- Freeradius-Users - lists.freeradius.org

SQL Module not Enabling
by Mark Kohler 31 Jan '20

31 Jan '20

I am attempting to enable the SQL module on a freeradius server I have hosted on my local computer, but I can't seem to get it to work. output of radiusd -x FreeRADIUS Version 3.0.21 Copyright (C) 1999-2019 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/detail including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/accounting including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "no" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_cache # Loading module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } instantiate { } # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "bangpath" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Please use tls_min_version and tls_max_version instead of disable_tlsv1 Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /usr/local/etc/raddb/sites-enabled/inner-tunnel:336 } # server inner-tunnel server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 32952 Listening on proxy address :: port 33980 Ready to process requests contents of mods-enabled total 0 lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 always -> ../mods-available/always lrwxrwxrwx 1 freerad freerad 29 Jan 30 14:52 attr_filter -> ../mods-available/attr_filter lrwxrwxrwx 1 freerad freerad 27 Jan 30 14:52 cache_eap -> ../mods-available/cache_eap lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 chap -> ../mods-available/chap lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 detail -> ../mods-available/detail lrwxrwxrwx 1 freerad freerad 28 Jan 30 14:52 detail.log -> ../mods-available/detail.log lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 digest -> ../mods-available/digest lrwxrwxrwx 1 freerad freerad 33 Jan 30 14:52 dynamic_clients -> ../mods-available/dynamic_clients lrwxrwxrwx 1 freerad freerad 21 Jan 30 14:52 eap -> ../mods-available/eap lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 echo -> ../mods-available/echo lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 exec -> ../mods-available/exec lrwxrwxrwx 1 freerad freerad 28 Jan 30 14:52 expiration -> ../mods-available/expiration lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 expr -> ../mods-available/expr lrwxrwxrwx 1 freerad freerad 23 Jan 30 14:52 files -> ../mods-available/files lrwxrwxrwx 1 freerad freerad 25 Jan 30 14:52 linelog -> ../mods-available/linelog lrwxrwxrwx 1 freerad freerad 27 Jan 30 14:52 logintime -> ../mods-available/logintime lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 mschap -> ../mods-available/mschap lrwxrwxrwx 1 freerad freerad 27 Jan 30 14:52 ntlm_auth -> ../mods-available/ntlm_auth lrwxrwxrwx 1 freerad freerad 21 Jan 30 14:52 pap -> ../mods-available/pap lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 passwd -> ../mods-available/passwd lrwxrwxrwx 1 freerad freerad 28 Jan 30 14:52 preprocess -> ../mods-available/preprocess lrwxrwxrwx 1 freerad freerad 25 Jan 30 14:52 radutmp -> ../mods-available/radutmp lrwxrwxrwx 1 freerad freerad 23 Jan 30 14:52 realm -> ../mods-available/realm lrwxrwxrwx 1 freerad freerad 27 Jan 30 14:52 replicate -> ../mods-available/replicate lrwxrwxrwx 1 freerad freerad 21 Jan 30 14:52 soh -> ../mods-available/soh lrwxrwxrwx 1 freerad freerad 21 Jan 31 10:49 sql -> ../mods-available/sql lrwxrwxrwx 1 freerad freerad 26 Jan 30 14:52 sradutmp -> ../mods-available/sradutmp lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 unix -> ../mods-available/unix lrwxrwxrwx 1 freerad freerad 24 Jan 30 14:52 unpack -> ../mods-available/unpack lrwxrwxrwx 1 freerad freerad 22 Jan 30 14:52 utf8 -> ../mods-available/utf8

2 1

rlm_rest learnings - PAP and PEAP/MSCHAPv2
by Lang, Russell 30 Jan '20

30 Jan '20

Thanks to Arran for his hints on calling a REST API from FreeRADIUS. rlm_rest is working, doing authentication for WPA2-Personal (PAP via captive portal) and WPA2-Enterprise Wi-Fi clients (PEAP/MSCHAPv2). Using FreeRADIUS 3.0.16 (Ubuntu 18.04). PAP is handled in the default site, while the MSCHAP2 part of PEAP/MSCHAP2 is handled in the inner-tunnel. The trick is preventing the REST API from being called in the default site with EAP outer messages, which would result in 9 unwanted API calls. The authorize REST API code does pre-authentication and if it passes it returns the NT-Password or Cleartext-Password as appropriate. To find out if the user was authenticated, a post-auth REST API is used to log success/failure. rest module configuration: authorize { uri = "RADIUS_API_PATH/radius?action=authorize" method = 'post' body = 'json' auth = 'basic' username = 'RADIUS_API_USER' password = 'RADIUS_API_PASSWORD' } post-auth { uri = "RADIUS_API_PATH/radius?action=post-auth&result=%{control:Post-Auth-Type}" # result is either '' or 'Reject' ... } API pseudo code for authorize: if pre-authenticated if mschap return { "control:NT-Password": {"type":"octets","value":[ "0x0123456789ABCDEF0123456789ABCDEF" ]}}, 200 else return { "control:Cleartext-Password": {"type":"string","value":[ "clear-text-password-here" ]}}, 200 else: return {}, 401 default site config: authorize { mschap eap { ok = return } if (!ok && !updated) { # Only call rest if not handled by EAP rest } pap } post-auth { ... if (!&reply:EAP-Message) { # Only call rest if not EAP rest } ... } inner-site config: authorize { mschap eap { ok = return } if (!ok && !updated) { # Only call rest if not already handled rest } pap } post-auth { ... rest ... } Issues: When doing PEAP/MSCHAPv2, the authorize REST API gets called twice in the inner-tunnel, for two different EAP messages. Wastes a few milliseconds, but only a minor issue. Using radtest -t mschap valid-user@domain invalid_password 127.0.0.1 0 radius_secret replied with MS-CHAP-Error = "\000E=691 R=1 C=ad8367a70f809d72 V=2" My reading of the MS-CHAP-V2 RFC2759 and PPP CHAP RFC1994 is that this should have been MS-CHAP-Error = "E=691 R=1 C=ad8367a70f809d72 V=2"

3 3

Dealing with Apple Watches?
by Ted Hyde (RSI) 30 Jan '20

30 Jan '20

Howdy - So I'm not an "Apple Guy". I tolerate them, I support them, but I don't own them. I recently redesigned one of our office networks to split up departments into vlans (something that was on my list for a long time and desperately needed), and after some labbing, rolled it out last week. I intentionally kept the wifi out of the main distribution loop because I needed to really find out what levels of security the staff would permit. While I would love to enforce full EAP-TLS (or TTLS) some of that is difficult with transient workers, staff, and of course some devices that don't support certificates. So to wrangle this, I created a dedicated subnet (a little /27) and made it wpa2-psk. Simple test just to keep the bare minimum going. Except after giving two people the pwd, I ran out of scope. This seemed odd, how could two people eat up some 28-odd ip addresses? First thought, they blabbed. Turns out they did tell "only a couple of other people" - which is exactly what I needed to find out in this test - a psk is useless security in the workplace. That still didn't account for everything. So I cleared out all the ip bindings and watched as all the clients re-acquired ip addresses. 28 gone in a heartbeat. There weren't 28 people in the building. Half of these folks were "very-Apple-people". That means iMac, Mac-top, ipad, watch, phone, backup watch, backup phone..... and they all of course (in hindsight it's obvious) use their devices in "Default" mode which means accepting all of Apple's recommendations without reading them. After clearing the scope and changing the password, I went and worked with one user directly, typed in the credential myself on her laptop. While I was holding her phone, I got interrupted, and when my attention went back to the phone, I saw that it had already connected - how did it get the new key? I'm sure at this moment there are 50 admins talking to the screen saying "oh, all Apple users can set their devices to share and automatically connect as a convenience" - an item that I was not aware of prior. I took the test a step further and was able to observe that another user has credentials automatically pop up to his icloud account, wherein his ENTIRE FAMILY gets the credential. Not good. Definitely not good. I'm sure this is happening in school campus scenarios where staff and students eat up scope from devices that shouldn't ever be permitted on a particular network, and since folks like the convenience, they sync their phones to their dtops, and no group policy is going to get in the way of that. Does anyone have a workable solution to controlling this above? Is it "some auth" + Mac Auth? Or is it "give up on control and just make huge networks so there's enough scope"? With decidedly less hair, many thanks, Ted.

3 2

802.1x radius issue
by Amardeep Singh 30 Jan '20

30 Jan '20

Hi Guys, While testing 802.1x in our lab we are getting the following error on radius: Debug: [mschap] No Cleartext-Password configured. Cannot create LM-Password. Debug: [mschap] No Cleartext-Password configured. Cannot create NT-Password. Debug: [mschap] Creating challenge hash with username: test951 Debug: [mschap] Client is using MS-CHAPv2 for test951, we need NT-Password Debug: [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. Debug: [mschap] FAILED: MS-CHAP2-Response is incorrect Debug: ++[mschap] = reject There are valid entries in the radius tables. select * from radcheck where username = 'test951'; +-----------+--------------+--------------------+----+--------------+ | id | username | attribute | op | value | +-----------+--------------+--------------------+----+--------------+ | 115850045 | jerrytest951 | Cleartext-Password | := | jerrytest951 | Please suggest! Thanks, Amardeep

5 8

Idle Timeout issues
by Philemon Jaomalaza 30 Jan '20

30 Jan '20

Hello, My users logged out after a few minutes of inactivity while I set Idle Timeout attributes to 86400 seconds. This is a FreeRadius or NAS or user device configuration problem? Thanks, JMLZ

2 1

Strange behaviour
by Ellad G. Yatsko 30 Jan '20

30 Jan '20

Hello! I faced a strange problem while setting up PEAP/TLS with FreeRADIUS as a Proxy for Windows NPS (2012R). Wireless Client -->> AccessPoint -->> FreeRADIUS -->> NPS (iOS,Android,Win) Cisco/Motorola/Unifi Ubuntu 16.04 Win2012R FreeRADIUS is set up and waiting for requests. When Wireless Client is trying to authenticate it seems FreeRADIUS tries to proxy request to NPS Request/Challenges begins and sometimes the process stucks in this exchange sometimes NPS and subsequently FreeRADIUS Access-Accepts and authenticates user. I supply relevant FreeRADIUS logs and I'm ready to provide configs and so on. May you help me to understand what's wrong with me? The impression FreeRADIUS interprets some packets incorrectly. The matter I think is in my settings which is got from numerous articles from Internet. FreeRADIUS Version 2.2.8 /etc/freeradius/sites-available/default: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ authorize { chap mschap digest ntdomain eap { ok = return } if ( ! (realm == "ponyex.local") ) { files if (noop) { sql if (notfound) { update control { Proxy-To-Realm := "ponyex.local" } } } } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } pre-proxy { update proxy-request { Connect-Info := "This is a Friendly-Name" } } /etc/freeradius/proxy.conf: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ home_server nps { type = auth ipaddr = 10.0.0.179 port = 1812 secret = *************************** require_message_authenticator = yes response_window = 20 zombie_period = 40 revive_interval = 120 status_check = request username = "test_user_please_reject_me" password = "this is really secret" num_answers_to_alive = 3 max_outstanding = 65536 } home_server_pool ponyex_pool { type = fail-over home_server = nps } realm ponyex.local { auth_pool = ponyex_pool nostrip } /etc/freeradius/eap.conf: ~~~~~~~~~~~~~~~~~~~~~~~~~ eap { default_eap_type = tls peap timer_expire = 60 tls { # Domains Cert/Key private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.crt CA_file = ${cadir}/ca.crt } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } mschapv2 { } /etc/freeradius/modules/mschap: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } /etc/freeradius/modules/realm: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } Kind regards, Ellad

3 2

Two different user-names while using computer authentification with client certificate
by uj2.hahn＠posteo.de 29 Jan '20

29 Jan '20

Hi! I have a question just for my understanding. I installed a Radius client certificate (RadiusClient) on a Win10 client and enabled user authentification on this WLAN profile. This all works fine. Just for my education I switched the client WLAN profile to computer (!) authentification (instead of user), just to see what will happen with freeradius. First thing I saw is: (7) Received Access-Request Id 152 from 192.168.188.45:37569 to 192.168.188.50:1812 length 226 (7) User-Name = "host/RadiusClient" (7) NAS-IP-Address = 192.168.1.245 (7) NAS-Port = 0 (7) Called-Station-Id = "88-90-8D-42-55-70:ciscosb" So User-Name changed from RadiusClient to host/RadiusClient which I understood. But later in the same session I saw: 7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state WAITING FOR INNER IDENTITY (7) eap_peap: Identity - host/DESKTOP-FLOQN5Q (7) eap_peap: Got inner identity 'host/DESKTOP-FLOQN5Q' (7) eap_peap: Setting default EAP type for tunneled EAP session (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x0207001901686f73742f4445534b544f502d464c4f514e3551 (7) eap_peap: Setting User-Name to host/DESKTOP-FLOQN5Q (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x0207001901686f73742f4445534b544f502d464c4f514e3551 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "host/DESKTOP-FLOQN5Q" (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x0207001901686f73742f4445534b544f502d464c4f514e3551 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "host/DESKTOP-FLOQN5Q" Now the User-Name is the real PC hostname "host/DESKTOP-FLOQN5Q". So it seems the outer and the inner tunnel see different User-Names. Is this on intention? Any chance to have one User-Name only, e.g. the client certificate name: RadiusClient. Thanks Uwe

3 4

Telling FR to conect to postres vi IPv4
by Alex Sharaz 29 Jan '20

29 Jan '20

Hi, Our database team have just migrated a postgres db from Ubuntu 15.04 -> 18.04 postgres 10 my FR server ( Ubuntu 16.04 / FR 3.0.20) has had dual ip stacks for ages but I guess the postgres db server hasn't The new server does have ipv6 and now FR is trying to connect to it via ipv6.... and is getting rejected Two options 1). Set postgres up to accept connections from the new ipv6 address 2). Tell the FR end to use ipv4 Fairly certain its not a FR thing but underlying postgres config. So how do I tell my FR server to connect via ipv4 ? Rgds A

2 2

module fails parsing output, expecting operator
by Richard Green 29 Jan '20

29 Jan '20

I am seeking help with an error parsing the output from an external exec program with FreeRADIUS 3 (a similar configuration, albeit some file movements for the updated config, worked without a problem with FreeRADIUS 2). The external exec program (/usr/local/bin/multiotp.php) seem to return a valid response (which is the same as for the working configuration for version 2), however FreeRADIUS 3 reports a parsing error at this point. I've been using successfully using FreeRADIUS 2 for a while with MultiOTP to provide an authentication component where the password is a TOTP token and the username is synchronised with an Active Directory and am attempting to upgrade to FreeRADIUS 3. My debug log is as follows: . . . (1) auth_log: --> Mon Jan 27 09:08:08 2020 (1) [auth_log] = ok (1) [chap] = noop (1) mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' (1) [mschap] = ok (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "johnboy", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) [expiration] = noop (1) [logintime] = noop (1) multiotp: Executing: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}: (1) multiotp: EXPAND %{User-Name} (1) multiotp: --> johnboy (1) multiotp: EXPAND %{User-Password} (1) multiotp: --> (1) multiotp: EXPAND -src=%{Packet-Src-IP-Address} (1) multiotp: --> -src=127.0.0.1 (1) multiotp: EXPAND -chap-challenge=%{CHAP-Challenge} (1) multiotp: --> -chap-challenge= (1) multiotp: EXPAND -chap-password=%{CHAP-Password} (1) multiotp: --> -chap-password= (1) multiotp: EXPAND -ms-chap-challenge=%{MS-CHAP-Challenge} (1) multiotp: --> -ms-chap-challenge=0x5c1ed153a00f704f [8/1872] (1) multiotp: EXPAND -ms-chap-response=%{MS-CHAP-Response} (1) multiotp: --> -ms-chap-response=0x0001000000000000000000000000000000000000000000000000e6a71cf3f91b0c6218c456823e92d63ff58359976f0c272a (1) multiotp: EXPAND -ms-chap2-response=%{MS-CHAP2-Response} (1) multiotp: --> -ms-chap2-response= (1) multiotp: ERROR: Failed parsing output from: /usr/local/bin/multiotp.php '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}: Expecting opera tor (1) multiotp: ERROR: Program returned code (0) and output 'Filter-Id += "Erica-Users",NT_KEY: EBEEE229885004ACEA55894DFDC1272D ' (1) [multiotp] = fail (1) } # authorize = fail (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { . . . (Note the wiki page https://wiki.freeradius.org/guide/multiOTP-HOWTO discusses version 3 but seems to reference version 2 file names, so is only useful as a guideline). Thanks! Richard Green UNSW Sydney

2 2

Can an EAP-over-RADIUS request ever result in an Access-Reject?
by Joe Garcia 28 Jan '20

28 Jan '20

The reason for that question is based on RFC 3579, section 3.2: It [Message-Authenticator] MUST be used in any Access-Request, Access- Accept, Access-Reject or Access-Challenge that includes an EAP-Message attribute. A RADIUS server receiving an Access-Request with a Message- Authenticator attribute present MUST calculate the correct value of the Message-Authenticator and silently discard the packet if it does not match the value sent. What this would mean in practice is that any EAP authentication request with an incorrect password will be silently dropped, so there's no possibility of ever seeing an Access-Reject. I know what the Message-Authenticator is meant for, but since I'm just using EAP as a transport layer for a TLS tunnel its presence is irrelevant. Is this behavior really how it works? How can you use an authentication mechanism for which the behavior for an incorrect password is indistinguishable from a network error? JG.

3 4