396472ca00be8c9d98052d085b190f0000000000000000c22d93428f3bee0caf1819dc34561f6a9f89d2b9604a0d2c (1) Calling-Station-Id = "2E:8E:B0:85:1F:9C" (1) NAS-Identifier = "shatsk-server" (1) NAS-Port = 354 (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/abills (1) authorize { (1) [preprocess] = ok (1) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (1) [mschap] = ok (1) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'bna-test' (1) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '192.168.1.2' (1) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '354' (1) perl: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' (1) perl: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' (1) perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '2E:8E:B0:85:1F:9C' (1) perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'shatsk-server' (1) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'фев 4 2020 16:47:01 MSK' (1) perl: $RAD_REQUEST{'MS-CHAP-Challenge'} = &request:MS-CHAP-Challenge -> '0x250079a903f6fdb042702a7fcf7b41de' (1) perl: $RAD_REQUEST{'MS-CHAP2-Response'} = &request:MS-CHAP2-Response -> '0x92005b396472ca00be8c9d98052d085b190f0000000000000000c22d93428f3bee0caf1819dc34561f6a9f89d2b9604a0d2c' (1) perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'MS-CHAP' (1) perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'MS-CHAP' (1) perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '2E:8E:B0:85:1F:9C' (1) perl: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' (1) perl: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' (1) perl: &request:MS-CHAP2-Response = $RAD_REQUEST{'MS-CHAP2-Response'} -> '0x92005b396472ca00be8c9d98052d085b190f0000000000000000c22d93428f3bee0caf1819dc34561f6a9f89d2b9604a0d2c' (1) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '192.168.1.2' (1) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'bna-test' (1) perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'shatsk-server' (1) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '354' (1) perl: &request:MS-CHAP-Challenge = $RAD_REQUEST{'MS-CHAP-Challenge'} -> '0x250079a903f6fdb042702a7fcf7b41de' (1) perl: ERROR: Failed to create pair - failed to parse time string "фев 4 2020 16:47:01 MSK" (1) perl: ERROR: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'фев 4 2020 16:47:01 MSK' (1) perl: &control:Cleartext-Password = $RAD_CHECK{'Cleartext-Password'} -> '********' (1) perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'MS-CHAP' (1) [perl] = ok (1) } # authorize = ok (1) Found Auth-Type = MS-CHAP (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/abills (1) Auth-Type MS-CHAP { (1) mschap: Found Cleartext-Password, hashing to create NT-Password (1) mschap: Found Cleartext-Password, hashing to create LM-Password (1) mschap: Creating challenge hash with username: bna-test (1) mschap: Client is using MS-CHAPv2 (1) mschap: Adding MS-CHAPv2 MPPE keys (1) [mschap] = ok (1) } # Auth-Type MS-CHAP = ok (1) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/abills (1) post-auth { (1) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'bna-test' (1) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '192.168.1.2' (1) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '354' (1) perl: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' (1) perl: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' (1) perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '2E:8E:B0:85:1F:9C' (1) perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'shatsk-server' (1) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'янв 1 1970 03:00:00 MSK' (1) perl: $RAD_REQUEST{'MS-CHAP-Challenge'} = &request:MS-CHAP-Challenge -> '0x250079a903f6fdb042702a7fcf7b41de' (1) perl: $RAD_REQUEST{'MS-CHAP2-Response'} = &request:MS-CHAP2-Response -> '0x92005b396472ca00be8c9d98052d085b190f0000000000000000c22d93428f3bee0caf1819dc34561f6a9f89d2b9604a0d2c' (1) perl: $RAD_REPLY{'MS-MPPE-Encryption-Policy'} = &reply:MS-MPPE-Encryption-Policy -> 'Encryption-Allowed' (1) perl: $RAD_REPLY{'MS-MPPE-Encryption-Types'} = &reply:MS-MPPE-Encryption-Types -> 'RC4-40or128-bit-Allowed' (1) perl: $RAD_REPLY{'MS-MPPE-Send-Key'} = &reply:MS-MPPE-Send-Key -> '0x77a85433b9d374eb3be839925778140e' (1) perl: $RAD_REPLY{'MS-MPPE-Recv-Key'} = &reply:MS-MPPE-Recv-Key -> '0x9e8ff9f5ba2c8bae072bbf86ecfca77f' (1) perl: $RAD_REPLY{'MS-CHAP2-Success'} = &reply:MS-CHAP2-Success -> '0x92533d45463644433939323744354344353046363432303744303535383330363444314438304241433042' (1) perl: $RAD_CHECK{'Auth-Type'} = &control:Auth-Type -> 'MS-CHAP' (1) perl: $RAD_CHECK{'LM-Password'} = &control:LM-Password -> '0x0b2de211d6157ab01104594f8c2ef12b' (1) perl: $RAD_CHECK{'NT-Password'} = &control:NT-Password -> '0xd28f6c50f12c6793b10bad32a40e7c23' (1) perl: $RAD_CHECK{'Cleartext-Password'} = &control:Cleartext-Password -> '********' (1) perl: $RAD_CONFIG{'Auth-Type'} = &control:Auth-Type -> 'MS-CHAP' (1) perl: $RAD_CONFIG{'LM-Password'} = &control:LM-Password -> '0x0b2de211d6157ab01104594f8c2ef12b' (1) perl: $RAD_CONFIG{'NT-Password'} = &control:NT-Password -> '0xd28f6c50f12c6793b10bad32a40e7c23' (1) perl: $RAD_CONFIG{'Cleartext-Password'} = &control:Cleartext-Password -> '********' (1) perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '2E:8E:B0:85:1F:9C' (1) perl: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' (1) perl: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' (1) perl: &request:MS-CHAP2-Response = $RAD_REQUEST{'MS-CHAP2-Response'} -> '0x92005b396472ca00be8c9d98052d085b190f0000000000000000c22d93428f3bee0caf1819dc34561f6a9f89d2b9604a0d2c' (1) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '192.168.1.2' (1) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'bna-test' (1) perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'shatsk-server' (1) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '354' (1) perl: &request:MS-CHAP-Challenge = $RAD_REQUEST{'MS-CHAP-Challenge'} -> '0x250079a903f6fdb042702a7fcf7b41de' (1) perl: ERROR: Failed to create pair - failed to parse time string "янв 1 1970 03:00:00 MSK" (1) perl: ERROR: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'янв 1 1970 03:00:00 MSK' (1) perl: &reply:PPPD-Downstream-Speed-Limit = $RAD_REPLY{'PPPD-Downstream-Speed-Limit'} -> '8192' (1) perl: &reply:MS-MPPE-Encryption-Types = $RAD_REPLY{'MS-MPPE-Encryption-Types'} -> 'RC4-40or128-bit-Allowed' (1) perl: &reply:MS-CHAP2-Success = $RAD_REPLY{'MS-CHAP2-Success'} -> '0x92533d45463644433939323744354344353046363432303744303535383330363444314438304241433042' (1) perl: &reply:MS-MPPE-Send-Key = $RAD_REPLY{'MS-MPPE-Send-Key'} -> '0x77a85433b9d374eb3be839925778140e' (1) perl: &reply:Framed-IP-Address = $RAD_REPLY{'Framed-IP-Address'} -> '10.67.15.11' (1) perl: &reply:MS-MPPE-Encryption-Policy = $RAD_REPLY{'MS-MPPE-Encryption-Policy'} -> 'Encryption-Allowed' (1) perl: &reply:MS-MPPE-Recv-Key = $RAD_REPLY{'MS-MPPE-Recv-Key'} -> '0x9e8ff9f5ba2c8bae072bbf86ecfca77f' (1) perl: &reply:Acct-Interim-Interval = $RAD_REPLY{'Acct-Interim-Interval'} -> '60' (1) perl: &reply:User-Name = $RAD_REPLY{'User-Name'} -> 'bna-test' (1) perl: &reply:PPPD-Upstream-Speed-Limit = $RAD_REPLY{'PPPD-Upstream-Speed-Limit'} -> '8192' (1) perl: &reply:Framed-IP-Netmask = $RAD_REPLY{'Framed-IP-Netmask'} -> '255.255.255.255' (1) perl: &reply:PPPD-Abills-UID = $RAD_REPLY{'PPPD-Abills-UID'} -> '1319' (1) perl: &control:LM-Password = $RAD_CHECK{'LM-Password'} -> '0x0b2de211d6157ab01104594f8c2ef12b' (1) perl: &control:Cleartext-Password = $RAD_CHECK{'Cleartext-Password'} -> '********' (1) perl: &control:Auth-Type = $RAD_CHECK{'Auth-Type'} -> 'MS-CHAP' (1) perl: &control:NT-Password = $RAD_CHECK{'NT-Password'} -> '0xd28f6c50f12c6793b10bad32a40e7c23' (1) [perl] = ok (1) } # post-auth = ok (1) Login OK: [bna-test/<via Auth-Type = MS-CHAP>] (from client NAS_9 port 354 cli 2E:8E:B0:85:1F:9C) (1) Sent Access-Accept Id 110 from 62.109.17.189:1812 to 192.168.1.2:35706 length 0 (1) PPPD-Downstream-Speed-Limit = 8192 (1) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (1) MS-CHAP2-Success = 0x92533d45463644433939323744354344353046363432303744303535383330363444314438304241433042 (1) MS-MPPE-Send-Key = 0x77a85433b9d374eb3be839925778140e (1) Framed-IP-Address = 10.67.15.11 (1) MS-MPPE-Encryption-Policy = Encryption-Allowed (1) MS-MPPE-Recv-Key = 0x9e8ff9f5ba2c8bae072bbf86ecfca77f (1) Acct-Interim-Interval = 60 (1) User-Name = "bna-test" (1) PPPD-Upstream-Speed-Limit = 8192 (1) Framed-IP-Netmask = 255.255.255.255 (1) PPPD-Abills-UID = 1319 (1) Finished request Waking up in 4.9 seconds. (2) Received Accounting-Request Id 111 from 192.168.1.2:33964 to 62.109.17.189:1813 length 128 (2) Acct-Session-Id = "5E3975D556A200" (2) User-Name = "bna-test" (2) Acct-Status-Type = Start (2) Service-Type = Framed-User (2) Framed-Protocol = PPP (2) Calling-Station-Id = "2E:8E:B0:85:1F:9C" (2) Acct-Authentic = RADIUS (2) NAS-Port-Type = Async (2) Framed-IP-Address = 10.67.15.11 (2) NAS-Identifier = "shatsk-server" (2) NAS-Port = 354 (2) Acct-Delay-Time = 0 (2) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/abills (2) preacct { (2) [preprocess] = ok (2) } # preacct = ok (2) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/abills (2) accounting { (2) perl: $RAD_REQUEST{'User-Name'} = &request:User-Name -> 'bna-test' (2) perl: $RAD_REQUEST{'NAS-IP-Address'} = &request:NAS-IP-Address -> '192.168.1.2' (2) perl: $RAD_REQUEST{'NAS-Port'} = &request:NAS-Port -> '354' (2) perl: $RAD_REQUEST{'Service-Type'} = &request:Service-Type -> 'Framed-User' (2) perl: $RAD_REQUEST{'Framed-Protocol'} = &request:Framed-Protocol -> 'PPP' (2) perl: $RAD_REQUEST{'Framed-IP-Address'} = &request:Framed-IP-Address -> '10.67.15.11' (2) perl: $RAD_REQUEST{'Calling-Station-Id'} = &request:Calling-Station-Id -> '2E:8E:B0:85:1F:9C' (2) perl: $RAD_REQUEST{'NAS-Identifier'} = &request:NAS-Identifier -> 'shatsk-server' (2) perl: $RAD_REQUEST{'NAS-Port-Type'} = &request:NAS-Port-Type -> 'Async' (2) perl: $RAD_REQUEST{'Acct-Status-Type'} = &request:Acct-Status-Type -> 'Start' (2) perl: $RAD_REQUEST{'Acct-Delay-Time'} = &request:Acct-Delay-Time -> '0' (2) perl: $RAD_REQUEST{'Acct-Session-Id'} = &request:Acct-Session-Id -> '5E3975D556A200' (2) perl: $RAD_REQUEST{'Acct-Authentic'} = &request:Acct-Authentic -> 'RADIUS' (2) perl: $RAD_REQUEST{'Event-Timestamp'} = &request:Event-Timestamp -> 'фев 4 2020 16:47:01 MSK' (2) perl: &request:Framed-Protocol = $RAD_REQUEST{'Framed-Protocol'} -> 'PPP' (2) perl: &request:OUTBYTE = $RAD_REQUEST{'OUTBYTE'} -> '0' (2) perl: &request:OUTBYTE2 = $RAD_REQUEST{'OUTBYTE2'} -> '0' (2) perl: &request:Service-Type = $RAD_REQUEST{'Service-Type'} -> 'Framed-User' (2) perl: &request:Acct-Delay-Time = $RAD_REQUEST{'Acct-Delay-Time'} -> '0' (2) perl: &request:Acct-Output-Gigawords = $RAD_REQUEST{'Acct-Output-Gigawords'} -> '0' (2) perl: &request:Acct-Session-Time = $RAD_REQUEST{'Acct-Session-Time'} -> '0' (2) perl: &request:NAS-Identifier = $RAD_REQUEST{'NAS-Identifier'} -> 'shatsk-server' (2) perl: &request:NAS-Port = $RAD_REQUEST{'NAS-Port'} -> '354' (2) perl: &request:INBYTE2 = $RAD_REQUEST{'INBYTE2'} -> '0' (2) perl: &request:INTERIUM_INBYTE = $RAD_REQUEST{'INTERIUM_INBYTE'} -> '0' (2) perl: &request:Acct-Status-Type = $RAD_REQUEST{'Acct-Status-Type'} -> 'Start' (2) perl: &request:NAS-Port-Type = $RAD_REQUEST{'NAS-Port-Type'} -> 'Async' (2) perl: &request:INBYTE = $RAD_REQUEST{'INBYTE'} -> '0' (2) perl: &request:NAS-IP-Address = $RAD_REQUEST{'NAS-IP-Address'} -> '192.168.1.2' (2) perl: ERROR: Failed to create pair - failed to parse time string "фев 4 2020 16:47:01 MSK" (2) perl: ERROR: &request:Event-Timestamp = $RAD_REQUEST{'Event-Timestamp'} -> 'фев 4 2020 16:47:01 MSK' (2) perl: &request:Acct-Authentic = $RAD_REQUEST{'Acct-Authentic'} -> 'RADIUS' (2) perl: &request:Calling-Station-Id = $RAD_REQUEST{'Calling-Station-Id'} -> '2E:8E:B0:85:1F:9C' (2) perl: &request:Framed-IP-Address = $RAD_REQUEST{'Framed-IP-Address'} -> '10.67.15.11' (2) perl: &request:INTERIUM_OUTBYTE2 = $RAD_REQUEST{'INTERIUM_OUTBYTE2'} -> '0' (2) perl: &request:Acct-Input-Gigawords = $RAD_REQUEST{'Acct-Input-Gigawords'} -> '0' (2) perl: &request:Acct-Session-Id = $RAD_REQUEST{'Acct-Session-Id'} -> '5E3975D556A200' (2) perl: &request:Connect-Info = $RAD_REQUEST{'Connect-Info'} -> '' (2) perl: &request:User-Name = $RAD_REQUEST{'User-Name'} -> 'bna-test' (2) perl: &request:INTERIUM_INBYTE2 = $RAD_REQUEST{'INTERIUM_INBYTE2'} -> '0' (2) perl: &request:INTERIUM_OUTBYTE = $RAD_REQUEST{'INTERIUM_OUTBYTE'} -> '0' (2) [perl] = ok (2) } # accounting = ok (2) Sent Accounting-Response Id 111 from 62.109.17.189:1813 to 192.168.1.2:33964 length 0 (2) Finished request (2) Cleaning up request packet ID 111 with timestamp +10 Waking up in 4.9 seconds. (1) Cleaning up request packet ID 110 with timestamp +10 Ready to process requests

2 1

Re: Grant access to a groups of users to a determinated subnets
by Condor 04 Feb '20

04 Feb '20

Sorry for ask again, there is an alternative to hunt group regex for subnet? unlang is possible maybe, but i don't understand how to use it. Someone could please point me some example Thanks! On Tuesday, January 28, 2020, 08:41:50 AM GMT-3, Condor <condor_bulto(a)yahoo.com> wrote: Hi all, sorry for bother again, i like to grant access to a groups of users to a determinated subnets. For example: In clients: client 192.168.0.0/16 { ipaddr = 192.168.0.0/16 shortname = LAN secret = ****} In users: test003 Crypt-Password := "$1$Z71rzgee$ZIJbcaMDyHtUtKN/", Huntgroup-Name == gNetworking, Huntgroup-Name == Servers Auth-Type = System, Service-Type = Login, Reply-Message = "Hello Test003", (user: test003 belong to two huntgroups) In huntgroups:Servers NAS-IP-Address =~ "/^172\.16\.0\.(1?\d\d?|2[0-4]\d|25[0-5])$/" gNetworking NAS-IP-Address =~ /^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])$/ Trying also (gNetworking NAS-IP-Address =~ "/^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])$/")Trying also (gNetworking NAS-IP-Address =~ ^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])) Trying also (gNetworking NAS-IP-Address =~ ^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5]), NAS-Group := "networking") I get this error "Parse error (check) for entry gNetworking: Expected end of line or comma", or not work anyway Using this to verify the regex: https://regex101.com/ Following this thread: http://freeradius.1045715.n5.nabble.com/Matching-a-value-within-an-IP-subne… Using:FreeRADIUS Version 3.0.4 Any idea? Thanks! On Monday, January 27, 2020, 10:38:12 AM GMT-3, Condor via Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: Hi all, sorry for bother again, i like to grant access to a groups of users to a determinated subnets. For example: In clients: client 192.168.0.0/16 { ipaddr = 192.168.0.0/16 shortname = LAN secret = ****} In users: test003 Crypt-Password := "$1$Z71rzgee$ZIJbcaMDyHtUtKN/", Huntgroup-Name == gNetworking, Huntgroup-Name == Servers Auth-Type = System, Service-Type = Login, Reply-Message = "Hello Test003", (user: test003 belong to two huntgroups) In huntgroups:Servers NAS-IP-Address =~ "/^172\.16\.0\.(1?\d\d?|2[0-4]\d|25[0-5])$/" gNetworking NAS-IP-Address =~ /^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])$/ Trying also (gNetworking NAS-IP-Address =~ "/^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])$/")Trying also (gNetworking NAS-IP-Address =~ ^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5])) Trying also (gNetworking NAS-IP-Address =~ ^192\.168\.(1?\d\d?|2[0-4]\d|25[0-5])\.(1?\d\d?|2[0-4]\d|25[0-5]), NAS-Group := "networking") I get this error "Parse error (check) for entry gNetworking: Expected end of line or comma", or not work anyway Using this to verify the regex: https://regex101.com/ Following this thread: http://freeradius.1045715.n5.nabble.com/Matching-a-value-within-an-IP-subne… Using:FreeRADIUS Version 3.0.4 Any idea? Thanks! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 10

Re: Freeradius-Users Digest, Vol 178, Issue 5
by Ted Hyde (RSI) 03 Feb '20

03 Feb '20

Greets - is there a way in unlang to test against attributes created after a 'files' module? Not sure if I'm asking that correctly, so here's what I'm trying to do: SSID: test1 -- EAP-TLS only with cert loaded on supplicant, no further auth (my usual setup) SSID: test2 -- EAP-TTLS with mac auth and user-name/pwd auth to restrict unauthorized Apple clients (like watches) SSID: test3 -- EAP-TTLS with only user-name/pwd for a guest access portal. clients associating with test1 only associate with test 1 (since they are the only ones with a cert pre-installed and choose eap-tls mode to make it work, thus no user/pwd/mac filtering needed), usernames from 'test2' shall be permitted to ONLY associate with test2, and usernames for test3 shall be permitted to ONLY associate with test3. IF a client attempts associating with test2 and has a valid username/pwd in eap-ttls mode, then its mac is checked against a separate file (auth_macs) for final permission. I've been testing this out with manually-typed entries in nested if/switch statements with success, however I would "like" to be able to set my own VSA in the users file (or authorize file, since this is FR3) and be able to test against it inside of my default virtual-server: >>>>>>>eg "files/authorize" (assuming "My-Allowed-SSID is in the dictionary correctly): myusername Cleartext-Password := "mypassword" My-Allowed-SSID = "test2" >>>>>>>>>and in "mods-enabled/files" appending: files authorized_macs { key = "%{Calling-Station-ID}" usersfile = ${confdir}/authorized_macs } >>>>>>>>>in "${confdir}/authorized_macs": 50-F0-D3-10-B5-CA Reply-Message = "Device authorized". >>>>>>>>>and in "sites-enabled/default": if (Eap-Message) { ... if (Cisco-AVPair[0] == "ssid=test2") { authorized_macs if (ok) { <<< some method of calling files and testing if UserName matches Password and returning value of My-Allowed-SSID, and testing against = test2 >>> if (<<<ok and My-Allowed-SSID == "test2">>>) { eap } } } ... } I will eventually roll this over to a postgres db, but want to "make it work in the simple mode first". So far I have not been able to figure out how I would reference an attribute after calling a lookup from "files" or similar; the docs I am reading (network... and wiki.free....) point to module responses being mostly enumerated responses, not something that can contain dynamic responses and later parsed... Realizing this is a hugely complex question, and certainly not the only way to go about getting to the goal, this is also half-learn-more-about-FR than just a task for the office. Is there a way of having a separate "users" file (or files/authorize) that is queried after eap but does double-duty of the authorized_macs and username/pwd? The pwd for an account that has a restricted mac filter will be one-to-one (one mac, one u/p, one SSID combination). Regards, Ted.

2 1

DHCP relay port
by Talkabout 03 Feb '20

03 Feb '20

Hi all, I would like to use the dhcp relay feature of the freeradius Server but Need to use a different relay port to relay Messages to. Is there a way to Change the Destination port? Thanks Gesendet von Mail für Windows 10

2 2